You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by us...@apache.org on 2013/06/24 10:39:30 UTC
svn commit: r1495958 - in /lucene/dev/branches/branch_4x: ./ lucene/
lucene/CHANGES.txt lucene/common-build.xml
Author: uschindler
Date: Mon Jun 24 08:39:29 2013
New Revision: 1495958
URL: http://svn.apache.org/r1495958
Log:
Merged revision(s) 1495954 from lucene/dev/trunk:
LUCENE-5072: Automatically patch javadocs generated by JDK versions before 7u25 to work around the frame injection vulnerability (CVE-2013-1571, VU#225657)
Modified:
lucene/dev/branches/branch_4x/ (props changed)
lucene/dev/branches/branch_4x/lucene/ (props changed)
lucene/dev/branches/branch_4x/lucene/CHANGES.txt
lucene/dev/branches/branch_4x/lucene/common-build.xml (contents, props changed)
Modified: lucene/dev/branches/branch_4x/lucene/CHANGES.txt
URL: http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/lucene/CHANGES.txt?rev=1495958&r1=1495957&r2=1495958&view=diff
==============================================================================
--- lucene/dev/branches/branch_4x/lucene/CHANGES.txt (original)
+++ lucene/dev/branches/branch_4x/lucene/CHANGES.txt Mon Jun 24 08:39:29 2013
@@ -225,6 +225,10 @@ Build
forbidden-api signatures, and parts of resources folders. (Ryan Ernst,
Uwe Schindler)
+* LUCENE-5072: Automatically patch javadocs generated by JDK versions
+ before 7u25 to work around the frame injection vulnerability (CVE-2013-1571,
+ VU#225657). (Uwe Schindler)
+
Tests
* LUCENE-4901: TestIndexWriterOnJRECrash should work on any
Modified: lucene/dev/branches/branch_4x/lucene/common-build.xml
URL: http://svn.apache.org/viewvc/lucene/dev/branches/branch_4x/lucene/common-build.xml?rev=1495958&r1=1495957&r2=1495958&view=diff
==============================================================================
--- lucene/dev/branches/branch_4x/lucene/common-build.xml (original)
+++ lucene/dev/branches/branch_4x/lucene/common-build.xml Mon Jun 24 08:39:29 2013
@@ -1818,10 +1818,72 @@ ${tests-output}/junit4-*.suites - pe
</condition>
</fail>
-
+ <patch-javadoc dir="@{destdir}" docencoding="${javadoc.charset}"/>
</sequential>
</macrodef>
+ <!--
+ Patch frame injection bugs in javadoc generated files - see CVE-2013-1571, http://www.kb.cert.org/vuls/id/225657
+
+ Feel free to use this macro in your own Ant build file. This macro works together with the javadoc task on Ant
+ and should be invoked directly after its execution to patch broken javadocs, e.g.:
+ <patch-javadoc dir="..." docencoding="UTF-8"/>
+ Please make sure that the docencoding parameter uses the same charset like javadoc's docencoding. Default
+ is the platform default encoding (like the javadoc task).
+ The specified dir is the destination directory of the javadoc task.
+ -->
+ <macrodef name="patch-javadoc">
+ <attribute name="dir"/>
+ <attribute name="docencoding" default="${file.encoding}"/>
+ <sequential>
+ <replace encoding="@{docencoding}" summary="true" taskname="patch-javadoc">
+ <restrict>
+ <fileset dir="@{dir}" casesensitive="false" includes="**/index.html,**/index.htm,**/toc.html,**/toc.htm"/>
+ <!-- TODO: add encoding="@{docencoding}" to contains check, when we are on ANT 1.9.0: -->
+ <not><contains text="function validURL(url) {" casesensitive="true" /></not>
+ </restrict>
+ <replacetoken><![CDATA[function loadFrames() {]]></replacetoken>
+ <replacevalue expandProperties="false"><![CDATA[if (targetPage != "" && !validURL(targetPage))
+ targetPage = "undefined";
+ function validURL(url) {
+ var pos = url.indexOf(".html");
+ if (pos == -1 || pos != url.length - 5)
+ return false;
+ var allowNumber = false;
+ var allowSep = false;
+ var seenDot = false;
+ for (var i = 0; i < url.length - 5; i++) {
+ var ch = url.charAt(i);
+ if ('a' <= ch && ch <= 'z' ||
+ 'A' <= ch && ch <= 'Z' ||
+ ch == '$' ||
+ ch == '_') {
+ allowNumber = true;
+ allowSep = true;
+ } else if ('0' <= ch && ch <= '9'
+ || ch == '-') {
+ if (!allowNumber)
+ return false;
+ } else if (ch == '/' || ch == '.') {
+ if (!allowSep)
+ return false;
+ allowNumber = false;
+ allowSep = false;
+ if (ch == '.')
+ seenDot = true;
+ if (ch == '/' && seenDot)
+ return false;
+ } else {
+ return false;
+ }
+ }
+ return true;
+ }
+ function loadFrames() {]]></replacevalue>
+ </replace>
+ </sequential>
+ </macrodef>
+
<macrodef name="modules-crawl">
<attribute name="target" default=""/>
<attribute name="failonerror" default="true"/>