packages/velocity-tools
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!5 [sync] PR-3: fix CVE-2020-13959

Browse Source 
From: @openeuler-sync-bot
Reviewed-by: @wang_yue111,@wangchong1995924
Signed-off-by: @wangchong1995924
This commit is contained in:
openeuler-ci-bot 2021-03-23 16:05:30 +08:00 committed by Gitee
commit 8c2db074fc
2 changed files with 31 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
CVE-2020-13959.patch Normal file
View File

@ -0,0 +1,25 @@
From e141828a4eb03e4b0224535eed12b5c463a24152 Mon Sep 17 00:00:00 2001
From: Jackson Henry <54763344+JHHAX@users.noreply.github.com>
Date: Thu, 8 Oct 2020 14:18:25 +1100
Subject: [PATCH] Fixed Reflected XSS Vuln
Velocity Tools has an automatically generated error page, which echoes back the file name unescaped. This commit sanitizes user input and fixes the XSS Vulnerability!
Updated XSS Vuln fix (used StringEscapeUtils)
---
.../org/apache/velocity/tools/view/VelocityViewServlet.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java b/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java
index aff9b71d7..325ab0bba 100644
--- a/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java
+++ b/src/main/java/org/apache/velocity/tools/view/VelocityViewServlet.java
@@ -460,7 +460,7 @@ protected void error(HttpServletRequest request,
html.append("<head><title>Error</title></head>\n");
html.append("<body>\n");
html.append("<h2>VelocityView : Error processing a template for path '");
- html.append(path);
+ html.append(StringEscapeUtils.escapeHtml(path));
html.append("'</h2>\n");
Throwable cause = e;

7
velocity-tools.spec
View File

@ -1,6 +1,6 @@
Name: velocity-tools
Version: 2.0
Release: 2
Release: 3
Summary: Collection of useful tools for Velocity template engine
License: ASL 2.0
Url: http://velocity.apache.org/tools/releases/2.0/
@ -9,6 +9,7 @@ Patch0: %{name}-%{version}-junit4.patch
Patch1: %{name}-%{version}-dont_copy_test_lib.patch
Patch2: %{name}-%{version}-servlet.patch
Patch3: %{name}-%{version}-port-to-dom4j-2.0.patch
Patch4: CVE-2020-13959.patch
BuildRequires: maven-local mvn(commons-beanutils:commons-beanutils)
BuildRequires: mvn(commons-chain:commons-chain) mvn(commons-collections:commons-collections)
BuildRequires: mvn(commons-digester:commons-digester) mvn(commons-lang:commons-lang)
@ -49,6 +50,7 @@ find . -name "*.class" -delete
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
sed -i 's/\r//' LICENSE NOTICE WHY_THREE_JARS.txt
%pom_remove_dep javax.servlet:servlet-api
%pom_remove_dep sslext:sslext
@ -78,6 +80,9 @@ sed -i 's/\r//' LICENSE NOTICE WHY_THREE_JARS.txt
%license LICENSE NOTICE
%changelog
* Sat Mar 20 2021 zhanghua <zhanghua40@huawei.com> - 2.0-3
- fix CVE-2020-13959
* Tue Jan 26 2021 Ge Wang <wangge20@huawei.com> - 2.0-2
- remove dependence to sslext