From 8dd47fe61aee94a37be1fe1ab01efe6fbc2ffa2a Mon Sep 17 00:00:00 2001
From: Funda Wang <fundawang@yeah.net>
Date: Tue, 20 May 2025 10:33:43 +0800
Subject: [PATCH] fix CVE-2025-3155

---
 yelp-CVE-2025-3155.patch | 118 +++++++++++++++++++++++++++++++++++++++
 yelp.spec                |  14 +++--
 2 files changed, 127 insertions(+), 5 deletions(-)
 create mode 100644 yelp-CVE-2025-3155.patch

diff --git a/yelp-CVE-2025-3155.patch b/yelp-CVE-2025-3155.patch
new file mode 100644
index 0000000..1c10b61
--- /dev/null
+++ b/yelp-CVE-2025-3155.patch
@@ -0,0 +1,118 @@
+From 7ecd58dc0ca7bf9d0acb00bf04194a0cb6e8b724 Mon Sep 17 00:00:00 2001
+From: Shaun McCance <shaunm@gnome.org>
+Date: Fri, 18 Apr 2025 11:33:01 -0400
+Subject: [PATCH] Initial fix for CVE-2025-3155 from parrot409
+
+https://gitlab.gnome.org/GNOME/yelp/-/issues/221
+---
+ data/xslt/mal2html.xsl.in    |  5 +++++
+ data/xslt/man2html.xsl.in    |  2 +-
+ data/xslt/yelp-common.xsl.in |  7 +++++++
+ libyelp/yelp-transform.c     | 19 +++++++++++++++++++
+ libyelp/yelp-view.c          |  2 +-
+ 5 files changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/data/xslt/mal2html.xsl.in b/data/xslt/mal2html.xsl.in
+index 9e44b734..0a74da55 100644
+--- a/data/xslt/mal2html.xsl.in
++++ b/data/xslt/mal2html.xsl.in
+@@ -19,6 +19,11 @@
+ <xsl:param name="mal.link.prefix" select="'xref:'"/>
+ <xsl:param name="mal.link.extension" select="''"/>
+ 
++<xsl:template name="html.head.top.custom">
++  <xsl:param name="node" select="."/>
++  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'nonce-{$html.csp.nonce}'; "/>
++</xsl:template>
++
+ <xsl:template name="mal.link.target.custom">
+   <xsl:param name="node" select="."/>
+   <xsl:param name="action" select="$node/@action"/>
+diff --git a/data/xslt/man2html.xsl.in b/data/xslt/man2html.xsl.in
+index 676ce3eb..56bc1f5c 100644
+--- a/data/xslt/man2html.xsl.in
++++ b/data/xslt/man2html.xsl.in
+@@ -131,7 +131,7 @@
+   the correct styling and a single character which we measure the
+   width of and update each sheet as required.
+ -->
+-<script type="text/javascript" language="javascript">
++<script type="text/javascript" language="javascript" nonce="{$html.csp.nonce}">
+ <xsl:text>
+ $(document).ready (function () {
+   var div = document.getElementById("invisible-char");
+diff --git a/data/xslt/yelp-common.xsl.in b/data/xslt/yelp-common.xsl.in
+index 0c1ec9bb..421fc02d 100644
+--- a/data/xslt/yelp-common.xsl.in
++++ b/data/xslt/yelp-common.xsl.in
+@@ -15,6 +15,13 @@
+ <xsl:param name="html.syntax.highlight" select="true()"/>
+ <xsl:param name="html.js.root" select="'file://@XSL_JSDIR@/'"/>
+ 
++<xsl:param name="html.csp.nonce" select="yelp:generate_nonce()"/>
++
++<xsl:template name="html.head.top.custom">
++  <xsl:param name="node" select="."/>
++  <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'unsafe-inline'; "/>
++</xsl:template>
++
+ <xsl:template name="html.js.mathjax">
+   <xsl:param name="node" select="."/>
+   <xsl:if test="$node//mml:*[1]">
+diff --git a/libyelp/yelp-transform.c b/libyelp/yelp-transform.c
+index e74eb463..2ce1d05b 100644
+--- a/libyelp/yelp-transform.c
++++ b/libyelp/yelp-transform.c
+@@ -71,6 +71,8 @@ static void      xslt_yelp_cache            (xsltTransformContextPtr  ctxt,
+                                              xsltStylePreCompPtr      comp);
+ static void      xslt_yelp_aux              (xmlXPathParserContextPtr ctxt,
+                                              int                      nargs);
++static void      xslt_yelp_generate_nonce   (xmlXPathParserContextPtr ctxt,
++                                             int                      nargs);
+ 
+ enum {
+     PROP_0,
+@@ -412,6 +414,10 @@ transform_run (YelpTransform *transform)
+                              BAD_CAST "input",
+                              BAD_CAST YELP_NAMESPACE,
+                              (xmlXPathFunction) xslt_yelp_aux);
++    xsltRegisterExtFunction (priv->context,
++                         BAD_CAST "generate_nonce",
++                         BAD_CAST YELP_NAMESPACE,
++                         (xmlXPathFunction) xslt_yelp_generate_nonce);
+ 
+     priv->output = xsltApplyStylesheetUser (priv->stylesheet,
+                                             priv->input,
+@@ -607,3 +613,16 @@ xslt_yelp_aux (xmlXPathParserContextPtr ctxt, int nargs)
+     xsltExtensionInstructionResultRegister (tctxt, ret);
+     valuePush (ctxt, ret);
+ }
++
++static void
++xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt, int nargs)
++{
++    GRand* rand;
++    gchar* nonce_str;
++
++    rand = g_rand_new ();
++    nonce_str = g_strdup_printf("%08x%08x", g_rand_int (rand), g_rand_int (rand));
++    xmlXPathReturnString (ctxt, xmlStrdup ((xmlChar *) nonce_str));
++    g_free(nonce_str);
++    g_rand_free(rand);
++}
+diff --git a/libyelp/yelp-view.c b/libyelp/yelp-view.c
+index 32ae131e..d544c5df 100644
+--- a/libyelp/yelp-view.c
++++ b/libyelp/yelp-view.c
+@@ -971,7 +971,7 @@ view_external_uri (YelpView *view,
+ 
+     if (app_info)
+       {
+-        if (!strstr (g_app_info_get_executable (app_info), "yelp"))
++        if (!strstr (g_app_info_get_executable (app_info), "yelp") && !strstr (struri, "%3C") && !strstr (struri, "%3E"))
+           {
+             GList l;
+ 
+-- 
+GitLab
+
diff --git a/yelp.spec b/yelp.spec
index f880560..db36437 100644
--- a/yelp.spec
+++ b/yelp.spec
@@ -1,7 +1,7 @@
 Name:           yelp
 Epoch:          2
 Version:        3.36.0
-Release:        1
+Release:        2
 Summary:        Help browser for the GNOME desktop
 License:        LGPLv2+ and ASL 2.0 and GPLv2+
 URL:            https://wiki.gnome.org/Apps/Yelp
@@ -9,11 +9,12 @@ Source:         https://download.gnome.org/sources/%{name}/3.34/%{name}-%{versio
 
 # https://bugzilla.gnome.org/show_bug.cgi?id=687960
 Patch1:         0001-Center-new-windows.patch
+Patch2:         yelp-CVE-2025-3155.patch
 
 BuildRequires:  gcc gtk3-devel xz-devel libxml2-devel libxslt-devel
 BuildRequires:  sqlite-devel webkit2gtk3-devel yelp-xsl-devel
 BuildRequires:  desktop-file-utils bzip2-devel gettext-devel intltool itstool
-Requires:       yelp-xsl
+Requires:       yelp-xsl >= 3.36.0-2
 Provides:       %{name}-libs = %{epoch}:%{version}-%{release}
 Obsoletes:      %{name}-libs < %{epoch}:%{version}-%{release}
 
@@ -85,11 +86,14 @@ desktop-file-validate $RPM_BUILD_ROOT%{_datadir}/applications/yelp.desktop
 %{_datadir}/gtk-doc
 
 %changelog
-* Wed Aug 26 2020 zhanzhimin <zhanzhimin@huawei.com> 3.36.0-1
+* Sat May 10 2025 Funda Wang <fundawang@yeah.net> - 2:3.36.0-2
+- fix CVE-2025-3155
+
+* Wed Aug 26 2020 zhanzhimin <zhanzhimin@huawei.com> - 2:3.36.0-1
 - Upgrade to 3.36.0-1
 
-* Mon May 18 2020 wangchen <wangchen137@huawei.com> - 3.34.0-2
+* Mon May 18 2020 wangchen <wangchen137@huawei.com> - 2:3.34.0-2
 - rebuild for yelp
 
-* Fri Oct 11 2019 openEuler Buildteam <buildteam@openeuler.org> - 3.34.0-1
+* Fri Oct 11 2019 openEuler Buildteam <buildteam@openeuler.org> - 2:3.34.0-1
 - Package init
-- 
Gitee