diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3be2f6a --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/xalan-j_2_7_1-src.tar.gz diff --git a/.rh-maven35-xalan-j2.metadata b/.rh-maven35-xalan-j2.metadata new file mode 100644 index 0000000..d44aae0 --- /dev/null +++ b/.rh-maven35-xalan-j2.metadata @@ -0,0 +1 @@ +dfaac3bd3e18a8961c27b3d07b7405bd8a15d64a SOURCES/xalan-j_2_7_1-src.tar.gz diff --git a/README.md b/README.md deleted file mode 100644 index 98f42b4..0000000 --- a/README.md +++ /dev/null @@ -1,4 +0,0 @@ -The master branch has no content - -Look at the c7 branch if you are working with CentOS-7, or the c4/c5/c6 branch for CentOS-4, 5 or 6 -If you find this file in a distro specific branch, it means that no content has been checked in yet diff --git a/SOURCES/serializer-2.7.1.pom b/SOURCES/serializer-2.7.1.pom new file mode 100644 index 0000000..79b0027 --- /dev/null +++ b/SOURCES/serializer-2.7.1.pom @@ -0,0 +1,39 @@ + + + + 4.0.0 + + org.apache + apache + 4 + + + xalan + serializer + 2.7.1 + + Xalan Java Serializer + + Serializer to write out XML, HTML etc. as a stream of characters from an input DOM or from input + SAX events. + + http://xml.apache.org/xalan-j/ + + + + xml-apis + xml-apis + 1.3.04 + + + xerces + xercesImpl + 2.9.0 + true + + + + \ No newline at end of file diff --git a/SOURCES/xalan-2.7.1.pom b/SOURCES/xalan-2.7.1.pom new file mode 100644 index 0000000..b4a56e9 --- /dev/null +++ b/SOURCES/xalan-2.7.1.pom @@ -0,0 +1,41 @@ + + + + 4.0.0 + + org.apache + apache + 4 + + + xalan + xalan + 2.7.1 + + Xalan Java + + Xalan-Java is an XSLT processor for transforming XML documents into HTML, + text, or other XML document types. It implements XSL Transformations (XSLT) + Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from + the command line, in an applet or a servlet, or as a module in other program. + + http://xml.apache.org/xalan-j/ + + + + xalan + serializer + 2.7.1 + + + xerces + xercesImpl + 2.9.0 + true + + + + \ No newline at end of file diff --git a/SOURCES/xalan-j2-CVE-2014-0107.patch b/SOURCES/xalan-j2-CVE-2014-0107.patch new file mode 100644 index 0000000..3358f60 --- /dev/null +++ b/SOURCES/xalan-j2-CVE-2014-0107.patch @@ -0,0 +1,148 @@ +diff --git a/src/org/apache/xalan/processor/TransformerFactoryImpl.java b/src/org/apache/xalan/processor/TransformerFactoryImpl.java +index 1298943..96a5e58 100644 +--- a/src/org/apache/xalan/processor/TransformerFactoryImpl.java ++++ b/src/org/apache/xalan/processor/TransformerFactoryImpl.java +@@ -335,6 +335,10 @@ public class TransformerFactoryImpl extends SAXTransformerFactory + reader = XMLReaderFactory.createXMLReader(); + } + ++ if(m_isSecureProcessing) ++ { ++ reader.setFeature("http://xml.org/sax/features/external-general-entities",false); ++ } + // Need to set options! + reader.setContentHandler(handler); + reader.parse(isource); +diff --git a/src/org/apache/xalan/processor/XSLTElementProcessor.java b/src/org/apache/xalan/processor/XSLTElementProcessor.java +index b946743..17b7395 100644 +--- a/src/org/apache/xalan/processor/XSLTElementProcessor.java ++++ b/src/org/apache/xalan/processor/XSLTElementProcessor.java +@@ -338,17 +338,31 @@ public class XSLTElementProcessor extends ElemTemplateElement + } + else + { +- // Can we switch the order here: +- +- boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, +- attributes.getQName(i), attributes.getValue(i), +- target); +- +- // Now we only add the element if it passed a validation check +- if (success) +- processedDefs.add(attrDef); +- else +- errorDefs.add(attrDef); ++ //handle secure processing ++ if(handler.getStylesheetProcessor()==null) ++ System.out.println("stylesheet processor null"); ++ if(attrDef.getName().compareTo("*")==0 && handler.getStylesheetProcessor().isSecureProcessing()) ++ { ++ //foreign attributes are not allowed in secure processing mode ++ // Then barf, because this element does not allow this attribute. ++ handler.error(XSLTErrorResources.ER_ATTR_NOT_ALLOWED, new Object[]{attributes.getQName(i), rawName}, null);//"\""+attributes.getQName(i)+"\"" ++ //+ " attribute is not allowed on the " + rawName ++ // + " element!", null); ++ } ++ else ++ { ++ ++ ++ boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, ++ attributes.getQName(i), attributes.getValue(i), ++ target); ++ ++ // Now we only add the element if it passed a validation check ++ if (success) ++ processedDefs.add(attrDef); ++ else ++ errorDefs.add(attrDef); ++ } + } + } + +diff --git a/src/org/apache/xalan/transformer/TransformerImpl.java b/src/org/apache/xalan/transformer/TransformerImpl.java +index dd0d4d9..0906d24 100644 +--- a/src/org/apache/xalan/transformer/TransformerImpl.java ++++ b/src/org/apache/xalan/transformer/TransformerImpl.java +@@ -438,7 +438,9 @@ public class TransformerImpl extends Transformer + try + { + if (sroot.getExtensions() != null) +- m_extensionsTable = new ExtensionsTable(sroot); ++ //only load extensions if secureProcessing is disabled ++ if(!sroot.isSecureProcessing()) ++ m_extensionsTable = new ExtensionsTable(sroot); + } + catch (javax.xml.transform.TransformerException te) + {te.printStackTrace();} +diff --git a/src/org/apache/xpath/functions/FuncSystemProperty.java b/src/org/apache/xpath/functions/FuncSystemProperty.java +index 4bea356..78ac980 100644 +--- a/src/org/apache/xpath/functions/FuncSystemProperty.java ++++ b/src/org/apache/xpath/functions/FuncSystemProperty.java +@@ -58,7 +58,7 @@ public class FuncSystemProperty extends FunctionOneArg + + String fullName = m_arg0.execute(xctxt).str(); + int indexOfNSSep = fullName.indexOf(':'); +- String result; ++ String result = null; + String propName = ""; + + // List of properties where the name of the +@@ -98,14 +98,20 @@ public class FuncSystemProperty extends FunctionOneArg + + try + { +- result = System.getProperty(propName); +- +- if (null == result) +- { +- +- // result = System.getenv(propName); +- return XString.EMPTYSTRING; +- } ++ //if secure procession is enabled only handle required properties do not not map any valid system property ++ if(!xctxt.isSecureProcessing()) ++ { ++ result = System.getProperty(propName); ++ } ++ else ++ { ++ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, ++ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); ++ } ++ if (null == result) ++ { ++ return XString.EMPTYSTRING; ++ } + } + catch (SecurityException se) + { +@@ -120,14 +126,20 @@ public class FuncSystemProperty extends FunctionOneArg + { + try + { +- result = System.getProperty(fullName); +- +- if (null == result) +- { +- +- // result = System.getenv(fullName); +- return XString.EMPTYSTRING; +- } ++ //if secure procession is enabled only handle required properties do not not map any valid system property ++ if(!xctxt.isSecureProcessing()) ++ { ++ result = System.getProperty(fullName); ++ } ++ else ++ { ++ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, ++ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); ++ } ++ if (null == result) ++ { ++ return XString.EMPTYSTRING; ++ } + } + catch (SecurityException se) + { diff --git a/SOURCES/xalan-j2-MANIFEST.MF b/SOURCES/xalan-j2-MANIFEST.MF new file mode 100644 index 0000000..f5d77cf --- /dev/null +++ b/SOURCES/xalan-j2-MANIFEST.MF @@ -0,0 +1,75 @@ +Manifest-Version: 1.0 +Ant-Version: Apache Ant 1.8.2 +Created-By: 1.7.0_b147-icedtea (Oracle Corporation) +Main-Class: org.apache.xalan.xslt.Process +Bundle-ManifestVersion: 2 +Bundle-Name: %Bundle-Name.0 +Bundle-SymbolicName: org.apache.xalan +Bundle-Version: 2.7.1 +Bundle-Vendor: %Bundle-Vendor.0 +Export-Package: org.apache.regexp;version="2.7.1", + org.apache.xalan;version="2.7.1", + org.apache.xalan.client;version="2.7.1", + org.apache.xalan.extensions;version="2.7.1", + org.apache.xalan.lib;version="2.7.1", + org.apache.xalan.lib.sql;version="2.7.1", + org.apache.xalan.processor;version="2.7.1", + org.apache.xalan.res;version="2.7.1", + org.apache.xalan.serialize;version="2.7.1", + org.apache.xalan.templates;version="2.7.1", + org.apache.xalan.trace;version="2.7.1", + org.apache.xalan.transformer;version="2.7.1", + org.apache.xalan.xslt;version="2.7.1", + org.apache.xalan.xsltc;version="2.7.1", + org.apache.xalan.xsltc.cmdline;version="2.7.1", + org.apache.xalan.xsltc.cmdline.getopt;version="2.7.1", + org.apache.xalan.xsltc.compiler;version="2.7.1", + org.apache.xalan.xsltc.compiler.util;version="2.7.1", + org.apache.xalan.xsltc.dom;version="2.7.1", + org.apache.xalan.xsltc.runtime;version="2.7.1", + org.apache.xalan.xsltc.runtime.output;version="2.7.1", + org.apache.xalan.xsltc.trax;version="2.7.1", + org.apache.xalan.xsltc.util;version="2.7.1", + org.apache.xml.dtm;version="2.7.1", + org.apache.xml.dtm.ref;version="2.7.1", + org.apache.xml.dtm.ref.dom2dtm;version="2.7.1", + org.apache.xml.dtm.ref.sax2dtm;version="2.7.1", + org.apache.xml.res;version="2.7.1", + org.apache.xml.utils;version="2.7.1", + org.apache.xml.utils.res;version="2.7.1", + org.apache.xpath;version="2.7.1", + org.apache.xpath.axes;version="2.7.1", + org.apache.xpath.compiler;version="2.7.1", + org.apache.xpath.domapi;version="2.7.1", + org.apache.xpath.functions;version="2.7.1", + org.apache.xpath.jaxp;version="2.7.1", + org.apache.xpath.objects;version="2.7.1", + org.apache.xpath.operations;version="2.7.1", + org.apache.xpath.patterns;version="2.7.1", + org.apache.xpath.res;version="2.7.1" +Require-Bundle: system.bundle, org.apache.xerces +Eclipse-BuddyPolicy: registered + +Name: org/apache/xalan/ +Comment: Main Xalan engine implementing TrAX/JAXP +Specification-Title: Java API for XML Processing +Specification-Vendor: Sun Microsystems Inc. +Specification-Version: 1.3 +Implementation-Title: org.apache.xalan +Implementation-Version: 2.7.1 +Implementation-Vendor: Apache Software Foundation +Implementation-URL: http://xml.apache.org/xalan-j/dist/ + +Name: org/apache/xml/ +Comment: DTM implementation and utilities +Implementation-Title: org.apache.xml +Implementation-Version: 2.7.1 +Implementation-Vendor: Apache Software Foundation +Implementation-URL: http://xml.apache.org/xalan-j/dist/ + +Name: org/apache/xpath/ +Comment: XPath engine +Implementation-Title: org.apache.xpath +Implementation-Version: 2.7.1 +Implementation-Vendor: Apache Software Foundation +Implementation-URL: http://xml.apache.org/xalan-j/dist/ diff --git a/SOURCES/xalan-j2-noxsltcdeps.patch b/SOURCES/xalan-j2-noxsltcdeps.patch new file mode 100644 index 0000000..6840741 --- /dev/null +++ b/SOURCES/xalan-j2-noxsltcdeps.patch @@ -0,0 +1,11 @@ +--- build.xml.orig 2007-11-22 23:44:01.000000000 +0200 ++++ build.xml 2010-04-07 13:32:31.878542610 +0300 +@@ -683,7 +683,7 @@ $Id: build.xml 563656 2007-08-07 21:12:1 + + + +- + + diff --git a/SOURCES/xalan-j2-serializer-MANIFEST.MF b/SOURCES/xalan-j2-serializer-MANIFEST.MF new file mode 100644 index 0000000..436d24a --- /dev/null +++ b/SOURCES/xalan-j2-serializer-MANIFEST.MF @@ -0,0 +1,10 @@ +Manifest-Version: 1.0 +Bundle-RequiredExecutionEnvironment: J2SE-1.2 +Bundle-SymbolicName: org.apache.xml.serializer +Bundle-ManifestVersion: 2 +Bundle-Name: %Bundle-Name.0 +Bundle-Localization: plugin +Bundle-Version: 2.7.1.v200806030322 +Bundle-Vendor: %Bundle-Vendor.0 +Export-Package: org.apache.xml.serializer,org.apache.xml.serializer.do + m3 diff --git a/SOURCES/xsltc-2.7.1.pom b/SOURCES/xsltc-2.7.1.pom new file mode 100644 index 0000000..b32dbd0 --- /dev/null +++ b/SOURCES/xsltc-2.7.1.pom @@ -0,0 +1,13 @@ + + 4.0.0 + xalan + xsltc + 2.7.1 + + + xalan + xalan + 2.7.1 + + + diff --git a/SPECS/xalan-j2.spec b/SPECS/xalan-j2.spec new file mode 100644 index 0000000..c04b5d9 --- /dev/null +++ b/SPECS/xalan-j2.spec @@ -0,0 +1,597 @@ +%{?scl:%scl_package xalan-j2} +%{!?scl:%global pkg_name %{name}} + +# Copyright (c) 2000-2005, JPackage Project +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the +# distribution. +# 3. Neither the name of the JPackage Project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# + +%global cvs_version 2_7_1 + +Name: %{?scl_prefix}xalan-j2 +Version: 2.7.1 +Release: 31.2%{?dist} +Epoch: 0 +Summary: Java XSLT processor +# src/org/apache/xpath/domapi/XPathStylesheetDOM3Exception.java is W3C +License: ASL 2.0 and W3C +URL: http://xalan.apache.org/ +Source0: http://archive.apache.org/dist/xml/xalan-j/xalan-j_2_7_1-src.tar.gz +Source1: %{pkg_name}-serializer-MANIFEST.MF +Source2: http://repo1.maven.org/maven2/xalan/xalan/2.7.1/xalan-2.7.1.pom +Source3: http://repo1.maven.org/maven2/xalan/serializer/2.7.1/serializer-2.7.1.pom +Source4: xsltc-%{version}.pom +Source5: %{pkg_name}-MANIFEST.MF + +Patch0: %{pkg_name}-noxsltcdeps.patch +# Fix CVE-2014-0107: insufficient constraints in secure processing +# feature (oCERT-2014-002). Generated form upstream revisions 1581058 +# and 1581426. +Patch2: %{pkg_name}-CVE-2014-0107.patch + +BuildArch: noarch + +BuildRequires: %{?scl_prefix}javapackages-local +BuildRequires: %{?scl_prefix}ant +BuildRequires: %{?scl_prefix}apache-parent +BuildRequires: %{?scl_prefix}bcel +BuildRequires: %{?scl_prefix}java_cup +BuildRequires: %{?scl_prefix}regexp +BuildRequires: sed +BuildRequires: %{?scl_prefix}glassfish-servlet-api +BuildRequires: %{?scl_prefix}xerces-j2 >= 0:2.7.1 +BuildRequires: %{?scl_prefix}xml-commons-apis >= 0:1.3 +BuildRequires: %{?scl_prefix}xml-stylebook +BuildRequires: zip + +Requires: %{?scl_prefix}xerces-j2 + +Provides: %{?scl_prefix}jaxp_transform_impl + +%description +Xalan is an XSLT processor for transforming XML documents into HTML, +text, or other XML document types. It implements the W3C Recommendations +for XSL Transformations (XSLT) and the XML Path Language (XPath). It can +be used from the command line, in an applet or a servlet, or as a module +in other program. + +%package xsltc +Summary: XSLT compiler +Requires: %{?scl_prefix}java_cup +Requires: %{?scl_prefix}bcel +Requires: %{?scl_prefix}regexp +Requires: %{?scl_prefix}xerces-j2 + +%description xsltc +The XSLT Compiler is a Java-based tool for compiling XSLT stylesheets into +lightweight and portable Java byte codes called translets. + +%package manual +Summary: Manual for %{pkg_name} + +%description manual +Documentation for %{pkg_name}. + +%package javadoc +Summary: Javadoc for %{pkg_name} + +%description javadoc +Javadoc for %{pkg_name}. + +%package demo +Summary: Demo for %{pkg_name} +Requires: %{name} = %{epoch}:%{version}-%{release} +Requires: %{?scl_prefix}glassfish-servlet-api + +%description demo +Demonstrations and samples for %{pkg_name}. + +%prep +%setup -q -n xalan-j_%{cvs_version} +%patch0 -p0 +%patch2 -p1 + +find . -name '*.jar' -delete +find . -name '*.class' -delete + +# this tar.gz contains bundled software, some of which has unclear +# licensing terms (W3C Software/Document license) . We could probably +# replicate this with our jars but it's too much work so just generate +# non-interlinked documentation +rm src/*tar.gz +sed -i '/