From f26fa354f1d76ce9cbc43cc553637af3f0c34cc2 Mon Sep 17 00:00:00 2001 From: Tobias Geerinckx-Rice Date: Thu, 11 Jan 2018 00:54:22 +0100 Subject: gnu: newsbeuter: Deprecate in favour of newsboat. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * gnu/packages/syndication.scm (newsbeuter): Redefine using ‘deprecated-package’. * gnu/packages/patches/newsbeuter-CVE-2017-12904.patch: Delete file. * gnu/packages/patches/newsbeuter-CVE-2017-14500.patch: Likewise. * gnu/local.mk (dist_patch_DATA): Remove both. --- .../patches/newsbeuter-CVE-2017-12904.patch | 34 ----------------- .../patches/newsbeuter-CVE-2017-14500.patch | 43 ---------------------- 2 files changed, 77 deletions(-) delete mode 100644 gnu/packages/patches/newsbeuter-CVE-2017-12904.patch delete mode 100644 gnu/packages/patches/newsbeuter-CVE-2017-14500.patch (limited to 'gnu/packages/patches') diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch b/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch deleted file mode 100644 index 8e90502469..0000000000 --- a/gnu/packages/patches/newsbeuter-CVE-2017-12904.patch +++ /dev/null @@ -1,34 +0,0 @@ -Fix CVE-2017-12904: - -https://github.com/akrennmair/newsbeuter/issues/591 -https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12904 - -Patch copied from the Debian package of newsbeuter, version 2.9-5+deb9u1. - -Adapted from upstream source repository: - -https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 - -Description: Fix a RCE vulnerability in the bookmark command - Newsbeuter didn't properly escape the title and description fields before - passing them to the bookmarking program which could lead to remote code - execution using the shells command substitution functionality (e.g. "$()", ``, - etc) - -Origin: upstream, https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307 -Last-Update: 2017-08-18 - ---- newsbeuter-2.9.orig/src/controller.cpp -+++ newsbeuter-2.9/src/controller.cpp -@@ -1274,9 +1274,10 @@ std::string controller::bookmark(const s - std::string bookmark_cmd = cfg.get_configvalue("bookmark-cmd"); - bool is_interactive = cfg.get_configvalue_as_bool("bookmark-interactive"); - if (bookmark_cmd.length() > 0) { -- std::string cmdline = utils::strprintf("%s '%s' %s %s", -+ std::string cmdline = utils::strprintf("%s '%s' '%s' '%s'", - bookmark_cmd.c_str(), utils::replace_all(url,"'", "%27").c_str(), -- stfl::quote(title).c_str(), stfl::quote(description).c_str()); -+ utils::replace_all(title,"'", "%27").c_str(), -+ utils::replace_all(description,"'", "%27").c_str()); - - LOG(LOG_DEBUG, "controller::bookmark: cmd = %s", cmdline.c_str()); diff --git a/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch b/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch deleted file mode 100644 index 449105e42a..0000000000 --- a/gnu/packages/patches/newsbeuter-CVE-2017-14500.patch +++ /dev/null @@ -1,43 +0,0 @@ -https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333.patch -http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14500 - -From 26f5a4350f3ab5507bb8727051c87bb04660f333 Mon Sep 17 00:00:00 2001 -From: Alexander Batischev -Date: Sat, 16 Sep 2017 19:31:43 +0300 -Subject: [PATCH] Work around shell code in podcast names (#598) - ---- - src/pb_controller.cpp | 6 +++--- - src/queueloader.cpp | 2 +- - 2 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/src/pb_controller.cpp b/src/pb_controller.cpp -index 09b5e897..213216cd 100644 ---- a/src/pb_controller.cpp -+++ b/src/pb_controller.cpp -@@ -306,9 +306,9 @@ void pb_controller::play_file(const std::string& file) { - if (player == "") - return; - cmdline.append(player); -- cmdline.append(" \""); -- cmdline.append(utils::replace_all(file,"\"", "\\\"")); -- cmdline.append("\""); -+ cmdline.append(" \'"); -+ cmdline.append(utils::replace_all(file,"'", "%27")); -+ cmdline.append("\'"); - stfl::reset(); - LOG(LOG_DEBUG, "pb_controller::play_file: running `%s'", cmdline.c_str()); - ::system(cmdline.c_str()); -diff --git a/src/queueloader.cpp b/src/queueloader.cpp -index c1dabdd8..ae725e04 100644 ---- a/src/queueloader.cpp -+++ b/src/queueloader.cpp -@@ -130,7 +130,7 @@ std::string queueloader::get_filename(const std::string& str) { - strftime(lbuf, sizeof(lbuf), "%Y-%b-%d-%H%M%S.unknown", localtime(&t)); - fn.append(lbuf); - } else { -- fn.append(base); -+ fn.append(utils::replace_all(base, "'", "%27")); - } - return fn; - } -- cgit v1.2.3