mirror of
https://git.yoctoproject.org/poky
synced 2026-09-20 21:49:33 +02:00
ae2f076ef7
This patch applies the upstream fix as referenced in [2], using the commit shown in [1].
[1] c4d63a4423
[2] https://security-tracker.debian.org/tracker/CVE-2026-5222
(From OE-Core rev: 1f38e3b8ea709fb8e7ef7a13991809ede5d24d09)
Signed-off-by: Anil Dongare <adongare@cisco.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>
93 lines
4.1 KiB
Diff
93 lines
4.1 KiB
Diff
From c4d63a44234de22dc745231c416b80ed848d997f Mon Sep 17 00:00:00 2001
|
|
From: Arlo Siemsen <arkixml@gmail.com>
|
|
Date: Mon, 25 May 2026 09:49:43 +0200
|
|
Subject: [PATCH] CVE-2026-5222: avoid stripping .git suffix when for non git
|
|
registries
|
|
|
|
CVE: CVE-2026-5222
|
|
Upstream-Status: Backport [https://github.com/rust-lang/cargo/commit/c4d63a44234de22dc745231c416b80ed848d997f]
|
|
|
|
(cherry picked from commit c4d63a44234de22dc745231c416b80ed848d997f)
|
|
Signed-off-by: Anil Dongare <adongare@cisco.com>
|
|
---
|
|
src/tools/cargo/src/cargo/sources/git/source.rs | 7 +++++++
|
|
src/tools/cargo/src/cargo/util/canonical_url.rs | 44 +++++++++++++------------
|
|
2 files changed, 31 insertions(+), 20 deletions(-)
|
|
|
|
diff --git a/src/tools/cargo/src/cargo/sources/git/source.rs b/src/tools/cargo/src/cargo/sources/git/source.rs
|
|
index a75c1ec..1c8dbc8 100644
|
|
--- a/src/tools/cargo/src/cargo/sources/git/source.rs
|
|
+++ b/src/tools/cargo/src/cargo/sources/git/source.rs
|
|
@@ -377,6 +377,13 @@ mod test {
|
|
assert_eq!(ident1, ident2);
|
|
}
|
|
|
|
+ #[test]
|
|
+ fn test_canonicalize_idents_does_not_strip_dot_git_for_sparse() {
|
|
+ let ident1 = ident(&src("sparse+https://crates.io/fake-registry"));
|
|
+ let ident2 = ident(&src("sparse+https://crates.io/fake-registry.git"));
|
|
+ assert_ne!(ident1, ident2);
|
|
+ }
|
|
+
|
|
fn src(s: &str) -> SourceId {
|
|
SourceId::for_git(&s.into_url().unwrap(), GitReference::DefaultBranch).unwrap()
|
|
}
|
|
diff --git a/src/tools/cargo/src/cargo/util/canonical_url.rs b/src/tools/cargo/src/cargo/util/canonical_url.rs
|
|
index 7516e03..2716d2d 100644
|
|
--- a/src/tools/cargo/src/cargo/util/canonical_url.rs
|
|
+++ b/src/tools/cargo/src/cargo/util/canonical_url.rs
|
|
@@ -33,27 +33,31 @@ impl CanonicalUrl {
|
|
url.path_segments_mut().unwrap().pop_if_empty();
|
|
}
|
|
|
|
- // For GitHub URLs specifically, just lower-case everything. GitHub
|
|
- // treats both the same, but they hash differently, and we're gonna be
|
|
- // hashing them. This wants a more general solution, and also we're
|
|
- // almost certainly not using the same case conversion rules that GitHub
|
|
- // does. (See issue #84)
|
|
- if url.host_str() == Some("github.com") {
|
|
- url = format!("https{}", &url[url::Position::AfterScheme..])
|
|
- .parse()
|
|
- .unwrap();
|
|
- let path = url.path().to_lowercase();
|
|
- url.set_path(&path);
|
|
- }
|
|
+ // Perform further canonicalization specific to git registries, which
|
|
+ // do not contain a `+` specifier.
|
|
+ if !url.scheme().contains('+') {
|
|
+ // For GitHub URLs specifically, just lower-case everything. GitHub
|
|
+ // treats both the same, but they hash differently, and we're gonna be
|
|
+ // hashing them. This wants a more general solution, and also we're
|
|
+ // almost certainly not using the same case conversion rules that GitHub
|
|
+ // does. (See issue #84)
|
|
+ if url.host_str() == Some("github.com") {
|
|
+ url = format!("https{}", &url[url::Position::AfterScheme..])
|
|
+ .parse()
|
|
+ .unwrap();
|
|
+ let path = url.path().to_lowercase();
|
|
+ url.set_path(&path);
|
|
+ }
|
|
|
|
- // Repos can generally be accessed with or without `.git` extension.
|
|
- let needs_chopping = url.path().ends_with(".git");
|
|
- if needs_chopping {
|
|
- let last = {
|
|
- let last = url.path_segments().unwrap().next_back().unwrap();
|
|
- last[..last.len() - 4].to_owned()
|
|
- };
|
|
- url.path_segments_mut().unwrap().pop().push(&last);
|
|
+ // Repos can generally be accessed with or without `.git` extension.
|
|
+ let needs_chopping = url.path().ends_with(".git");
|
|
+ if needs_chopping {
|
|
+ let last = {
|
|
+ let last = url.path_segments().unwrap().next_back().unwrap();
|
|
+ last[..last.len() - 4].to_owned()
|
|
+ };
|
|
+ url.path_segments_mut().unwrap().pop().push(&last);
|
|
+ }
|
|
}
|
|
|
|
Ok(CanonicalUrl(url))
|
|
--
|
|
2.44.4
|