diff --git a/CVE-2025-2361.patch b/CVE-2025-2361.patch new file mode 100644 index 0000000000000000000000000000000000000000..d68bb19d5197dc04758b48db6b046c6e8927c7ac --- /dev/null +++ b/CVE-2025-2361.patch @@ -0,0 +1,357 @@ +# HG changeset patch +# User Raphaël Gomès +# Date 1742340720 -3600 +# Wed Mar 19 00:32:00 2025 +0100 +# Branch stable +# Node ID a5c72ed2929341d97b11968211c880854803f003 +# Parent 74439d1cbebaa9ff8f8300e37e93b42e6d381be4 +hgweb: fix XSS vulnerability in hgweb (CVE-2025-2361) + +818598f5bc8b91 is the change that introduced the vulnerability (in 2006!) +that was disclosed to us, but I found a similar pattern in other places +in the code. + +Since XSS escaping is actually hard and that would mean vendoring some +better sanitation tool, I decided to simply remove user input from any +HTML output in hgweb, hopefully in all places. + +--- + mercurial/hgweb/hgweb_mod.py | 5 ++- + mercurial/hgweb/webcommands.py | 22 +++++++++----- + tests/test-archive.t | 54 ++++++++++++++++----------------- + tests/test-hgweb.t | 10 +++--- + tests/test-lfs-serve-access.t | 4 +-- + tests/test-remotefilelog-http.t | 4 +-- + 6 files changed, 55 insertions(+), 44 deletions(-) + +diff --git a/mercurial/hgweb/hgweb_mod.py b/mercurial/hgweb/hgweb_mod.py +index 99a2bb2..1b06e09 100644 +--- a/mercurial/hgweb/hgweb_mod.py ++++ b/mercurial/hgweb/hgweb_mod.py +@@ -420,7 +420,10 @@ class hgweb(object): + res.headers['ETag'] = tag + + if cmd not in webcommands.__all__: +- msg = 'no such method: %s' % cmd ++ msg = b'method not found' ++ # /!\ Do not print `cmd` here unless you do *extensive* ++ # escaping. ++ # Because XSS escaping is hard, we just don't risk it. + raise ErrorResponse(HTTP_BAD_REQUEST, msg) + else: + # Set some globals appropriate for web handlers. Commands can +diff --git a/mercurial/hgweb/webcommands.py b/mercurial/hgweb/webcommands.py +index 38b7690..a1d2d11 100644 +--- a/mercurial/hgweb/webcommands.py ++++ b/mercurial/hgweb/webcommands.py +@@ -559,7 +559,9 @@ def manifest(web): + h[None] = None # denotes files present + + if mf and not files and not dirs: +- raise ErrorResponse(HTTP_NOT_FOUND, 'path not found: ' + path) ++ # /!\ Do not print `path` here unless you do *extensive* escaping. ++ # Because XSS escaping is hard, we just don't risk it. ++ raise ErrorResponse(HTTP_NOT_FOUND, b'path not found') + + def filelist(context): + for f in sorted(files): +@@ -1172,12 +1174,15 @@ def archive(web): + key = web.req.qsparams['node'] + + if type_ not in webutil.archivespecs: +- msg = 'Unsupported archive type: %s' % stringutil.pprint(type_) ++ # /!\ Do not print `type_` here unless you do *extensive* escaping. ++ # Because XSS escaping is hard, we just don't risk it. ++ msg = b'Unsupported archive type' + raise ErrorResponse(HTTP_NOT_FOUND, msg) + +- if not ((type_ in allowed or +- web.configbool("web", "allow" + type_))): +- msg = 'Archive type not allowed: %s' % type_ ++ if not (type_ in allowed or web.configbool(b"web", b"allow" + type_)): ++ # /!\ Do not print `type_` here unless you do *extensive* escaping. ++ # Because XSS escaping is hard, we just don't risk it. ++ msg = b'Archive type not allowed' + raise ErrorResponse(HTTP_FORBIDDEN, msg) + + reponame = re.sub(br"\W+", "-", os.path.basename(web.reponame)) +@@ -1197,8 +1202,11 @@ def archive(web): + if pats: + files = [f for f in ctx.manifest().keys() if match(f)] + if not files: +- raise ErrorResponse(HTTP_NOT_FOUND, +- 'file(s) not found: %s' % file) ++ # /!\ Do not print `files` here unless you do *extensive* ++ # escaping. ++ # Because XSS escaping is hard, we just don't risk it. ++ raise ErrorResponse(HTTP_NOT_FOUND, b'file(s) not found') ++ + + mimetype, artype, extension, encoding = webutil.archivespecs[type_] + +diff --git a/tests/test-archive.t b/tests/test-archive.t +index 1907954..0f5f49d 100644 +--- a/tests/test-archive.t ++++ b/tests/test-archive.t +@@ -133,22 +133,22 @@ check http return codes + + body: size=408, sha1=8fa06531bddecc365a9f5edb0f88b65974bfe505 + % tar.bz2 and zip disallowed should both give 403 +- 403 Archive type not allowed: bz2 ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=4c5cf0f574446c44feb7f88f4e0e2a56bd92c352 +- 403 Archive type not allowed: zip ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=cbfa5574b337348bfd0564cc534474d002e7d6c7 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d + $ test_archtype bz2 tar.bz2 zip tar.gz + % bz2 allowed should give 200 + 200 Script output follows +@@ -161,22 +161,22 @@ check http return codes + + body: size=426, sha1=8d87f5aba6e14f1bfea6c232985982c278b2fb0b + % zip and tar.gz disallowed should both give 403 +- 403 Archive type not allowed: zip ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=cbfa5574b337348bfd0564cc534474d002e7d6c7 +- 403 Archive type not allowed: gz ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1450, sha1=71f0b12d59f85fdcfe8ff493e2dc66863f2f7734 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d + $ test_archtype zip zip tar.gz tar.bz2 + % zip allowed should give 200 + 200 Script output follows +@@ -189,22 +189,22 @@ check http return codes + + body: size=(1377|1461|1489), sha1=(677b14d3d048778d5eb5552c14a67e6192068650|be6d3983aa13dfe930361b2569291cdedd02b537|1897e496871aa89ad685a92b936f5fa0d008b9e8) (re) + % tar.gz and tar.bz2 disallowed should both give 403 +- 403 Archive type not allowed: gz ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1450, sha1=71f0b12d59f85fdcfe8ff493e2dc66863f2f7734 +- 403 Archive type not allowed: bz2 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=4c5cf0f574446c44feb7f88f4e0e2a56bd92c352 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d + + check http return codes (with deprecated option) + +@@ -220,22 +220,22 @@ check http return codes (with deprecated option) + + body: size=408, sha1=8fa06531bddecc365a9f5edb0f88b65974bfe505 + % tar.bz2 and zip disallowed should both give 403 +- 403 Archive type not allowed: bz2 ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=4c5cf0f574446c44feb7f88f4e0e2a56bd92c352 +- 403 Archive type not allowed: zip ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=cbfa5574b337348bfd0564cc534474d002e7d6c7 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d + $ test_archtype_deprecated bz2 tar.bz2 zip tar.gz + % bz2 allowed should give 200 + 200 Script output follows +@@ -248,22 +248,22 @@ check http return codes (with deprecated option) + + body: size=426, sha1=8d87f5aba6e14f1bfea6c232985982c278b2fb0b + % zip and tar.gz disallowed should both give 403 +- 403 Archive type not allowed: zip ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=cbfa5574b337348bfd0564cc534474d002e7d6c7 +- 403 Archive type not allowed: gz ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1450, sha1=71f0b12d59f85fdcfe8ff493e2dc66863f2f7734 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d + $ test_archtype_deprecated zip zip tar.gz tar.bz2 + % zip allowed should give 200 + 200 Script output follows +@@ -276,22 +276,22 @@ check http return codes (with deprecated option) + + body: size=(1377|1461|1489), sha1=(677b14d3d048778d5eb5552c14a67e6192068650|be6d3983aa13dfe930361b2569291cdedd02b537|1897e496871aa89ad685a92b936f5fa0d008b9e8) (re) + % tar.gz and tar.bz2 disallowed should both give 403 +- 403 Archive type not allowed: gz ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1450, sha1=71f0b12d59f85fdcfe8ff493e2dc66863f2f7734 +- 403 Archive type not allowed: bz2 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d ++ 403 Archive type not allowed + content-type: text/html; charset=ascii + date: $HTTP_DATE$ + etag: W/"*" (glob) + server: testing stub value + transfer-encoding: chunked + +- body: size=1451, sha1=4c5cf0f574446c44feb7f88f4e0e2a56bd92c352 ++ body: size=1446, sha1=023cb60af79cf672217fbae8ecf20ad4b7472c9d + + $ echo "allow-archive = gz bz2 zip" >> .hg/hgrc + $ hg serve -p $HGPORT -d --pid-file=hg.pid -E errors.log +@@ -307,7 +307,7 @@ check archive links' order + invalid arch type should give 404 + + $ get-with-headers.py localhost:$HGPORT "archive/tip.invalid" | head -n 1 +- 404 Unsupported archive type: None ++ 404 Unsupported archive type + + $ TIP=`hg id -v | cut -f1 -d' '` + $ QTIP=`hg id -q` +@@ -379,12 +379,12 @@ test that we can download single directories and files + test that we detect file patterns that match no files + + $ "$PYTHON" getarchive.py "$TIP" gz foobar +- HTTP Error 404: file(s) not found: foobar ++ HTTP Error 404: file(s) not found + + test that we reject unsafe patterns + + $ "$PYTHON" getarchive.py "$TIP" gz relre:baz +- HTTP Error 404: file(s) not found: relre:baz ++ HTTP Error 404: file(s) not found + + $ killdaemons.py + +diff --git a/tests/test-hgweb.t b/tests/test-hgweb.t +index 366bfc1..0c5df58 100644 +--- a/tests/test-hgweb.t ++++ b/tests/test-hgweb.t +@@ -122,25 +122,25 @@ should give a 400 - bad command + 400* (glob) + + +- error: no such method: spam ++ error: method not found + [1] + + $ get-with-headers.py --headeronly localhost:$HGPORT '?cmd=spam' +- 400 no such method: spam ++ 400 method not found + [1] + + should give a 400 - bad command as a part of url path (issue4071) + + $ get-with-headers.py --headeronly localhost:$HGPORT 'spam' +- 400 no such method: spam ++ 400 method not found + [1] + + $ get-with-headers.py --headeronly localhost:$HGPORT 'raw-spam' +- 400 no such method: spam ++ 400 method not found + [1] + + $ get-with-headers.py --headeronly localhost:$HGPORT 'spam/tip/foo' +- 400 no such method: spam ++ 400 method not found + [1] + + should give a 404 - file does not exist +diff --git a/tests/test-lfs-serve-access.t b/tests/test-lfs-serve-access.t +index 519671e..6329938 100644 +--- a/tests/test-lfs-serve-access.t ++++ b/tests/test-lfs-serve-access.t +@@ -29,7 +29,7 @@ Uploads fail... + $ hg -R client push http://localhost:$HGPORT + pushing to http://localhost:$HGPORT/ + searching for changes +- abort: LFS HTTP error: HTTP Error 400: no such method: .git! ++ abort: LFS HTTP error: HTTP Error 400: method not found + (check that lfs serving is enabled on http://localhost:$HGPORT/.git/info/lfs and "upload" is supported) + [255] + +@@ -51,7 +51,7 @@ Downloads fail... + added 1 changesets with 1 changes to 1 files + new changesets 525251863cad + updating to branch default +- abort: LFS HTTP error: HTTP Error 400: no such method: .git! ++ abort: LFS HTTP error: HTTP Error 400: method not found + (check that lfs serving is enabled on http://localhost:$HGPORT/.git/info/lfs and "download" is supported) + [255] + +diff --git a/tests/test-remotefilelog-http.t b/tests/test-remotefilelog-http.t +index 9ee27bc..34745ec 100644 +--- a/tests/test-remotefilelog-http.t ++++ b/tests/test-remotefilelog-http.t +@@ -44,9 +44,9 @@ as the getfile method it offers doesn't work with http. + x_rfl_getflogheads + + $ get-with-headers.py localhost:$HGPORT '?cmd=this-command-does-not-exist' | head -n 1 +- 400 no such method: this-command-does-not-exist ++ 400 method not found + $ get-with-headers.py localhost:$HGPORT '?cmd=x_rfl_getfiles' | head -n 1 +- 400 no such method: x_rfl_getfiles ++ 400 method not found + + Verify serving from a shallow clone doesn't allow for remotefile + fetches. This also serves to test the error handling for our batchable +-- +2.33.0 + diff --git a/mercurial.spec b/mercurial.spec index 04ec6d1e8efd27503a06554301c4ff6df9d8cd97..983538f1f2215c1f8824af49a0615c73de83df60 100644 --- a/mercurial.spec +++ b/mercurial.spec @@ -2,7 +2,7 @@ Name: mercurial Version: 5.1 -Release: 3 +Release: 4 Summary: Source control management tool License: GPLv2+ URL: http://www.selenic.com/mercurial/ @@ -14,6 +14,7 @@ Patch2: dirs-tag-a-struct-as-not-being-formattable.patch Patch3: dirs-give-formatting-oversight-to-clang-format.patch Patch4: dirs-reject-consecutive-slashes-in-paths.patch Patch5: dirs-resolve-fuzzer-OOM-situation-by-disallowing-deep-directory-hierarchies.patch +Patch6: CVE-2025-2361.patch BuildRequires: gcc python2 python2-devel bash-completion emacs-nox emacs-el pkgconfig gettext python2-docutils Requires: python2 emacs-filesystem tk @@ -138,6 +139,9 @@ grep -v locale %{name}-base.files > %{name}-base-filtered.files %{_mandir}/man?/chg.*.gz %changelog +* Mon Dec 22 2025 hanguanqiang - 5.1-4 +- fix CVE-2025-2361 + * Thu Apr 23 2020 openEuler Buildteam - 5.1-3 - Type:bugfix - ID:NA