diff --git a/CVE-2019-13990.patch b/CVE-2019-13990.patch deleted file mode 100644 index dd407efe03bb20cdcf938db8496ffb7b6b65cea1..0000000000000000000000000000000000000000 --- a/CVE-2019-13990.patch +++ /dev/null @@ -1,99 +0,0 @@ -From a961d9a9af5f457a12838aa9e28db385b051603d Mon Sep 17 00:00:00 2001 -From: Jonathan Gallimore -Date: Tue, 6 Aug 2019 10:36:16 +0100 -Subject: [PATCH] Issue #467 provide XML parser with a strong configuration to - prevent XXE attacks - ---- - .../xml/XMLSchedulingDataProcessor.java | 9 ++++++- - .../xml/XMLSchedulingDataProcessorTest.java | 26 +++++++++++++++++++ - .../org/quartz/xml/bad-job-config.xml | 15 +++++++++++ - 3 files changed, 49 insertions(+), 1 deletion(-) - create mode 100755 quartz-core/src/test/resources/org/quartz/xml/bad-job-config.xml - -diff --git a/quartz-core/src/main/java/org/quartz/xml/XMLSchedulingDataProcessor.java b/quartz-core/src/main/java/org/quartz/xml/XMLSchedulingDataProcessor.java -index 0a074ebb..506651a8 100644 ---- a/quartz-core/src/main/java/org/quartz/xml/XMLSchedulingDataProcessor.java -+++ b/quartz-core/src/main/java/org/quartz/xml/XMLSchedulingDataProcessor.java -@@ -173,7 +173,14 @@ protected void initDocumentParser() throws ParserConfigurationException { - docBuilderFactory.setAttribute("http://java.sun.com/xml/jaxp/properties/schemaLanguage", "http://www.w3.org/2001/XMLSchema"); - - docBuilderFactory.setAttribute("http://java.sun.com/xml/jaxp/properties/schemaSource", resolveSchemaSource()); -- -+ -+ docBuilderFactory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); -+ docBuilderFactory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); -+ docBuilderFactory.setFeature("http://xml.org/sax/features/external-general-entities", false); -+ docBuilderFactory.setFeature("http://xml.org/sax/features/external-parameter-entities", false); -+ docBuilderFactory.setXIncludeAware(false); -+ docBuilderFactory.setExpandEntityReferences(false); -+ - docBuilder = docBuilderFactory.newDocumentBuilder(); - - docBuilder.setErrorHandler(this); -diff --git a/quartz-core/src/test/java/org/quartz/xml/XMLSchedulingDataProcessorTest.java b/quartz-core/src/test/java/org/quartz/xml/XMLSchedulingDataProcessorTest.java -index 4aeb6464..ae8fc298 100755 ---- a/quartz-core/src/test/java/org/quartz/xml/XMLSchedulingDataProcessorTest.java -+++ b/quartz-core/src/test/java/org/quartz/xml/XMLSchedulingDataProcessorTest.java -@@ -30,6 +30,7 @@ - import org.quartz.simpl.SimpleThreadPool; - import org.quartz.spi.ClassLoadHelper; - import org.quartz.utils.DBConnectionManager; -+import org.xml.sax.SAXParseException; - - /** - * Unit test for XMLSchedulingDataProcessor. -@@ -204,6 +205,31 @@ public void testQTZ327SimpleTriggerNoRepeat() throws Exception { - } - } - -+ public void testXmlParserConfiguration() throws Exception { -+ Scheduler scheduler = null; -+ try { -+ StdSchedulerFactory factory = new StdSchedulerFactory("org/quartz/xml/quartz-test.properties"); -+ scheduler = factory.getScheduler(); -+ ClassLoadHelper clhelper = new CascadingClassLoadHelper(); -+ clhelper.initialize(); -+ XMLSchedulingDataProcessor processor = new XMLSchedulingDataProcessor(clhelper); -+ processor.processFileAndScheduleJobs("org/quartz/xml/bad-job-config.xml", scheduler); -+ -+ -+ final JobKey jobKey = scheduler.getJobKeys(GroupMatcher.jobGroupEquals("native")).iterator().next(); -+ final JobDetail jobDetail = scheduler.getJobDetail(jobKey); -+ final String description = jobDetail.getDescription(); -+ -+ -+ fail("Expected parser configuration to block DOCTYPE. The following was injected into the job description field: " + description); -+ } catch (SAXParseException e) { -+ assertTrue(e.getMessage().contains("DOCTYPE is disallowed")); -+ } finally { -+ if (scheduler != null) -+ scheduler.shutdown(); -+ } -+ } -+ - private Date dateOfGMT_UTC(int hour, int minute, int second, int dayOfMonth, int month, int year) { - final GregorianCalendar calendar = new GregorianCalendar(TimeZone.getTimeZone("GMT")); - calendar.set(year, month, dayOfMonth, hour, minute, second); -diff --git a/quartz-core/src/test/resources/org/quartz/xml/bad-job-config.xml b/quartz-core/src/test/resources/org/quartz/xml/bad-job-config.xml -new file mode 100755 -index 00000000..9aeb5673 ---- /dev/null -+++ b/quartz-core/src/test/resources/org/quartz/xml/bad-job-config.xml -@@ -0,0 +1,15 @@ -+ -+ -+ ]> -+ -+ -+ -+ xxe -+ native -+ &xxe; -+ org.quartz.xml.XMLSchedulingDataProcessorTest$MyJob -+ true -+ false -+ -+ -+ -\ No newline at end of file diff --git a/quartz-2.2.1.tar.gz b/quartz-2.2.1.tar.gz deleted file mode 100644 index 1e3b95efd0737d2ef203a13f8109374d39ba9afc..0000000000000000000000000000000000000000 Binary files a/quartz-2.2.1.tar.gz and /dev/null differ diff --git a/quartz-2.3.2.tar.gz b/quartz-2.3.2.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..f863491d6baf2cb1f90a2eda48d248816f9a0c73 Binary files /dev/null and b/quartz-2.3.2.tar.gz differ diff --git a/quartz.spec b/quartz.spec index 48cbcb92b2bafa27ed6b092b74a041ef65f4ebb7..d037ee737de94efb2f50574f52d879bf81fe906a 100644 --- a/quartz.spec +++ b/quartz.spec @@ -1,12 +1,11 @@ Summary: Enterprise Job Scheduler for Java Name: quartz -Version: 2.2.1 -Release: 3 +Version: 2.3.2 +Release: 1 Epoch: 0 License: Apache-2.0 URL: http://www.quartz-scheduler.org/ -Source0: https://github.com/quartz-scheduler/quartz/archive/refs/tags/%{name}-%{version}.tar.gz -Patch6000: CVE-2019-13990.patch +Source0: https://github.com/quartz-scheduler/quartz/archive/v2.3.2/%{name}-%{version}.tar.gz BuildRequires: maven-local maven-antrun-plugin maven-checkstyle-plugin maven-dependency-plugin BuildRequires: maven-enforcer-plugin maven-release-plugin maven-shade-plugin maven-shared BuildRequires: rmic-maven-plugin mvn(com.mchange:c3p0) mvn(javax.mail:mail) >= 1.4.3 @@ -20,6 +19,7 @@ BuildRequires: mvn(org.apache.tomcat:tomcat-servlet-api) mvn(org.slf4j:slf BuildRequires: mvn(org.slf4j:slf4j-log4j12) mvn(asm:asm) mvn(commons-io:commons-io) BuildRequires: mvn(junit:junit) mvn(org.apache.derby:derby) BuildRequires: mvn(org.hamcrest:hamcrest-library) >= 1.2 +BuildRequires: mvn(com.zaxxer:HikariCP-java6) BuildArch: noarch %description Quartz is a job scheduling system that can be integrated with, or used @@ -34,14 +34,13 @@ Summary: API docs for quartz This package contains the API Documentation for quartz. %prep -%autosetup -p1 -n %{name}-%{name}-%{version} +%autosetup -p1 -n %{name}-%{version} %pom_disable_module quartz-jboss %pom_disable_module quartz-oracle %pom_disable_module quartz-weblogic %pom_disable_module terracotta %pom_remove_plugin org.codehaus.mojo:findbugs-maven-plugin %pom_remove_plugin :maven-source-plugin -sed -i -e 's/groupId>c3p0com.mchangejunit-depjunit - 0:2.3.2-1 +- Update to version 2.3.2 + * Mon Nov 14 2022 Ge Wang - 0:2.2.1-3 - Bring source file into correspondence with described in spec file