From 72fd75e4582a8c4b24eb3e5ea4da33b21f626c73 Mon Sep 17 00:00:00 2001 From: skyamgarp <130442619+skyamgarp@users.noreply.github.com> Date: Tue, 23 Jan 2024 12:42:27 +0530 Subject: [PATCH] (PA-6051) Bump Ruby to 3.2.3 --- .../{ruby-3.2.2.rb => ruby-3.2.3.rb} | 7 +- configs/projects/agent-runtime-main.rb | 2 +- configs/projects/pdk-runtime.rb | 2 +- .../projects/pe-bolt-server-runtime-main.rb | 2 +- configs/projects/pe-installer-runtime-main.rb | 2 +- .../ruby_32/uri-redos-cve-2023-36617.patch | 83 ------------------- 6 files changed, 7 insertions(+), 91 deletions(-) rename configs/components/{ruby-3.2.2.rb => ruby-3.2.3.rb} (98%) delete mode 100644 resources/patches/ruby_32/uri-redos-cve-2023-36617.patch diff --git a/configs/components/ruby-3.2.2.rb b/configs/components/ruby-3.2.3.rb similarity index 98% rename from configs/components/ruby-3.2.2.rb rename to configs/components/ruby-3.2.3.rb index ff46bc145..c3327a226 100644 --- a/configs/components/ruby-3.2.2.rb +++ b/configs/components/ruby-3.2.3.rb @@ -1,7 +1,7 @@ # The file name of the ruby component must match the ruby_version -component 'ruby-3.2.2' do |pkg, settings, platform| - pkg.version '3.2.2' - pkg.sha256sum '96c57558871a6748de5bc9f274e93f4b5aad06cd8f37befa0e8d94e7b8a423bc' +component 'ruby-3.2.3' do |pkg, settings, platform| + pkg.version '3.2.3' + pkg.sha256sum 'af7f1757d9ddb630345988139211f1fd570ff5ba830def1cc7c468ae9b65c9ba' # rbconfig-update is used to munge rbconfigs after the fact. pkg.add_source("file://resources/files/ruby/rbconfig-update.rb") @@ -38,7 +38,6 @@ base = 'resources/patches/ruby_32' - pkg.apply_patch "#{base}/uri-redos-cve-2023-36617.patch" if platform.is_cross_compiled? unless platform.is_macos? diff --git a/configs/projects/agent-runtime-main.rb b/configs/projects/agent-runtime-main.rb index 6b4202c6e..4a7bf3557 100644 --- a/configs/projects/agent-runtime-main.rb +++ b/configs/projects/agent-runtime-main.rb @@ -1,7 +1,7 @@ project 'agent-runtime-main' do |proj| # Set preferred component versions if they differ from defaults: - proj.setting :ruby_version, '3.2.2' + proj.setting :ruby_version, '3.2.3' proj.setting :rubygem_deep_merge_version, '1.2.2' proj.setting :rubygem_hocon_version, '1.4.0' diff --git a/configs/projects/pdk-runtime.rb b/configs/projects/pdk-runtime.rb index d4b51ac5a..5d9f65960 100644 --- a/configs/projects/pdk-runtime.rb +++ b/configs/projects/pdk-runtime.rb @@ -48,7 +48,7 @@ proj.setting(:includedir, File.join(proj.prefix, 'include')) proj.setting(:bindir, File.join(proj.prefix, 'bin')) - proj.setting(:ruby_version, '3.2.2') + proj.setting(:ruby_version, '3.2.3') proj.setting(:ruby_major_version, 3) proj.setting(:ruby_api, '3.2.0') diff --git a/configs/projects/pe-bolt-server-runtime-main.rb b/configs/projects/pe-bolt-server-runtime-main.rb index 91796a4bb..5a0f073c8 100644 --- a/configs/projects/pe-bolt-server-runtime-main.rb +++ b/configs/projects/pe-bolt-server-runtime-main.rb @@ -7,7 +7,7 @@ # Once we are no longer using ruby 2.5 we can update. proj.setting(:no_doc, true) - proj.setting(:ruby_version, '3.2.2') + proj.setting(:ruby_version, '3.2.3') proj.setting(:openssl_version, '3.0') # We enable legacy algorithms for winrm transport. Currently the winrm transport diff --git a/configs/projects/pe-installer-runtime-main.rb b/configs/projects/pe-installer-runtime-main.rb index 7e65ab52d..0f0bb17f4 100644 --- a/configs/projects/pe-installer-runtime-main.rb +++ b/configs/projects/pe-installer-runtime-main.rb @@ -1,7 +1,7 @@ project 'pe-installer-runtime-main' do |proj| # Used in component configurations to conditionally include dependencies proj.setting(:runtime_project, 'pe-installer') - proj.setting(:ruby_version, '3.2.2') + proj.setting(:ruby_version, '3.2.3') proj.setting(:augeas_version, '1.14.1') proj.setting(:openssl_version, '3.0') # NLTM uses MD4 unconditionally in its protocol, so legacy algos must be diff --git a/resources/patches/ruby_32/uri-redos-cve-2023-36617.patch b/resources/patches/ruby_32/uri-redos-cve-2023-36617.patch deleted file mode 100644 index 0cd264614..000000000 --- a/resources/patches/ruby_32/uri-redos-cve-2023-36617.patch +++ /dev/null @@ -1,83 +0,0 @@ -From dd73fe077cae077808e820f4765a12b1f4660521 Mon Sep 17 00:00:00 2001 -From: Hiroshi SHIBATA -Date: Wed, 21 Jun 2023 13:20:54 +0900 -Subject: [PATCH] Merge URI-0.12.2 - ---- - lib/uri/rfc2396_parser.rb | 4 ++-- - lib/uri/rfc3986_parser.rb | 2 +- - lib/uri/version.rb | 2 +- - test/uri/test_parser.rb | 22 ++++++++++++++++++++++ - 4 files changed, 26 insertions(+), 4 deletions(-) - -diff --git a/lib/uri/rfc2396_parser.rb b/lib/uri/rfc2396_parser.rb -index 76a8f99fd4..00c66cf042 100644 ---- a/lib/uri/rfc2396_parser.rb -+++ b/lib/uri/rfc2396_parser.rb -@@ -497,8 +497,8 @@ def initialize_regexp(pattern) - ret = {} - - # for URI::split -- ret[:ABS_URI] = Regexp.new('\A\s*' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED) -- ret[:REL_URI] = Regexp.new('\A\s*' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED) -+ ret[:ABS_URI] = Regexp.new('\A\s*+' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED) -+ ret[:REL_URI] = Regexp.new('\A\s*+' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED) - - # for URI::extract - ret[:URI_REF] = Regexp.new(pattern[:URI_REF]) -diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb -index dd24a409ea..9b1663dbb6 100644 ---- a/lib/uri/rfc3986_parser.rb -+++ b/lib/uri/rfc3986_parser.rb -@@ -100,7 +100,7 @@ def default_regexp # :nodoc: - QUERY: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, - FRAGMENT: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, - OPAQUE: /\A(?:[^\/].*)?\z/, -- PORT: /\A[\x09\x0a\x0c\x0d ]*\d*[\x09\x0a\x0c\x0d ]*\z/, -+ PORT: /\A[\x09\x0a\x0c\x0d ]*+\d*[\x09\x0a\x0c\x0d ]*\z/, - } - end - -diff --git a/lib/uri/version.rb b/lib/uri/version.rb -index 7497a7d31a..f0aca586ac 100644 ---- a/lib/uri/version.rb -+++ b/lib/uri/version.rb -@@ -1,6 +1,6 @@ - module URI - # :stopdoc: -- VERSION_CODE = '001201'.freeze -+ VERSION_CODE = '001202'.freeze - VERSION = VERSION_CODE.scan(/../).collect{|n| n.to_i}.join('.').freeze - # :startdoc: - end -diff --git a/test/uri/test_parser.rb b/test/uri/test_parser.rb -index 72fb5901d9..cee0acb4b5 100644 ---- a/test/uri/test_parser.rb -+++ b/test/uri/test_parser.rb -@@ -79,4 +79,26 @@ def test_split - assert_equal([nil, nil, "example.com", nil, nil, "", nil, nil, nil], URI.split("//example.com")) - assert_equal([nil, nil, "[0::0]", nil, nil, "", nil, nil, nil], URI.split("//[0::0]")) - end -+ -+ def test_rfc2822_parse_relative_uri -+ pre = ->(length) { -+ " " * length + "\0" -+ } -+ parser = URI::RFC2396_Parser.new -+ assert_linear_performance((1..5).map {|i| 10**i}, pre: pre) do |uri| -+ assert_raise(URI::InvalidURIError) do -+ parser.split(uri) -+ end -+ end -+ end -+ -+ def test_rfc3986_port_check -+ pre = ->(length) {"\t" * length + "a"} -+ uri = URI.parse("http://my.example.com") -+ assert_linear_performance((1..5).map {|i| 10**i}, pre: pre) do |port| -+ assert_raise(URI::InvalidComponentError) do -+ uri.port = port -+ end -+ end -+ end - end