From a03611cf503636995b7e1603424d10c0146691a0 Mon Sep 17 00:00:00 2001 From: jackie_wu Date: Thu, 10 Jun 2021 16:07:44 +0800 Subject: [PATCH] fix CVE-2020-6950.patch (cherry picked from commit 823451e57b3906dce263bf2a407ed51a671788a2) --- CVE-2020-6950.patch | 53 +++++++++++++++++++++++++++++++++++++++++++++ mojarra.spec | 7 +++++- 2 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 CVE-2020-6950.patch diff --git a/CVE-2020-6950.patch b/CVE-2020-6950.patch new file mode 100644 index 0000000..5e56475 --- /dev/null +++ b/CVE-2020-6950.patch @@ -0,0 +1,53 @@ +From 2cf4da6f346b57128724aa893d4f2c8e57e7ed2e Mon Sep 17 00:00:00 2001 +From: ruolli +Date: Thu, 10 Jun 2021 15:52:22 +0800 +Subject: [PATCH] Multiple Path Traversal security issues + +--- + .../sun/faces/application/resource/ClasspathResourceHelper.java | 2 +- + .../com/sun/faces/application/resource/ResourceManager.java | 2 +- + .../sun/faces/application/resource/WebappResourceHelper.java | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java b/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java +index b50916e..57a5454 100644 +--- a/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java ++++ b/jsf-ri/src/main/java/com/sun/faces/application/resource/ClasspathResourceHelper.java +@@ -376,7 +376,7 @@ public class ClasspathResourceHelper extends ResourceHelper { + } else if (root == null) { + String contractName = ctx.getExternalContext().getRequestParameterMap() + .get("con"); +- if (null != contractName && 0 < contractName.length()) { ++ if (null != contractName && 0 < contractName.length() && !ResourceManager.nameContainsForbiddenSequence(contractName)) { + contracts = new ArrayList(); + contracts.add(contractName); + } else { +diff --git a/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java b/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java +index f904f9d..b714769 100644 +--- a/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java ++++ b/jsf-ri/src/main/java/com/sun/faces/application/resource/ResourceManager.java +@@ -374,7 +374,7 @@ public class ResourceManager { + + } + +- private static boolean nameContainsForbiddenSequence(String name) { ++ static boolean nameContainsForbiddenSequence(String name) { + boolean result = false; + if (name != null) { + name = name.toLowerCase(); +diff --git a/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java b/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java +index 4ff422a..d420e7b 100644 +--- a/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java ++++ b/jsf-ri/src/main/java/com/sun/faces/application/resource/WebappResourceHelper.java +@@ -334,7 +334,7 @@ public class WebappResourceHelper extends ResourceHelper { + } else if (root == null) { + String contractName = ctx.getExternalContext().getRequestParameterMap() + .get("con"); +- if (null != contractName && 0 < contractName.length()) { ++ if (null != contractName && 0 < contractName.length() && !ResourceManager.nameContainsForbiddenSequence(contractName)) { + contracts = new ArrayList(); + contracts.add(contractName); + } else { +-- +2.23.0 + diff --git a/mojarra.spec b/mojarra.spec index b2dee6e..6303f9f 100644 --- a/mojarra.spec +++ b/mojarra.spec @@ -1,6 +1,6 @@ Name: mojarra Version: 2.2.13 -Release: 1 +Release: 2 Summary: JSF Reference Implementation License: CDDL or GPLv2 with exceptions URL: http://javaserverfaces.java.net @@ -20,6 +20,7 @@ Patch8: mojarra-dont-use-namespace-alias.patch Patch9: mojarra-servlet-3.1.patch Patch10: mojarra-2.2.13-disable-references-to-com.sun.faces.spi.InjectionProvider.patch Patch11: mojarra-2.2.13-disabling-stripping-API-jars.patch +Patch12: CVE-2020-6950.patch BuildArch: noarch BuildRequires: ant ant-contrib apache-commons-digester aqute-bnd atinject cdi-api @@ -55,6 +56,7 @@ This package contains the API documentation for mojarra. %patch9 -p1 %patch10 -p1 %patch11 -p1 +%patch12 -p1 sed -i "s|-f @{pomFile}|-o -f @{pomFile}|" common/ant/maven.xml common/ant/maven-pre-maven-rename.xml find . -name '*.class' -print -delete find . -name '*.jar' -print -delete @@ -143,5 +145,8 @@ cp -rp jsf-ri/build/javadocs/* %{buildroot}%{_javadocdir}/mojarra/jsf-impl/. %license LICENSE %changelog +* Thu Jun 10 2021 wutao - 2.2.13-2 +- fix CVE-2020-6950 + * Fri Sep 11 2020 huanghaitao - 2.2.13-1 - package init -- Gitee