Notification time stamped 2021-06-30 22:49:43 UTC
From b7f673a27908240d4bbcdc4770fbc70b786c739e Mon Sep 17 00:00:00 2001
From: Nick Black <dankamongmen(a)gmail.com>
Date: Jun 30 2021 22:49:23 +0000
Subject: Merge branch 'main' into f33
---
diff --git a/notcurses.spec b/notcurses.spec
index 39f872a..4ce26e5 100644
--- a/notcurses.spec
+++ b/notcurses.spec
@@ -1,5 +1,5 @@
Name: notcurses
-Version: 2.3.6
+Version: 2.3.7
Release: 1%{?dist}
Summary: Character graphics and TUI library
License: ASL 2.0
@@ -144,6 +144,9 @@ cd cffi
%{python3_sitearch}/*.so
%changelog
+* Tue Jun 29 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.7-1
+- New upstream release
+
* Wed Jun 23 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.6-1
- New upstream release
https://src.fedoraproject.org/rpms/notcurses/c/b7f673a27908240d4bbcdc4770fb…
Notification time stamped 2021-06-30 22:49:43 UTC
From 3843e8ecab67af7f16631332bdb8f0390186296f Mon Sep 17 00:00:00 2001
From: Nick Black <dankamongmen(a)gmail.com>
Date: Jun 29 2021 11:49:18 +0000
Subject: new upstream 2.3.7
---
diff --git a/notcurses.spec b/notcurses.spec
index db7ceef..6097471 100644
--- a/notcurses.spec
+++ b/notcurses.spec
@@ -1,5 +1,5 @@
Name: notcurses
-Version: 2.3.6
+Version: 2.3.7
Release: 1%{?dist}
Summary: Character graphics and TUI library
License: ASL 2.0
@@ -144,6 +144,9 @@ cd cffi
%{python3_sitearch}/*.so
%changelog
+* Tue Jun 29 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.7-1
+- New upstream release
+
* Wed Jun 23 2021 Nick Black <dankamongmen(a)gmail.com> - 2.3.6-1
- New upstream release
https://src.fedoraproject.org/rpms/notcurses/c/3843e8ecab67af7f16631332bdb8…
Notification time stamped 2021-06-30 22:17:25 UTC
From 9ffff020320f2ea937c12873fb7e6735d6210aa1 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam(a)redhat.com>
Date: Jun 30 2021 22:04:12 +0000
Subject: Backport session security fixes from 9.19
---
diff --git a/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
new file mode 100644
index 0000000..bed436d
--- /dev/null
+++ b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
@@ -0,0 +1,114 @@
+From 1f91263f3c6d5438a43d814171b88409d94bb61a Mon Sep 17 00:00:00 2001
+From: Sebastian Riedel <sri(a)cpan.org>
+Date: Tue, 1 Jun 2021 18:32:36 +0200
+Subject: [PATCH 1/2] Switch from HMAC-SHA1 to HMAC-SHA256
+
+---
+ lib/Mojolicious/Controller.pm | 13 +++++++------
+ lib/Mojolicious/Guides/Growing.pod | 8 ++++----
+ lib/Mojolicious/Sessions.pm | 2 +-
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/lib/Mojolicious/Controller.pm b/lib/Mojolicious/Controller.pm
+index 9abc56e17..f52adda82 100644
+--- a/lib/Mojolicious/Controller.pm
++++ b/lib/Mojolicious/Controller.pm
+@@ -2,7 +2,8 @@ package Mojolicious::Controller;
+ use Mojo::Base -base;
+
+ # No imports, for security reasons!
+-use Carp ();
++use Carp ();
++use Digest::SHA ();
+ use Mojo::ByteStream;
+ use Mojo::DynamicMethods -dispatch;
+ use Mojo::URL;
+@@ -83,7 +84,7 @@ sub every_signed_cookie {
+
+ my $valid;
+ for my $secret (@$secrets) {
+- my $check = Mojo::Util::hmac_sha1_sum("$name=$value", $secret);
++ my $check = Digest::SHA::hmac_sha256_hex("$name=$value", $secret);
+ ++$valid and last if Mojo::Util::secure_compare($signature, $check);
+ }
+ if ($valid) { push @results, $value }
+@@ -233,7 +234,7 @@ sub signed_cookie {
+ return $self->every_signed_cookie($name)->[-1] unless defined $value;
+
+ # Response cookie
+- my $sum = Mojo::Util::hmac_sha1_sum("$name=$value", $self->app->secrets->[0]);
++ my $sum = Digest::SHA::hmac_sha256_hex("$name=$value", $self->app->secrets->[0]);
+ return $self->cookie($name, "$value--$sum", $options);
+ }
+
+@@ -681,8 +682,8 @@ L<Mojolicious::Plugin::DefaultHelpers/"inactivity_timeout">, which usually defau
+ $c = $c->session(foo => 'bar');
+
+ Persistent data storage for the next few requests, all session data gets serialized with L<Mojo::JSON> and stored
+-Base64 encoded in HMAC-SHA1 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte (4KiB)
+-limit, depending on browser.
++Base64 encoded in HMAC-SHA256 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte
++(4KiB) limit, depending on browser.
+
+ # Manipulate session
+ $c->session->{foo} = 'bar';
+@@ -706,7 +707,7 @@ limit, depending on browser.
+
+ Access signed request cookie values and create new signed response cookies. If there are multiple values sharing the
+ same name, and you want to access more than just the last one, you can use L</"every_signed_cookie">. Cookies are
+-cryptographically signed with HMAC-SHA1, to prevent tampering, and the ones failing signature verification will be
++cryptographically signed with HMAC-SHA256, to prevent tampering, and the ones failing signature verification will be
+ automatically discarded.
+
+ =head2 stash
+diff --git a/lib/Mojolicious/Guides/Growing.pod b/lib/Mojolicious/Guides/Growing.pod
+index c3fef407e..c8e152dba 100644
+--- a/lib/Mojolicious/Guides/Growing.pod
++++ b/lib/Mojolicious/Guides/Growing.pod
+@@ -100,10 +100,10 @@ information across several HTTP requests.
+ Traditionally all session data was stored on the server-side and only session ids were exchanged between browser and
+ web server in the form of cookies.
+
+- Set-Cookie: session=hmac-sha1(base64(json($session)))
++ Set-Cookie: session=hmac-sha256(base64(json($session)))
+
+ In L<Mojolicious> however we are taking this concept one step further by storing everything JSON serialized and Base64
+-encoded in HMAC-SHA1 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
++encoded in HMAC-SHA256 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
+ requirements.
+
+ =head2 Test-Driven Development
+@@ -378,7 +378,7 @@ L<Mojolicious/"secrets">.
+
+ $app->secrets(['Mojolicious rocks']);
+
+-This passphrase is used by the HMAC-SHA1 algorithm to make signed cookies tamper resistant and can be changed at any
++This passphrase is used by the HMAC-SHA256 algorithm to make signed cookies tamper resistant and can be changed at any
+ time to invalidate all existing sessions.
+
+ $c->session(user => 'sebastian');
+@@ -401,7 +401,7 @@ L<Mojolicious::Plugin::DefaultHelpers/"flash">.
+ $c->flash(message => 'Everything is fine.');
+ $c->redirect_to('goodbye');
+
+-Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA1 signed cookies, which
++Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA256 signed cookies, which
+ usually have a C<4096> byte (4KiB) limit, depending on browser.
+
+ =head2 Final prototype
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 2f7f21c2b..6056105fa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -80,7 +80,7 @@ Mojolicious::Sessions - Session manager based on signed cookies
+ =head1 DESCRIPTION
+
+ L<Mojolicious::Sessions> manages sessions based on signed cookies for L<Mojolicious>. All data gets serialized with
+-L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA1
++L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA256
+ signature.
+
+ =head1 ATTRIBUTES
+--
+2.32.0
+
diff --git a/0002-pad-session-values-to-1025-bytes-by-default.patch b/0002-pad-session-values-to-1025-bytes-by-default.patch
new file mode 100644
index 0000000..dbc4cf9
--- /dev/null
+++ b/0002-pad-session-values-to-1025-bytes-by-default.patch
@@ -0,0 +1,92 @@
+From 4e660c4659cb1cde53db2b6591c32fdf09334c2a Mon Sep 17 00:00:00 2001
+From: Joel Berger <joel.a.berger(a)gmail.com>
+Date: Tue, 1 Jun 2021 13:39:54 -0500
+Subject: [PATCH 2/2] pad session values to 1025 bytes by default
+
+---
+ lib/Mojolicious/Sessions.pm | 12 ++++++++++--
+ t/mojolicious/lite_app.t | 30 ++++++++++++++++++++++++++++++
+ 2 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 6056105fa..989ad5faa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -8,9 +8,9 @@ has [qw(cookie_domain secure)];
+ has cookie_name => 'mojolicious';
+ has cookie_path => '/';
+ has default_expiration => 3600;
+-has deserialize => sub { \&Mojo::JSON::j };
++has deserialize => sub { \&_deserialize };
+ has samesite => 'Lax';
+-has serialize => sub { \&Mojo::JSON::encode_json };
++has serialize => sub { \&_serialize };
+
+ sub load {
+ my ($self, $c) = @_;
+@@ -61,6 +61,14 @@ sub store {
+ $c->signed_cookie($self->cookie_name, $value, $options);
+ }
+
++sub _deserialize { Mojo::JSON::decode_json($_[0] =~ s/\}\KZ*$//r) }
++
++sub _serialize {
++ no warnings 'numeric';
++ my $out = Mojo::JSON::encode_json($_[0]);
++ return $out . 'Z' x (1025 - length $out);
++}
++
+ 1;
+
+ =encoding utf8
+diff --git a/t/mojolicious/lite_app.t b/t/mojolicious/lite_app.t
+index 9a997b4c8..b06fdd1fb 100644
+--- a/t/mojolicious/lite_app.t
++++ b/t/mojolicious/lite_app.t
+@@ -276,6 +276,12 @@ get '/session_cookie/2' => sub {
+ $c->render(text => "Session is $value!");
+ };
+
++get '/session_length' => sub {
++ my $c = shift;
++ $c->session->{q} = $c->param('q');
++ $c->rendered(204);
++};
++
+ get '/foo' => sub {
+ my $c = shift;
+ $c->render(text => 'Yea baby!');
+@@ -801,6 +807,30 @@ ok !$t->tx, 'session reset';
+ $t->get_ok('/session_cookie/2')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')
+ ->content_is('Session is missing!');
+
++
++subtest 'Session length' => sub {
++ my $extract = sub {
++ my $value = $_[0]->tx->res->cookie('mojolicious')->value;
++ $value =~ s/--([^\-]+)$//;
++ $value =~ y/-/=/;
++ return Mojo::Util::b64_decode($value);
++ };
++
++ subtest 'Short session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=a')->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value =~ /Z+$/, 'session is padded';
++ };
++
++ subtest 'Long session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=' . 'a' x 1025)->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value !~ /Z+$/, 'session is not padded';
++ };
++};
++
+ # Text
+ $t->get_ok('/foo')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')->content_is('Yea baby!');
+
+--
+2.32.0
+
diff --git a/perl-Mojolicious.spec b/perl-Mojolicious.spec
index 943aa38..19a236b 100644
--- a/perl-Mojolicious.spec
+++ b/perl-Mojolicious.spec
@@ -1,12 +1,18 @@
Name: perl-Mojolicious
Version: 8.73
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: A next generation web framework for Perl
License: Artistic 2.0
URL: https://metacpan.org/release/Mojolicious
Source0: http://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-%{version}.tar.gz
+# Security fixes backported from 9.19:
+# https://github.com/mojolicious/mojo/commit/3f10b6af0271c4b5b589d2d9c31ea43c…
+Patch0: 0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
+# https://github.com/mojolicious/mojo/commit/c99dee43f62ac5d552208ebf494f1147…
+Patch1: 0002-pad-session-values-to-1025-bytes-by-default.patch
+
BuildArch: noarch
BuildRequires: coreutils
BuildRequires: make
@@ -114,7 +120,7 @@ techniques used are outdated now, the idea behind it is not. Mojolicious is
a new attempt at implementing this idea using state of the art technology.
%prep
-%setup -q -n Mojolicious-%{version}
+%autosetup -p1 -n Mojolicious-%{version}
mv README.md lib/Mojolicious/
%build
@@ -143,6 +149,9 @@ mv README.md lib/Mojolicious/
%{perl_vendorlib}/Test
%changelog
+* Wed Jun 30 2021 Adam Williamson <awilliam(a)redhat.com> - 8.73-2
+- Backport session security fixes from 9.19
+
* Sun Feb 07 2021 Emmanuel Seyman <emmanuel(a)seyman.fr> - 8.73-1
- Update to 8.73
https://src.fedoraproject.org/rpms/perl-Mojolicious/c/9ffff020320f2ea937c12…
Notification time stamped 2021-06-30 22:09:05 UTC
From 9ffff020320f2ea937c12873fb7e6735d6210aa1 Mon Sep 17 00:00:00 2001
From: Adam Williamson <awilliam(a)redhat.com>
Date: Jun 30 2021 22:04:12 +0000
Subject: Backport session security fixes from 9.19
---
diff --git a/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
new file mode 100644
index 0000000..bed436d
--- /dev/null
+++ b/0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
@@ -0,0 +1,114 @@
+From 1f91263f3c6d5438a43d814171b88409d94bb61a Mon Sep 17 00:00:00 2001
+From: Sebastian Riedel <sri(a)cpan.org>
+Date: Tue, 1 Jun 2021 18:32:36 +0200
+Subject: [PATCH 1/2] Switch from HMAC-SHA1 to HMAC-SHA256
+
+---
+ lib/Mojolicious/Controller.pm | 13 +++++++------
+ lib/Mojolicious/Guides/Growing.pod | 8 ++++----
+ lib/Mojolicious/Sessions.pm | 2 +-
+ 3 files changed, 12 insertions(+), 11 deletions(-)
+
+diff --git a/lib/Mojolicious/Controller.pm b/lib/Mojolicious/Controller.pm
+index 9abc56e17..f52adda82 100644
+--- a/lib/Mojolicious/Controller.pm
++++ b/lib/Mojolicious/Controller.pm
+@@ -2,7 +2,8 @@ package Mojolicious::Controller;
+ use Mojo::Base -base;
+
+ # No imports, for security reasons!
+-use Carp ();
++use Carp ();
++use Digest::SHA ();
+ use Mojo::ByteStream;
+ use Mojo::DynamicMethods -dispatch;
+ use Mojo::URL;
+@@ -83,7 +84,7 @@ sub every_signed_cookie {
+
+ my $valid;
+ for my $secret (@$secrets) {
+- my $check = Mojo::Util::hmac_sha1_sum("$name=$value", $secret);
++ my $check = Digest::SHA::hmac_sha256_hex("$name=$value", $secret);
+ ++$valid and last if Mojo::Util::secure_compare($signature, $check);
+ }
+ if ($valid) { push @results, $value }
+@@ -233,7 +234,7 @@ sub signed_cookie {
+ return $self->every_signed_cookie($name)->[-1] unless defined $value;
+
+ # Response cookie
+- my $sum = Mojo::Util::hmac_sha1_sum("$name=$value", $self->app->secrets->[0]);
++ my $sum = Digest::SHA::hmac_sha256_hex("$name=$value", $self->app->secrets->[0]);
+ return $self->cookie($name, "$value--$sum", $options);
+ }
+
+@@ -681,8 +682,8 @@ L<Mojolicious::Plugin::DefaultHelpers/"inactivity_timeout">, which usually defau
+ $c = $c->session(foo => 'bar');
+
+ Persistent data storage for the next few requests, all session data gets serialized with L<Mojo::JSON> and stored
+-Base64 encoded in HMAC-SHA1 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte (4KiB)
+-limit, depending on browser.
++Base64 encoded in HMAC-SHA256 signed cookies, to prevent tampering. Note that cookies usually have a C<4096> byte
++(4KiB) limit, depending on browser.
+
+ # Manipulate session
+ $c->session->{foo} = 'bar';
+@@ -706,7 +707,7 @@ limit, depending on browser.
+
+ Access signed request cookie values and create new signed response cookies. If there are multiple values sharing the
+ same name, and you want to access more than just the last one, you can use L</"every_signed_cookie">. Cookies are
+-cryptographically signed with HMAC-SHA1, to prevent tampering, and the ones failing signature verification will be
++cryptographically signed with HMAC-SHA256, to prevent tampering, and the ones failing signature verification will be
+ automatically discarded.
+
+ =head2 stash
+diff --git a/lib/Mojolicious/Guides/Growing.pod b/lib/Mojolicious/Guides/Growing.pod
+index c3fef407e..c8e152dba 100644
+--- a/lib/Mojolicious/Guides/Growing.pod
++++ b/lib/Mojolicious/Guides/Growing.pod
+@@ -100,10 +100,10 @@ information across several HTTP requests.
+ Traditionally all session data was stored on the server-side and only session ids were exchanged between browser and
+ web server in the form of cookies.
+
+- Set-Cookie: session=hmac-sha1(base64(json($session)))
++ Set-Cookie: session=hmac-sha256(base64(json($session)))
+
+ In L<Mojolicious> however we are taking this concept one step further by storing everything JSON serialized and Base64
+-encoded in HMAC-SHA1 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
++encoded in HMAC-SHA256 signed cookies, which is more compatible with the REST philosophy and reduces infrastructure
+ requirements.
+
+ =head2 Test-Driven Development
+@@ -378,7 +378,7 @@ L<Mojolicious/"secrets">.
+
+ $app->secrets(['Mojolicious rocks']);
+
+-This passphrase is used by the HMAC-SHA1 algorithm to make signed cookies tamper resistant and can be changed at any
++This passphrase is used by the HMAC-SHA256 algorithm to make signed cookies tamper resistant and can be changed at any
+ time to invalidate all existing sessions.
+
+ $c->session(user => 'sebastian');
+@@ -401,7 +401,7 @@ L<Mojolicious::Plugin::DefaultHelpers/"flash">.
+ $c->flash(message => 'Everything is fine.');
+ $c->redirect_to('goodbye');
+
+-Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA1 signed cookies, which
++Just remember that all session data gets serialized with L<Mojo::JSON> and stored in HMAC-SHA256 signed cookies, which
+ usually have a C<4096> byte (4KiB) limit, depending on browser.
+
+ =head2 Final prototype
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 2f7f21c2b..6056105fa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -80,7 +80,7 @@ Mojolicious::Sessions - Session manager based on signed cookies
+ =head1 DESCRIPTION
+
+ L<Mojolicious::Sessions> manages sessions based on signed cookies for L<Mojolicious>. All data gets serialized with
+-L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA1
++L<Mojo::JSON> and stored Base64 encoded on the client-side, but is protected from unwanted changes with a HMAC-SHA256
+ signature.
+
+ =head1 ATTRIBUTES
+--
+2.32.0
+
diff --git a/0002-pad-session-values-to-1025-bytes-by-default.patch b/0002-pad-session-values-to-1025-bytes-by-default.patch
new file mode 100644
index 0000000..dbc4cf9
--- /dev/null
+++ b/0002-pad-session-values-to-1025-bytes-by-default.patch
@@ -0,0 +1,92 @@
+From 4e660c4659cb1cde53db2b6591c32fdf09334c2a Mon Sep 17 00:00:00 2001
+From: Joel Berger <joel.a.berger(a)gmail.com>
+Date: Tue, 1 Jun 2021 13:39:54 -0500
+Subject: [PATCH 2/2] pad session values to 1025 bytes by default
+
+---
+ lib/Mojolicious/Sessions.pm | 12 ++++++++++--
+ t/mojolicious/lite_app.t | 30 ++++++++++++++++++++++++++++++
+ 2 files changed, 40 insertions(+), 2 deletions(-)
+
+diff --git a/lib/Mojolicious/Sessions.pm b/lib/Mojolicious/Sessions.pm
+index 6056105fa..989ad5faa 100644
+--- a/lib/Mojolicious/Sessions.pm
++++ b/lib/Mojolicious/Sessions.pm
+@@ -8,9 +8,9 @@ has [qw(cookie_domain secure)];
+ has cookie_name => 'mojolicious';
+ has cookie_path => '/';
+ has default_expiration => 3600;
+-has deserialize => sub { \&Mojo::JSON::j };
++has deserialize => sub { \&_deserialize };
+ has samesite => 'Lax';
+-has serialize => sub { \&Mojo::JSON::encode_json };
++has serialize => sub { \&_serialize };
+
+ sub load {
+ my ($self, $c) = @_;
+@@ -61,6 +61,14 @@ sub store {
+ $c->signed_cookie($self->cookie_name, $value, $options);
+ }
+
++sub _deserialize { Mojo::JSON::decode_json($_[0] =~ s/\}\KZ*$//r) }
++
++sub _serialize {
++ no warnings 'numeric';
++ my $out = Mojo::JSON::encode_json($_[0]);
++ return $out . 'Z' x (1025 - length $out);
++}
++
+ 1;
+
+ =encoding utf8
+diff --git a/t/mojolicious/lite_app.t b/t/mojolicious/lite_app.t
+index 9a997b4c8..b06fdd1fb 100644
+--- a/t/mojolicious/lite_app.t
++++ b/t/mojolicious/lite_app.t
+@@ -276,6 +276,12 @@ get '/session_cookie/2' => sub {
+ $c->render(text => "Session is $value!");
+ };
+
++get '/session_length' => sub {
++ my $c = shift;
++ $c->session->{q} = $c->param('q');
++ $c->rendered(204);
++};
++
+ get '/foo' => sub {
+ my $c = shift;
+ $c->render(text => 'Yea baby!');
+@@ -801,6 +807,30 @@ ok !$t->tx, 'session reset';
+ $t->get_ok('/session_cookie/2')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')
+ ->content_is('Session is missing!');
+
++
++subtest 'Session length' => sub {
++ my $extract = sub {
++ my $value = $_[0]->tx->res->cookie('mojolicious')->value;
++ $value =~ s/--([^\-]+)$//;
++ $value =~ y/-/=/;
++ return Mojo::Util::b64_decode($value);
++ };
++
++ subtest 'Short session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=a')->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value =~ /Z+$/, 'session is padded';
++ };
++
++ subtest 'Long session' => sub {
++ $t->reset_session;
++ my $value = $t->get_ok('/session_length?q=' . 'a' x 1025)->status_is(204)->$extract;
++ cmp_ok length($value), '>', 1024, 'session is long enough';
++ ok $value !~ /Z+$/, 'session is not padded';
++ };
++};
++
+ # Text
+ $t->get_ok('/foo')->status_is(200)->header_is(Server => 'Mojolicious (Perl)')->content_is('Yea baby!');
+
+--
+2.32.0
+
diff --git a/perl-Mojolicious.spec b/perl-Mojolicious.spec
index 943aa38..19a236b 100644
--- a/perl-Mojolicious.spec
+++ b/perl-Mojolicious.spec
@@ -1,12 +1,18 @@
Name: perl-Mojolicious
Version: 8.73
-Release: 1%{?dist}
+Release: 2%{?dist}
Summary: A next generation web framework for Perl
License: Artistic 2.0
URL: https://metacpan.org/release/Mojolicious
Source0: http://cpan.metacpan.org/authors/id/S/SR/SRI/Mojolicious-%{version}.tar.gz
+# Security fixes backported from 9.19:
+# https://github.com/mojolicious/mojo/commit/3f10b6af0271c4b5b589d2d9c31ea43c…
+Patch0: 0001-Switch-from-HMAC-SHA1-to-HMAC-SHA256.patch
+# https://github.com/mojolicious/mojo/commit/c99dee43f62ac5d552208ebf494f1147…
+Patch1: 0002-pad-session-values-to-1025-bytes-by-default.patch
+
BuildArch: noarch
BuildRequires: coreutils
BuildRequires: make
@@ -114,7 +120,7 @@ techniques used are outdated now, the idea behind it is not. Mojolicious is
a new attempt at implementing this idea using state of the art technology.
%prep
-%setup -q -n Mojolicious-%{version}
+%autosetup -p1 -n Mojolicious-%{version}
mv README.md lib/Mojolicious/
%build
@@ -143,6 +149,9 @@ mv README.md lib/Mojolicious/
%{perl_vendorlib}/Test
%changelog
+* Wed Jun 30 2021 Adam Williamson <awilliam(a)redhat.com> - 8.73-2
+- Backport session security fixes from 9.19
+
* Sun Feb 07 2021 Emmanuel Seyman <emmanuel(a)seyman.fr> - 8.73-1
- Update to 8.73
https://src.fedoraproject.org/rpms/perl-Mojolicious/c/9ffff020320f2ea937c12…