Date: Thu, 20 Nov 2014 21:31:18 +0000 (UTC) From: Raphael Kubo da Costa <rakuco@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r372965 - in head/www/kwebkitpart: . files Message-ID: <201411202131.sAKLVIrg098688@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: rakuco Date: Thu Nov 20 21:31:17 2014 New Revision: 372965 URL: https://svnweb.freebsd.org/changeset/ports/372965 QAT: https://qat.redports.org/buildarchive/r372965/ Log: Add upstream patch for CVE-2014-8600 (insufficient input validation). MFH: 2014Q4 Security: 890b6b22-70fa-11e4-91ae-5453ed2e2b49 Added: head/www/kwebkitpart/files/ head/www/kwebkitpart/files/patch-src__webpage.cpp (contents, props changed) Modified: head/www/kwebkitpart/Makefile Modified: head/www/kwebkitpart/Makefile ============================================================================== --- head/www/kwebkitpart/Makefile Thu Nov 20 21:30:29 2014 (r372964) +++ head/www/kwebkitpart/Makefile Thu Nov 20 21:31:17 2014 (r372965) @@ -2,7 +2,7 @@ PORTNAME= kwebkitpart PORTVERSION= 1.3.2 -PORTREVISION= 3 +PORTREVISION= 4 CATEGORIES= www kde MASTER_SITES= LOCAL/makc Added: head/www/kwebkitpart/files/patch-src__webpage.cpp ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/kwebkitpart/files/patch-src__webpage.cpp Thu Nov 20 21:31:17 2014 (r372965) @@ -0,0 +1,41 @@ +commit 641aa7c75631084260ae89aecbdb625e918c6689 +Author: Albert Astals Cid <aacid@kde.org> +Date: Thu Nov 13 15:06:01 2014 +0100 + + Sanitize html + + As discussed by the security team + +--- src/webpage.cpp ++++ src/webpage.cpp +@@ -226,23 +226,26 @@ QString WebPage::errorPage(int code, const QString& text, const KUrl& reqUrl) co + doc += QL1S( "<h3>" ); + doc += i18n( "Details of the Request:" ); + doc += QL1S( "</h3><ul><li>" ); +- doc += i18n( "URL: %1", reqUrl.url() ); ++ // escape URL twice: once for i18n, and once for HTML. ++ doc += i18n( "URL: %1", Qt::escape( Qt::escape( reqUrl.prettyUrl() ) ) ); + doc += QL1S( "</li><li>" ); + + const QString protocol (reqUrl.protocol()); + if ( !protocol.isNull() ) { +- doc += i18n( "Protocol: %1", protocol ); ++ // escape protocol twice: once for i18n, and once for HTML. ++ doc += i18n( "Protocol: %1", Qt::escape( Qt::escape( protocol ) ) ); + doc += QL1S( "</li><li>" ); + } + + doc += i18n( "Date and Time: %1", + KGlobal::locale()->formatDateTime(QDateTime::currentDateTime(), KLocale::LongDate) ); + doc += QL1S( "</li><li>" ); +- doc += i18n( "Additional Information: %1" , text ); ++ // escape text twice: once for i18n, and once for HTML. ++ doc += i18n( "Additional Information: %1", Qt::escape( Qt::escape( text ) ) ); + doc += QL1S( "</li></ul><h3>" ); + doc += i18n( "Description:" ); + doc += QL1S( "</h3><p>" ); +- doc += description; ++ doc += Qt::escape( description ); + doc += QL1S( "</p>" ); + + if ( causes.count() ) {
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201411202131.sAKLVIrg098688>