diff --git a/.gitignore b/.gitignore index 3065f7d..1515fb4 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,4 @@ dev-tools.tar.xz /lucene-5.4.1-src.tgz /solr-5.5.0-src.tgz /solr-6.1.0-src.tgz +/solr-7.1.0-src.tgz diff --git a/0001-SOLR-11477-Disallow-resolving-of-external-entities-i.patch b/0001-SOLR-11477-Disallow-resolving-of-external-entities-i.patch deleted file mode 100644 index 467fe87..0000000 --- a/0001-SOLR-11477-Disallow-resolving-of-external-entities-i.patch +++ /dev/null @@ -1,207 +0,0 @@ -From 207994b28ef8b6d9fe8cdfa5d95631d54f032c78 Mon Sep 17 00:00:00 2001 -From: Christine Poerschke -Date: Fri, 13 Oct 2017 12:46:58 +0100 -Subject: [PATCH] SOLR-11477: Disallow resolving of external entities in Lucene - ---- - .../apache/lucene/queryparser/xml/CoreParser.java | 65 ++++++++++++++++++---- - .../lucene/queryparser/xml/DOCTYPE_TermQuery.xml | 19 +++++++ - .../lucene/queryparser/xml/ENTITY_TermQuery.xml | 23 ++++++++ - .../lucene/queryparser/xml/TestCoreParser.java | 13 +++++ - 4 files changed, 108 insertions(+), 12 deletions(-) - create mode 100644 lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/DOCTYPE_TermQuery.xml - create mode 100644 lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/ENTITY_TermQuery.xml - -diff --git a/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java b/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java -index 2dd0097..d1e1930 100644 ---- a/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java -+++ b/lucene/queryparser/src/java/org/apache/lucene/queryparser/xml/CoreParser.java -@@ -22,11 +22,17 @@ import org.apache.lucene.queryparser.xml.builders.*; - import org.apache.lucene.search.Query; - import org.w3c.dom.Document; - import org.w3c.dom.Element; -+import org.xml.sax.EntityResolver; -+import org.xml.sax.ErrorHandler; -+import org.xml.sax.SAXException; - -+import javax.xml.XMLConstants; - import javax.xml.parsers.DocumentBuilder; - import javax.xml.parsers.DocumentBuilderFactory; -+import javax.xml.parsers.ParserConfigurationException; - - import java.io.InputStream; -+import java.util.Locale; - - /** - * Assembles a QueryBuilder which uses only core Lucene Query objects -@@ -109,6 +115,10 @@ public class CoreParser implements QueryBuilder { - queryFactory.addBuilder("SpanNot", snot); - } - -+ /** -+ * Parses the given stream as XML file and returns a {@link Query}. -+ * By default this disallows external entities for security reasons. -+ */ - public Query parse(InputStream xmlStream) throws ParserException { - return getQuery(parseXML(xmlStream).getDocumentElement()); - } -@@ -121,23 +131,47 @@ public class CoreParser implements QueryBuilder { - spanFactory.addBuilder(nodeName, builder); - } - -- static Document parseXML(InputStream pXmlFile) throws ParserException { -- DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); -- DocumentBuilder db = null; -+ /** -+ * Returns a SAX {@link EntityResolver} to be used by {@link DocumentBuilder}. -+ * By default this returns {@link #DISALLOW_EXTERNAL_ENTITY_RESOLVER}, which disallows the -+ * expansion of external entities (for security reasons). To restore legacy behavior, -+ * override this method to return {@code null}. -+ */ -+ protected EntityResolver getEntityResolver() { -+ return DISALLOW_EXTERNAL_ENTITY_RESOLVER; -+ } -+ -+ /** -+ * Subclass and override to return a SAX {@link ErrorHandler} to be used by {@link DocumentBuilder}. -+ * By default this returns {@code null} so no error handler is used. -+ * This method can be used to redirect XML parse errors/warnings to a custom logger. -+ */ -+ protected ErrorHandler getErrorHandler() { -+ return null; -+ } -+ -+ private Document parseXML(InputStream pXmlFile) throws ParserException { -+ final DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance(); -+ dbf.setValidating(false); - try { -- db = dbf.newDocumentBuilder(); -- } -- catch (Exception se) { -- throw new ParserException("XML Parser configuration error", se); -+ dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); -+ } catch (ParserConfigurationException e) { -+ // ignore since all implementations are required to support the -+ // {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING} feature - } -- org.w3c.dom.Document doc = null; -+ final DocumentBuilder db; - try { -- doc = db.parse(pXmlFile); -+ db = dbf.newDocumentBuilder(); -+ } catch (Exception se) { -+ throw new ParserException("XML Parser configuration error.", se); - } -- catch (Exception se) { -- throw new ParserException("Error parsing XML stream:" + se, se); -+ try { -+ db.setEntityResolver(getEntityResolver()); -+ db.setErrorHandler(getErrorHandler()); -+ return db.parse(pXmlFile); -+ } catch (Exception se) { -+ throw new ParserException("Error parsing XML stream: " + se, se); - } -- return doc; - } - - -@@ -145,4 +179,11 @@ public class CoreParser implements QueryBuilder { - public Query getQuery(Element e) throws ParserException { - return queryFactory.getQuery(e); - } -+ -+ public static final EntityResolver DISALLOW_EXTERNAL_ENTITY_RESOLVER = (String publicId, String systemId) -> { -+ throw new SAXException(String.format(Locale.ENGLISH, -+ "External Entity resolving unsupported: publicId=\"%s\" systemId=\"%s\"", -+ publicId, systemId)); -+ }; -+ - } -diff --git a/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/DOCTYPE_TermQuery.xml b/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/DOCTYPE_TermQuery.xml -new file mode 100644 -index 0000000..28938ae ---- /dev/null -+++ b/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/DOCTYPE_TermQuery.xml -@@ -0,0 +1,19 @@ -+ -+ -+ -+sumitomo -diff --git a/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/ENTITY_TermQuery.xml b/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/ENTITY_TermQuery.xml -new file mode 100644 -index 0000000..dc59613 ---- /dev/null -+++ b/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/ENTITY_TermQuery.xml -@@ -0,0 +1,23 @@ -+ -+ -+ -+ -+]> -+ -+&internalTerm;&externalTerm; -diff --git a/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/TestCoreParser.java b/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/TestCoreParser.java -index 5f33545..b81cd82 100644 ---- a/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/TestCoreParser.java -+++ b/lucene/queryparser/src/test/org/apache/lucene/queryparser/xml/TestCoreParser.java -@@ -29,6 +29,7 @@ import org.apache.lucene.search.ScoreDoc; - import org.apache.lucene.search.TopDocs; - import org.apache.lucene.util.LuceneTestCase; - import org.junit.AfterClass; -+import org.xml.sax.SAXException; - - import java.io.IOException; - import java.io.InputStream; -@@ -66,6 +67,18 @@ public class TestCoreParser extends LuceneTestCase { - dumpResults("TermQuery", q, 5); - } - -+ public void test_DOCTYPE_TermQueryXML() throws ParserException, IOException { -+ SAXException saxe = LuceneTestCase.expectThrows(ParserException.class, SAXException.class, -+ () -> parse("DOCTYPE_TermQuery.xml")); -+ assertTrue(saxe.getMessage().startsWith("External Entity resolving unsupported:")); -+ } -+ -+ public void test_ENTITY_TermQueryXML() throws ParserException, IOException { -+ SAXException saxe = LuceneTestCase.expectThrows(ParserException.class, SAXException.class, -+ () -> parse("ENTITY_TermQuery.xml")); -+ assertTrue(saxe.getMessage().startsWith("External Entity resolving unsupported:")); -+ } -+ - public void testTermQueryEmptyXML() throws ParserException, IOException { - parseShouldFail("TermQueryEmpty.xml", - "TermQuery has no text"); --- -2.13.6 - diff --git a/lucene.spec b/lucene.spec index 2ef5a7d..4870dc1 100644 --- a/lucene.spec +++ b/lucene.spec @@ -2,33 +2,27 @@ Summary: High-performance, full-featured text search engine Name: lucene -Version: 6.1.0 -Release: 8%{?dist} +Version: 7.1.0 +Release: 1%{?dist} Epoch: 0 License: ASL 2.0 URL: http://lucene.apache.org/ # solr source contains both lucene and dev-tools -Source0: http://www.apache.org/dist/lucene/solr/%{version}/solr-%{version}-src.tgz +Source0: https://archive.apache.org/dist/lucene/solr/%{version}/solr-%{version}-src.tgz Patch0: 0001-Disable-ivy-settings.patch Patch1: 0002-Dependency-generation.patch -# CVE-2017-12629 - https://bugzilla.redhat.com/show_bug.cgi?id=1501529 -# Backport of lucene part of https://github.com/apache/lucene-solr/commit/926cc4d65b6d2cc40ff07f76d50ddeda947e3cc4 -Patch2: 0001-SOLR-11477-Disallow-resolving-of-external-entities-i.patch BuildRequires: ant BuildRequires: ivy-local BuildRequires: maven-local - BuildRequires: mvn(org.apache:apache:pom:) -BuildRequires: mvn(jakarta-regexp:jakarta-regexp) BuildRequires: mvn(org.apache.felix:maven-bundle-plugin) %if %{without jp_minimal} BuildRequires: mvn(com.carrotsearch.randomizedtesting:randomizedtesting-runner) BuildRequires: mvn(com.ibm.icu:icu4j) BuildRequires: mvn(commons-codec:commons-codec) BuildRequires: mvn(commons-logging:commons-logging) -BuildRequires: mvn(com.spatial4j:spatial4j) BuildRequires: mvn(javax.servlet:javax.servlet-api) BuildRequires: mvn(javax.servlet:servlet-api) BuildRequires: mvn(junit:junit) @@ -49,6 +43,7 @@ BuildRequires: mvn(org.eclipse.jetty:jetty-io) BuildRequires: mvn(org.eclipse.jetty:jetty-server) BuildRequires: mvn(org.eclipse.jetty:jetty-servlet) BuildRequires: mvn(org.eclipse.jetty:jetty-util) +BuildRequires: mvn(org.locationtech.spatial4j:spatial4j) BuildRequires: mvn(org.ow2.asm:asm) BuildRequires: mvn(org.ow2.asm:asm-commons) BuildRequires: mvn(xerces:xercesImpl) @@ -269,21 +264,16 @@ Summary: Javadoc for Lucene %patch0 -p1 %patch1 -p1 -%patch2 -p1 rm -rf solr find -name "*.jar" -delete -mv lucene/*.txt . - -sed -i -e "s|/Export-Package>|/Export-Package><_nouses>true|g" dev-tools/maven/pom.xml.template +# don't generate uses clauses in osgi metadata +sed -i -e "//a<_nouses>true" dev-tools/maven/pom.xml.template # make the target public sed -i 's/-filter-pom-templates/filter-pom-templates/' lucene/common-build.xml -# avoid descent to other modules to avoid unnecessary compilation of modules we -# will recompile with maven anyway -%pom_xpath_remove 'target[@name="compile-tools"]/modules-crawl' lucene/build.xml # suggest provides spellchecker %mvn_alias :%{name}-suggest :%{name}-spellchecker @@ -299,7 +289,7 @@ sed -i 's/-filter-pom-templates/filter-pom-templates/' lucene/common-build.xml pushd %{name} find -maxdepth 2 -type d -exec mkdir -p '{}/lib' \; # generate dependencies -ant -f common-build.xml filter-pom-templates -Divy.mode=local -Dversion=%{version} +ant -f common-build.xml filter-pom-templates -Divy.mode=local -Dversion=%{version} -Divy.available=true # fix source dir + move to expected place for pom in `find build/poms/%{name} -name pom.xml`; do @@ -311,11 +301,8 @@ done # unresolvable test dep %pom_remove_dep org.locationtech.spatial4j:spatial4j::test spatial-extras -# fix dep on spatial4j -%pom_change_dep org.locationtech.spatial4j:spatial4j com.spatial4j:spatial4j spatial-extras -%pom_change_dep org.locationtech.spatial4j:spatial4j com.spatial4j:spatial4j benchmark -find benchmark spatial-extras -name *.java -exec sed -i \ - -e 's/org\.locationtech\.spatial4j/com.spatial4j.core/' {} \; +# currently unavailable in Fedora +%pom_remove_dep ua.net.nlp:morfologik-ukrainian-search analysis/morfologik # test deps %pom_add_dep org.antlr:antlr-runtime::test demo @@ -384,8 +371,9 @@ popd %global _docdir_fmt %{name} %files -f .mfiles-%{name}-core -%doc CHANGES.txt README.txt MIGRATE.txt -%license LICENSE.txt NOTICE.txt +%doc lucene/CHANGES.txt lucene/README.txt +%doc lucene/MIGRATE.txt lucene/JRE_VERSION_MIGRATION.txt +%license lucene/LICENSE.txt lucene/NOTICE.txt %files analysis -f .mfiles-%{name}-analysis %files analyzers-smartcn -f .mfiles-%{name}-analyzers-smartcn @@ -422,9 +410,12 @@ popd %endif %files javadoc -f .mfiles-javadoc -%license LICENSE.txt NOTICE.txt +%license lucene/LICENSE.txt lucene/NOTICE.txt %changelog +* Thu Apr 12 2018 Mat Booth - 0:7.1.0-1 +- Update to a newer upstream release + * Thu Feb 08 2018 Fedora Release Engineering - 0:6.1.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild diff --git a/sources b/sources index c21527f..3017763 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (solr-6.1.0-src.tgz) = 63989f6a0004026ec071ac5b0a569f7f1f401c76719e32467768df135e94da0bde819673fbe35ee5929cd650fcb288b31db2b3b76152e7f3e82cb1a471e96199 +SHA512 (solr-7.1.0-src.tgz) = 2022af8a16b218bd832b7921dd937fcb14ccbb0984f1b183c179b76b07a5d59f9d8ac4df4b8cf5d7371652d7a72267528c9cc361fa1178b24898a99b5fef95cd