mirror of
https://git.yoctoproject.org/poky
synced 2026-03-10 17:29:40 +01:00
61c55b9e30
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x.... This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. CVE-2024-49761-0009.patch is the CVE fix and rest are dependent commits. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-49761 Upstream-patch:810d22852383ca5c4b0f51217dbcc67e4049f6a6fc6cad570b7712855547370666e314a579730f25ce59f2eb1a(From OE-Core rev: 5b453400e9dd878b81b1447d14b3f518809de17e) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
72 lines
3.0 KiB
Diff
72 lines
3.0 KiB
Diff
From 7e4049f6a68c99c4efec2df117057ee080680c9f Mon Sep 17 00:00:00 2001
|
|
From: NAITOH Jun <naitoh@gmail.com>
|
|
Date: Wed, 31 Jan 2024 17:17:51 +0900
|
|
Subject: [PATCH] Change loop in parse_attributes to `while true`. (#109)
|
|
|
|
loop is slower than `while true`.
|
|
|
|
```
|
|
RUBYLIB= BUNDLER_ORIG_RUBYLIB= /Users/naitoh/.rbenv/versions/3.3.0/bin/ruby -v -S benchmark-driver /Users/naitoh/ghq/github.com/naitoh/rexml/benchmark/parse.yaml
|
|
ruby 3.3.0 (2023-12-25 revision 5124f9ac75) [arm64-darwin22]
|
|
Calculating -------------------------------------
|
|
before after before(YJIT) after(YJIT)
|
|
dom 11.186 11.304 17.395 17.450 i/s - 100.000 times in 8.940144s 8.846590s 5.748718s 5.730793s
|
|
sax 30.811 31.629 47.352 48.040 i/s - 100.000 times in 3.245601s 3.161619s 2.111854s 2.081594s
|
|
pull 35.793 36.621 56.924 57.313 i/s - 100.000 times in 2.793829s 2.730693s 1.756732s 1.744812s
|
|
stream 33.157 34.757 46.792 50.536 i/s - 100.000 times in 3.015940s 2.877088s 2.137106s 1.978787s
|
|
|
|
Comparison:
|
|
dom
|
|
after(YJIT): 17.4 i/s
|
|
before(YJIT): 17.4 i/s - 1.00x slower
|
|
after: 11.3 i/s - 1.54x slower
|
|
before: 11.2 i/s - 1.56x slower
|
|
|
|
sax
|
|
after(YJIT): 48.0 i/s
|
|
before(YJIT): 47.4 i/s - 1.01x slower
|
|
after: 31.6 i/s - 1.52x slower
|
|
before: 30.8 i/s - 1.56x slower
|
|
|
|
pull
|
|
after(YJIT): 57.3 i/s
|
|
before(YJIT): 56.9 i/s - 1.01x slower
|
|
after: 36.6 i/s - 1.57x slower
|
|
before: 35.8 i/s - 1.60x slower
|
|
|
|
stream
|
|
after(YJIT): 50.5 i/s
|
|
before(YJIT): 46.8 i/s - 1.08x slower
|
|
after: 34.8 i/s - 1.45x slower
|
|
before: 33.2 i/s - 1.52x slower
|
|
|
|
```
|
|
|
|
- YJIT=ON : 1.00x - 1.08x faster
|
|
- YJIT=OFF : 1.01x - 1.04x faster
|
|
|
|
CVE: CVE-2024-49761
|
|
|
|
Upstream-Status: Backport [https://github.com/ruby/rexml/commit/7e4049f6a68c99c4efec2df117057ee080680c9f]
|
|
|
|
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
|
---
|
|
.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
|
|
index b66b0ed..3fe5c29 100644
|
|
--- a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
|
|
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
|
|
@@ -610,7 +610,7 @@ module REXML
|
|
end
|
|
|
|
pos = scanner.pos
|
|
- loop do
|
|
+ while true
|
|
break if scanner.scan(ATTRIBUTE_PATTERN)
|
|
unless scanner.scan(QNAME)
|
|
message = "Invalid attribute name: <#{scanner.rest}>"
|
|
--
|
|
2.40.0
|