From 20ff25a4a834029b71c6e9e76f961c2dbf557f1a Mon Sep 17 00:00:00 2001 From: zhanghua1831 Date: Sat, 20 Mar 2021 10:15:12 +0800 Subject: [PATCH] fix CVE-2020-13959 (cherry picked from commit f19649e16621465c788d8648aad250464ee1764c) --- CVE-2020-13959.patch | 25 +++++++++++++++++++++++++ velocity-tools.spec | 7 ++++++- 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 CVE-2020-13959.patch diff --git a/CVE-2020-13959.patch b/CVE-2020-13959.patch new file mode 100644 index 0000000..2d1fbd8 --- /dev/null +++ b/CVE-2020-13959.patch @@ -0,0 +1,25 @@ +From e141828a4eb03e4b0224535eed12b5c463a24152 Mon Sep 17 00:00:00 2001 +From: Jackson Henry <54763344+JHHAX@users.noreply.github.com> +Date: Thu, 8 Oct 2020 14:18:25 +1100 +Subject: [PATCH] Fixed Reflected XSS Vuln + +Velocity Tools has an automatically generated error page, which echoes back the file name unescaped. This commit sanitizes user input and fixes the XSS Vulnerability! + +Updated XSS Vuln fix (used StringEscapeUtils) +--- + .../org/apache/velocity/tools/view/VelocityViewServlet.java | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java b/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java +index aff9b71d7..325ab0bba 100644 +--- a/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java ++++ b/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java +@@ -460,7 +460,7 @@ protected void error(HttpServletRequest request, + html.append("Error\n"); + html.append("\n"); + html.append("

VelocityView : Error processing a template for path '"); +- html.append(path); ++ html.append(StringEscapeUtils.escapeHtml(path)); + html.append("'

\n"); + + Throwable cause = e; diff --git a/velocity-tools.spec b/velocity-tools.spec index dac0dbf..15cf00e 100644 --- a/velocity-tools.spec +++ b/velocity-tools.spec @@ -1,6 +1,6 @@ Name: velocity-tools Version: 2.0 -Release: 2 +Release: 3 Summary: Collection of useful tools for Velocity template engine License: ASL 2.0 Url: http://velocity.apache.org/tools/releases/2.0/ @@ -9,6 +9,7 @@ Patch0: %{name}-%{version}-junit4.patch Patch1: %{name}-%{version}-dont_copy_test_lib.patch Patch2: %{name}-%{version}-servlet.patch Patch3: %{name}-%{version}-port-to-dom4j-2.0.patch +Patch4: CVE-2020-13959.patch BuildRequires: maven-local mvn(commons-beanutils:commons-beanutils) BuildRequires: mvn(commons-chain:commons-chain) mvn(commons-collections:commons-collections) BuildRequires: mvn(commons-digester:commons-digester) mvn(commons-lang:commons-lang) @@ -49,6 +50,7 @@ find . -name "*.class" -delete %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 sed -i 's/\r//' LICENSE NOTICE WHY_THREE_JARS.txt %pom_remove_dep javax.servlet:servlet-api %pom_remove_dep sslext:sslext @@ -78,6 +80,9 @@ sed -i 's/\r//' LICENSE NOTICE WHY_THREE_JARS.txt %license LICENSE NOTICE %changelog +* Sat Mar 20 2021 zhanghua - 2.0-3 +- fix CVE-2020-13959 + * Tue Jan 26 2021 Ge Wang - 2.0-2 - remove dependence to sslext