1
0
mirror of https://git.yoctoproject.org/poky synced 2026-05-09 17:39:31 +00:00
Files
poky/meta/recipes-devtools/ruby/ruby_3.1.3.bb
T
Divya Chellam 61c55b9e30 ruby: fix CVE-2024-49761
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS
vulnerability when it parses an XML that has many digits between &# and x...;
in a hex numeric character reference (&#x.... This does not happen with
Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby.
The REXML gem 3.3.9 or later include the patch to fix the vulnerability.

CVE-2024-49761-0009.patch is the CVE fix and rest are dependent commits.

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2024-49761

Upstream-patch:
https://github.com/ruby/rexml/commit/810d2285235d5501a0a124f300832e6e9515da3c
https://github.com/ruby/rexml/commit/83ca5c4b0f76cf7b307dd1be1dc934e1e8199863
https://github.com/ruby/rexml/commit/51217dbcc64ecc34aa70f126b103bedf07e153fc
https://github.com/ruby/rexml/commit/7e4049f6a68c99c4efec2df117057ee080680c9f
https://github.com/ruby/rexml/commit/fc6cad570b849692a28f26a963ceb58edc282bbc
https://github.com/ruby/rexml/commit/77128555476cb0db798e2912fb3a07d6411dc320
https://github.com/ruby/rexml/commit/370666e314816b57ecd5878e757224c3b6bc93f5
https://github.com/ruby/rexml/commit/a579730f25ec7443796495541ec57c071b91805d
https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f

(From OE-Core rev: 5b453400e9dd878b81b1447d14b3f518809de17e)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
2025-01-18 06:21:02 -08:00

160 lines
6.4 KiB
BlitzBasic

SUMMARY = "An interpreter of object-oriented scripting language"
DESCRIPTION = "Ruby is an interpreted scripting language for quick \
and easy object-oriented programming. It has many features to process \
text files and to do system management tasks (as in Perl). \
It is simple, straight-forward, and extensible. \
"
HOMEPAGE = "http://www.ruby-lang.org/"
SECTION = "devel/ruby"
LICENSE = "Ruby | BSD-2-Clause | BSD-3-Clause | GPL-2.0-only | ISC | MIT"
LIC_FILES_CHKSUM = "file://COPYING;md5=5b8c87559868796979806100db3f3805 \
file://BSDL;md5=8b50bc6de8f586dc66790ba11d064d75 \
file://GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
file://LEGAL;md5=f260190bc1e92e363f0ee3c0463d4c7c \
"
DEPENDS = "zlib openssl libyaml gdbm readline libffi"
DEPENDS:append:class-target = " ruby-native"
SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}"
SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \
file://0001-extmk-fix-cross-compilation-of-external-gems.patch \
file://0002-Obey-LDFLAGS-for-the-link-of-libruby.patch \
file://remove_has_include_macros.patch \
file://run-ptest \
file://0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch \
file://0002-template-Makefile.in-filter-out-f-prefix-map.patch \
file://0003-rdoc-build-reproducible-documentation.patch \
file://0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch \
file://0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch \
file://0006-Make-gemspecs-reproducible.patch \
file://0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch \
file://CVE-2023-28756.patch \
file://CVE-2023-28755.patch \
file://CVE-2023-36617_1.patch \
file://CVE-2023-36617_2.patch \
file://CVE-2024-27281.patch \
file://CVE-2024-27280.patch \
file://CVE-2024-27282.patch \
file://CVE-2024-49761-0001.patch \
file://CVE-2024-49761-0002.patch \
file://CVE-2024-49761-0003.patch \
file://CVE-2024-49761-0004.patch \
file://CVE-2024-49761-0005.patch \
file://CVE-2024-49761-0006.patch \
file://CVE-2024-49761-0007.patch \
file://CVE-2024-49761-0008.patch \
file://CVE-2024-49761-0009.patch \
"
UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/"
inherit autotools ptest pkgconfig
# This snippet lets compiled extensions which rely on external libraries,
# such as zlib, compile properly. If we don't do this, then when extmk.rb
# runs, it uses the native libraries instead of the target libraries, and so
# none of the linking operations succeed -- which makes extconf.rb think
# that the libraries aren't available and hence that the extension can't be
# built.
do_configure:prepend() {
sed -i "s#%%TARGET_CFLAGS%%#$CFLAGS#; s#%%TARGET_LDFLAGS%%#$LDFLAGS#" ${S}/common.mk
rm -rf ${S}/ruby/
}
DEPENDS:append:libc-musl = " libucontext"
SRC_URI[sha256sum] = "5ea498a35f4cd15875200a52dde42b6eb179e1264e17d78732c3a57cd1c6ab9e"
PACKAGECONFIG ??= ""
PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
PACKAGECONFIG[valgrind] = "--with-valgrind=yes, --with-valgrind=no, valgrind"
PACKAGECONFIG[gmp] = "--with-gmp=yes, --with-gmp=no, gmp"
PACKAGECONFIG[ipv6] = "--enable-ipv6, --disable-ipv6,"
# rdoc is off by default due to non-reproducibility reported in
# https://bugs.ruby-lang.org/issues/18456
PACKAGECONFIG[rdoc] = "--enable-install-rdoc,--disable-install-rdoc,"
EXTRA_OECONF = "\
--disable-versioned-paths \
--disable-rpath \
--disable-dtrace \
--enable-shared \
--enable-load-relative \
--with-pkg-config=pkg-config \
--with-static-linked-ext \
--with-mantype=man \
"
EXTRA_OECONF:append:libc-musl = "\
ac_cv_func_isnan=yes \
ac_cv_func_isinf=yes \
"
PARALLEL_MAKEINST = ""
do_install:append:class-target () {
# Find out rbconfig.rb from .installed.list
rbconfig_rb=`grep rbconfig.rb ${B}/.installed.list`
# Remove build host directories
sed -i -e 's:--sysroot=${STAGING_DIR_TARGET}::g' \
-e s:'--with-libtool-sysroot=${STAGING_DIR_TARGET}'::g \
-e 's|${DEBUG_PREFIX_MAP}||g' \
-e 's:${HOSTTOOLS_DIR}/::g' \
-e 's:${RECIPE_SYSROOT_NATIVE}::g' \
-e 's:${RECIPE_SYSROOT}::g' \
-e 's:${BASE_WORKDIR}/${MULTIMACH_TARGET_SYS}::g' \
${D}$rbconfig_rb
sed -i -e 's|${DEBUG_PREFIX_MAP}||g' \
${D}${libdir}/pkgconfig/*.pc
# logs that may contain host-specific paths
find ${D} -name gem_make.out -delete
}
do_install_ptest () {
cp -rf ${S}/test ${D}${PTEST_PATH}/
install -D ${S}/tool/test/runner.rb ${D}${PTEST_PATH}/tool/test/runner.rb
cp -r ${S}/tool/lib ${D}${PTEST_PATH}/tool/
mkdir -p ${D}${PTEST_PATH}/lib
cp -r ${S}/lib/did_you_mean ${S}/lib/rdoc ${D}${PTEST_PATH}/lib
# install test-binaries
# These .so files have sporadic reproducibility fails as seen here:
# https://autobuilder.yocto.io/pub/repro-fail/oe-reproducible-20220107-rm1diuww/packages/diff-html/
# As they are needed only in ruby-ptest, and that is currently altogether disabled, let's take them out.
# If someone wants to look at where the non-determinism comes from, one possible reason is use of
# -rdynamic -Wl,-export-dynamic
#find $(find ./.ext -path '*/-test-') -name '*.so' -print0 \
# | tar --no-recursion --null -T - --no-same-owner --preserve-permissions -cf - \
# | tar -C ${D}${libdir}/ruby/${SHRT_VER}.0/ --no-same-owner --preserve-permissions --strip-components=2 -xf -
# adjust path to not assume build directory layout
sed -e 's|File.expand_path(.*\.\./bin/erb[^)]*|File.expand_path("${bindir}/erb"|g' \
-i ${D}${PTEST_PATH}/test/erb/test_erb_command.rb
cp -r ${S}/include ${D}/${libdir}/ruby/
}
PACKAGES =+ "${PN}-ri-docs ${PN}-rdoc"
SUMMARY:${PN}-ri-docs = "ri (Ruby Interactive) documentation for the Ruby standard library"
RDEPENDS:${PN}-ri-docs = "${PN}"
FILES:${PN}-ri-docs += "${datadir}/ri"
SUMMARY:${PN}-rdoc = "RDoc documentation generator from Ruby source"
RDEPENDS:${PN}-rdoc = "${PN}"
FILES:${PN}-rdoc += "${libdir}/ruby/*/rdoc ${bindir}/rdoc"
FILES:${PN} += "${datadir}/rubygems"
FILES:${PN}-ptest:append:class-target = "\
${libdir}/ruby/include \
${libdir}/ruby/${SHRT_VER}.0/*/-test- \
"
BBCLASSEXTEND = "native"