!3 fix CVE-2020-6950

From: @jackie_wu123
Reviewed-by: @wang_yue111,@wangchong1995924
Signed-off-by: @wangchong1995924

CVE-2020-6950.patch

@@ -0,0 +1,53 @@
+From 2cf4da6f346b57128724aa893d4f2c8e57e7ed2e Mon Sep 17 00:00:00 2001
+From: ruolli <ruolin.li@oracle.com>
+Date: Thu, 10 Jun 2021 15:52:22 +0800
+Subject: [PATCH] Multiple Path Traversal security issues
+
+---
+ .../sun/faces/application/resource/ClasspathResourceHelper.java | 2 +-
+ .../com/sun/faces/application/resource/ResourceManager.java     | 2 +-
+ .../sun/faces/application/resource/WebappResourceHelper.java    | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java b/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java
+index b50916e..57a5454 100644
+--- a/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java
++++ b/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java
+@@ -376,7 +376,7 @@ public class ClasspathResourceHelper extends ResourceHelper {
+         } else if (root == null) {
+             String contractName = ctx.getExternalContext().getRequestParameterMap()
+                   .get("con");
+-            if (null != contractName && 0 < contractName.length()) {
++            if (null != contractName && 0 < contractName.length() && !ResourceManager.nameContainsForbiddenSequence(contractName)) {
+                 contracts = new ArrayList<String>();
+                 contracts.add(contractName);
+             } else {
+diff --git a/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java b/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java
+index f904f9d..b714769 100644
+--- a/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java
++++ b/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java
+@@ -374,7 +374,7 @@ public class ResourceManager {
+ 
+     }
+     
+-    private static boolean nameContainsForbiddenSequence(String name) {
++    static boolean nameContainsForbiddenSequence(String name) {
+         boolean result = false;
+         if (name != null) {
+         name = name.toLowerCase();
+diff --git a/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java b/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java
+index 4ff422a..d420e7b 100644
+--- a/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java
++++ b/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java
+@@ -334,7 +334,7 @@ public class WebappResourceHelper extends ResourceHelper {
+         } else if (root == null) {
+             String contractName = ctx.getExternalContext().getRequestParameterMap()
+                   .get("con");
+-            if (null != contractName && 0 < contractName.length()) {
++            if (null != contractName && 0 < contractName.length() && !ResourceManager.nameContainsForbiddenSequence(contractName)) {
+                 contracts = new ArrayList<String>();
+                 contracts.add(contractName);
+             } else {
+-- 
+2.23.0
+

mojarra.spec

@@ -1,6 +1,6 @@
 Name:                mojarra
 Version:             2.2.13
-Release:             1
+Release:             2
 Summary:             JSF Reference Implementation
 License:             CDDL or GPLv2 with exceptions
 URL:                 http://javaserverfaces.java.net
@@ -20,6 +20,7 @@ Patch8:              mojarra-dont-use-namespace-alias.patch
 Patch9:              mojarra-servlet-3.1.patch
 Patch10:             mojarra-2.2.13-disable-references-to-com.sun.faces.spi.InjectionProvider.patch
 Patch11:             mojarra-2.2.13-disabling-stripping-API-jars.patch
+Patch12:             CVE-2020-6950.patch
 
 BuildArch:           noarch
 BuildRequires:       ant ant-contrib apache-commons-digester aqute-bnd atinject cdi-api
@@ -55,6 +56,7 @@ This package contains the API documentation for mojarra.
 %patch9 -p1
 %patch10 -p1
 %patch11 -p1
+%patch12 -p1
 sed -i "s|-f @{pomFile}|-o -f @{pomFile}|" common/ant/maven.xml common/ant/maven-pre-maven-rename.xml
 find . -name '*.class' -print -delete
 find . -name '*.jar' -print -delete
@@ -143,5 +145,8 @@ cp -rp jsf-ri/build/javadocs/* %{buildroot}%{_javadocdir}/mojarra/jsf-impl/.
 %license LICENSE
 
 %changelog
+* Thu Jun 10 2021 wutao <wutao61@huawei.com> - 2.2.13-2
+- fix CVE-2020-6950
+
 * Fri Sep 11 2020 huanghaitao <huanghaitao8@huawei.com> - 2.2.13-1
 - package init