From nobody Tue Apr 16 21:35:23 2024 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4VJy4r1XGTz5H7Xt; Tue, 16 Apr 2024 21:35:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4VJy4r0WDWz4WZx; Tue, 16 Apr 2024 21:35:24 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1713303324; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=44oQU0/4U8wD4KzVqHBXRReUGof5gS55o0kJ2u7a7xI=; b=lrMrDTB11Y1T3lkgAdR365epeMjvsQBYxz3AfWuo9Zvwvbgjt2JrO3AJ42gXc06+ztr/lP XNBuY+R/nojPYGP7gijfg29zLxYRxBxNwmzR4+P3MszWtYCjZ19+UzFI1x7pApkUN0T8mW w92/U1SJvKnSP0ypQrbWI62bifRKY0TUnD/ur2IKtnu34kf3tJ3kA1gvXY2/Y5rISWTyPN z9QgsejtgmlffT06GvxCbIU1hfczaBm/FWQEFC0w0D6503seJbNhJ3VdTOCFO6CP/zuDIj J/1KjdhUBjzLfumIIzQDXsSJCipfGzK6lzH7SrxmTLJj8YJpdBgebuxAxNiUaQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1713303324; a=rsa-sha256; cv=none; b=kGaH76E3PA86JsXgVE4l1+0/rywxWUjvuBqnF4VjNJ+p0aQhTgAdTpee+pXgDI7vtJWcAI knElBe2WE6k4OzMD5SUGesZNL46QkohO9Ycre29NKsevoHkK+ePXDksMvQwXc/HKhXQwHk 0w8/WQft1remIFeLJ+sxuKFECRaPO+kiDieoVMmVMcR+XolzV6YHus8ZZg3zpVZw/4Xm4o rz027jBLRsKDcEpFl2h6cHV1PXoQHZfIrZmZWXHVVzXg9O+xhhw/0dmh1HXo5aa6t3tWMK xZdEBsab5LcqL7p4T3l+HHNwftA30d419clAXy1eBNHxL0CGSMPkgUW9lftXcg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1713303324; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=44oQU0/4U8wD4KzVqHBXRReUGof5gS55o0kJ2u7a7xI=; b=YFGeYD3hG+ZX2y969bqCCa98QqCJmJLcz5v39npD2R4uAkM1kPCjNHpThzDgNXgrnRo4Rf uAxTbvLFhH2B+wx49m2ZNqlcwg2x7jJs6JMjhFWBSo2iBOnpFg851MBv8R5SEznGWtA4DX QvUYuxI+Jme7ln2nTAQOBeXleE2rRbOA+UkgHDQ9i66JsDU7e3+cMtiM3RU8/nXjQbIxtY Kt5d2jxKPd1Y5DT3Vo/Cc9+8lUuPZcg0RZIWFelTlidH2NgB1v/rvW9fVedNWMvy3OBohX etDdHUu+qhuyZnMi62wADuQ7EVBTMFlt5QXhOngkPMpx5ut8zNcJITfyCIeaog== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4VJy4r06bszytb; Tue, 16 Apr 2024 21:35:24 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 43GLZN8H078023; Tue, 16 Apr 2024 21:35:23 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 43GLZN8m078020; Tue, 16 Apr 2024 21:35:23 GMT (envelope-from git) Date: Tue, 16 Apr 2024 21:35:23 GMT Message-Id: <202404162135.43GLZN8m078020@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Matthias Andree Subject: git: 725af8c49dfe - main - mail/mailman: add XSS patch for HTDIG-enabled builds List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-ports-main@freebsd.org Sender: owner-dev-commits-ports-main@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mandree X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 725af8c49dfeaf525da5ac0aaa52e237dd11c67a Auto-Submitted: auto-generated The branch main has been updated by mandree: URL: https://cgit.FreeBSD.org/ports/commit/?id=725af8c49dfeaf525da5ac0aaa52e237dd11c67a commit 725af8c49dfeaf525da5ac0aaa52e237dd11c67a Author: Matthias Andree AuthorDate: 2024-04-16 19:03:13 +0000 Commit: Matthias Andree CommitDate: 2024-04-16 19:08:53 +0000 mail/mailman: add XSS patch for HTDIG-enabled builds Reported by: Dan Niles Obtained from: Dan Niles https://github.com/danogh/mailman2.3/blob/main/Patches/htdig/mailman-htdig-xss.patch --- mail/mailman/Makefile | 3 ++- mail/mailman/files/mailman-htdig-xss.patch | 16 ++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/mail/mailman/Makefile b/mail/mailman/Makefile index 2da052f7a57c..64fc99cd5a3b 100644 --- a/mail/mailman/Makefile +++ b/mail/mailman/Makefile @@ -1,6 +1,6 @@ PORTNAME= mailman DISTVERSION= 2.1.39 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= mail MASTER_SITES= GNU \ SF/${PORTNAME}/Mailman%202.1%20%28stable%29/${PORTVERSION} \ @@ -139,6 +139,7 @@ PKGNAMESUFFIX:= ${PKGNAMESUFFIX}-with-htdig #X upload the latter with mode 0644 or similar to freefall's public_distfiles/ directory _HTDIGREV= 1822 PATCHFILES+= msapiro-htdig-${_HTDIGREV}.patch.xz +EXTRA_PATCHES+= ${FILESDIR}/mailman-htdig-xss.patch RUN_DEPENDS+= htdig:textproc/htdig PLIST_SUB+= SUB_HTDIG="" .else diff --git a/mail/mailman/files/mailman-htdig-xss.patch b/mail/mailman/files/mailman-htdig-xss.patch new file mode 100644 index 000000000000..454fb6530180 --- /dev/null +++ b/mail/mailman/files/mailman-htdig-xss.patch @@ -0,0 +1,16 @@ +Obtained from: Dan Niles +https://github.com/danogh/mailman2.3/blob/main/Patches/htdig/mailman-htdig-xss.patch + +--- ./Mailman/Cgi/mmsearch.py.orig 2024-04-15 11:11:03.159081000 -0500 ++++ ./Mailman/Cgi/mmsearch.py 2024-04-15 11:57:40.585341000 -0500 +@@ -146,6 +146,10 @@ + raise _search_exception(listname, 'cgi', '-6- ' + detail) + if type(fs[fieldname]) is types.ListType: + raise _search_exception(listname, 'cgi', '-8- ' + detail) ++ if (re.search('[<>]', fs[fieldname].value) or ++ Utils.suspiciousHTML(fs[fieldname].value)): ++ raise _search_exception(listname, 'cgi', ++ '-15- suspicious parameter') + fieldhash[fieldname] = fs[fieldname].value + return urllib.urlencode(fieldhash) +