mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-07-21 07:17:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

cargo: Fix CVE-2026-5222

Browse Source 
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].

[1] c4d63a4423
[2] https://security-tracker.debian.org/tracker/CVE-2026-5222

(From OE-Core rev: 1f38e3b8ea709fb8e7ef7a13991809ede5d24d09)

Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
This commit is contained in:
Anil Dongare
2026-06-15 06:00:41 -07:00
committed by Paul Barker
parent 8cb3e690c5
commit ae2f076ef7
2 changed files with 93 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

92
meta/recipes-devtools/rust/files/CVE-2026-5222.patch Normal file
View File

@@ -0,0 +1,92 @@
From c4d63a44234de22dc745231c416b80ed848d997f Mon Sep 17 00:00:00 2001
From: Arlo Siemsen <arkixml@gmail.com>
Date: Mon, 25 May 2026 09:49:43 +0200
Subject: [PATCH] CVE-2026-5222: avoid stripping .git suffix when for non git
registries
CVE: CVE-2026-5222
Upstream-Status: Backport [https://github.com/rust-lang/cargo/commit/c4d63a44234de22dc745231c416b80ed848d997f]
(cherry picked from commit c4d63a44234de22dc745231c416b80ed848d997f)
Signed-off-by: Anil Dongare <adongare@cisco.com>
---
src/tools/cargo/src/cargo/sources/git/source.rs | 7 +++++++
src/tools/cargo/src/cargo/util/canonical_url.rs | 44 +++++++++++++------------
2 files changed, 31 insertions(+), 20 deletions(-)
diff --git a/src/tools/cargo/src/cargo/sources/git/source.rs b/src/tools/cargo/src/cargo/sources/git/source.rs
index a75c1ec..1c8dbc8 100644
--- a/src/tools/cargo/src/cargo/sources/git/source.rs
+++ b/src/tools/cargo/src/cargo/sources/git/source.rs
@@ -377,6 +377,13 @@ mod test {
assert_eq!(ident1, ident2);
}
+ #[test]
+ fn test_canonicalize_idents_does_not_strip_dot_git_for_sparse() {
+ let ident1 = ident(&src("sparse+https://crates.io/fake-registry"));
+ let ident2 = ident(&src("sparse+https://crates.io/fake-registry.git"));
+ assert_ne!(ident1, ident2);
+ }
+
fn src(s: &str) -> SourceId {
SourceId::for_git(&s.into_url().unwrap(), GitReference::DefaultBranch).unwrap()
}
diff --git a/src/tools/cargo/src/cargo/util/canonical_url.rs b/src/tools/cargo/src/cargo/util/canonical_url.rs
index 7516e03..2716d2d 100644
--- a/src/tools/cargo/src/cargo/util/canonical_url.rs
+++ b/src/tools/cargo/src/cargo/util/canonical_url.rs
@@ -33,27 +33,31 @@ impl CanonicalUrl {
url.path_segments_mut().unwrap().pop_if_empty();
}
- // For GitHub URLs specifically, just lower-case everything. GitHub
- // treats both the same, but they hash differently, and we're gonna be
- // hashing them. This wants a more general solution, and also we're
- // almost certainly not using the same case conversion rules that GitHub
- // does. (See issue #84)
- if url.host_str() == Some("github.com") {
- url = format!("https{}", &url[url::Position::AfterScheme..])
- .parse()
- .unwrap();
- let path = url.path().to_lowercase();
- url.set_path(&path);
- }
+ // Perform further canonicalization specific to git registries, which
+ // do not contain a `+` specifier.
+ if !url.scheme().contains('+') {
+ // For GitHub URLs specifically, just lower-case everything. GitHub
+ // treats both the same, but they hash differently, and we're gonna be
+ // hashing them. This wants a more general solution, and also we're
+ // almost certainly not using the same case conversion rules that GitHub
+ // does. (See issue #84)
+ if url.host_str() == Some("github.com") {
+ url = format!("https{}", &url[url::Position::AfterScheme..])
+ .parse()
+ .unwrap();
+ let path = url.path().to_lowercase();
+ url.set_path(&path);
+ }
- // Repos can generally be accessed with or without `.git` extension.
- let needs_chopping = url.path().ends_with(".git");
- if needs_chopping {
- let last = {
- let last = url.path_segments().unwrap().next_back().unwrap();
- last[..last.len() - 4].to_owned()
- };
- url.path_segments_mut().unwrap().pop().push(&last);
+ // Repos can generally be accessed with or without `.git` extension.
+ let needs_chopping = url.path().ends_with(".git");
+ if needs_chopping {
+ let last = {
+ let last = url.path_segments().unwrap().next_back().unwrap();
+ last[..last.len() - 4].to_owned()
+ };
+ url.path_segments_mut().unwrap().pop().push(&last);
+ }
}
Ok(CanonicalUrl(url))
--
2.44.4

1
meta/recipes-devtools/rust/rust-source.inc
View File

@@ -13,6 +13,7 @@ SRC_URI += "https://static.rust-lang.org/dist/rustc-${RUST_VERSION}-src.tar.xz;n
file://0001-Handle-vendored-sources-when-remapping-paths.patch;patchdir=${RUSTSRC} \
file://repro-issue-fix-with-v175.patch;patchdir=${RUSTSRC} \
file://0001-cargo-do-not-write-host-information-into-compilation.patch;patchdir=${RUSTSRC} \
file://CVE-2026-5222.patch;patchdir=${RUSTSRC} \
"
SRC_URI[rust.sha256sum] = "4526f786d673e4859ff2afa0bab2ba13c918b796519a25c1acce06dba9542340"