Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-HTTP-Date for openSUSE:Factory checked in at 2026-07-23 23:08:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-HTTP-Date (Old) and /work/SRC/openSUSE:Factory/.perl-HTTP-Date.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-HTTP-Date" Thu Jul 23 23:08:21 2026 rev:15 rq:1366823 version:6.80.0 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-HTTP-Date/perl-HTTP-Date.changes 2026-06-30 15:11:41.996520514 +0200 +++ /work/SRC/openSUSE:Factory/.perl-HTTP-Date.new.2004/perl-HTTP-Date.changes 2026-07-23 23:08:30.712431563 +0200 @@ -1,0 +2,13 @@ +Thu Jul 9 08:48:50 UTC 2026 - Tina Müller <[email protected]> + +- updated to 6.80.0 (6.08) + see /usr/share/doc/packages/perl-HTTP-Date/Changes + + 6.08 2026-07-09 02:04:21Z + + - [SECURITY] Reject input longer than 64 characters in parse_date() + to prevent quadratic regex backtracking (a denial of service) on + hostile date strings. Fixes CVE-2026-14741. (Olaf Alders) + bsc#1271705 + +------------------------------------------------------------------- Old: ---- HTTP-Date-6.07.tar.gz New: ---- HTTP-Date-6.08.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-HTTP-Date.spec ++++++ --- /var/tmp/diff_new_pack.0U8txW/_old 2026-07-23 23:08:31.612462980 +0200 +++ /var/tmp/diff_new_pack.0U8txW/_new 2026-07-23 23:08:31.620463259 +0200 @@ -18,10 +18,10 @@ %define cpan_name HTTP-Date Name: perl-HTTP-Date -Version: 6.70.0 +Version: 6.80.0 Release: 0 -# 6.07 -> normalize -> 6.70.0 -%define cpan_version 6.07 +# 6.08 -> normalize -> 6.80.0 +%define cpan_version 6.08 License: Artistic-1.0 OR GPL-1.0-or-later Summary: HTTP::Date - date conversion routines URL: https://metacpan.org/release/%{cpan_name} @@ -31,6 +31,7 @@ BuildArch: noarch BuildRequires: perl BuildRequires: perl-macros +BuildRequires: perl(Test::More) >= 0.96 BuildRequires: perl(Time::Local) >= 1.28 BuildRequires: perl(Time::Zone) Requires: perl(Time::Local) >= 1.28 @@ -87,6 +88,12 @@ If the date is unrecognized, then the empty list is returned ('undef' in scalar context). +As a safeguard against pathological input, strings longer than 64 +characters are rejected without being parsed. The length is measured on the +string as given, before any leading or trailing whitespace is trimmed, so +heavily padded input may be rejected even if its trimmed payload would fit. +Every date format this module recognizes is far shorter than this limit. + The function is able to parse the following formats: "Wed, 09 Feb 1994 22:23:32 GMT" -- HTTP format ++++++ HTTP-Date-6.07.tar.gz -> HTTP-Date-6.08.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/Changes new/HTTP-Date-6.08/Changes --- old/HTTP-Date-6.07/Changes 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/Changes 2026-07-09 04:04:24.000000000 +0200 @@ -1,5 +1,11 @@ Change history for HTTP-Date +6.08 2026-07-09 02:04:21Z + + - [SECURITY] Reject input longer than 64 characters in parse_date() + to prevent quadratic regex backtracking (a denial of service) on + hostile date strings. Fixes CVE-2026-14741. (Olaf Alders) + 6.07 2026-06-25 15:12:09Z - Add test with Time::Zone (GH#25) (Michal Josef Špaček) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/MANIFEST new/HTTP-Date-6.08/MANIFEST --- old/HTTP-Date-6.07/MANIFEST 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/MANIFEST 2026-07-09 04:04:24.000000000 +0200 @@ -18,6 +18,7 @@ t/00-report-prereqs.t t/date.t t/numeric-date-order.t +t/redos.t t/unicode-digits.t tidyall.ini xt/author/eol.t diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/META.json new/HTTP-Date-6.08/META.json --- old/HTTP-Date-6.07/META.json 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/META.json 2026-07-09 04:04:24.000000000 +0200 @@ -75,7 +75,8 @@ "File::Spec" : "0", "IO::Handle" : "0", "IPC::Open3" : "0", - "Test::More" : "0", + "Test::More" : "0.96", + "Time::HiRes" : "0", "warnings" : "0" } } @@ -94,7 +95,7 @@ "x_IRC" : "irc://irc.perl.org/#lwp", "x_MailingList" : "mailto:[email protected]"; }, - "version" : "6.07", + "version" : "6.08", "x_Dist_Zilla" : { "perl" : { "version" : "5.042002" @@ -639,7 +640,7 @@ "branch" : null, "changelog" : "Changes", "signed" : 0, - "tag" : "v6.07", + "tag" : "v6.08", "tag_format" : "v%V", "tag_message" : "v%V" }, @@ -739,6 +740,17 @@ "version" : "6.037" }, { + "class" : "Dist::Zilla::Plugin::Prereqs", + "config" : { + "Dist::Zilla::Plugin::Prereqs" : { + "phase" : "test", + "type" : "requires" + } + }, + "name" : "TestRequires", + "version" : "6.037" + }, + { "class" : "Dist::Zilla::Plugin::Test::ChangesHasContent", "name" : "Test::ChangesHasContent", "version" : "0.011" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/META.yml new/HTTP-Date-6.08/META.yml --- old/HTTP-Date-6.07/META.yml 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/META.yml 2026-07-09 04:04:24.000000000 +0200 @@ -7,7 +7,8 @@ File::Spec: '0' IO::Handle: '0' IPC::Open3: '0' - Test::More: '0' + Test::More: '0.96' + Time::HiRes: '0' warnings: '0' configure_requires: ExtUtils::MakeMaker: '0' @@ -35,7 +36,7 @@ bugtracker: https://github.com/libwww-perl/HTTP-Date/issues homepage: https://github.com/libwww-perl/HTTP-Date repository: https://github.com/libwww-perl/HTTP-Date.git -version: '6.07' +version: '6.08' x_Dist_Zilla: perl: version: '5.042002' @@ -456,7 +457,7 @@ branch: ~ changelog: Changes signed: 0 - tag: v6.07 + tag: v6.08 tag_format: v%V tag_message: v%V Dist::Zilla::Role::Git::Repo: @@ -529,6 +530,14 @@ name: Prereqs version: '6.037' - + class: Dist::Zilla::Plugin::Prereqs + config: + Dist::Zilla::Plugin::Prereqs: + phase: test + type: requires + name: TestRequires + version: '6.037' + - class: Dist::Zilla::Plugin::Test::ChangesHasContent name: Test::ChangesHasContent version: '0.011' diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/Makefile.PL new/HTTP-Date-6.08/Makefile.PL --- old/HTTP-Date-6.07/Makefile.PL 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/Makefile.PL 2026-07-09 04:04:24.000000000 +0200 @@ -27,10 +27,11 @@ "File::Spec" => 0, "IO::Handle" => 0, "IPC::Open3" => 0, - "Test::More" => 0, + "Test::More" => "0.96", + "Time::HiRes" => 0, "warnings" => 0 }, - "VERSION" => "6.07", + "VERSION" => "6.08", "test" => { "TESTS" => "t/*.t" } @@ -43,7 +44,8 @@ "File::Spec" => 0, "IO::Handle" => 0, "IPC::Open3" => 0, - "Test::More" => 0, + "Test::More" => "0.96", + "Time::HiRes" => 0, "Time::Local" => "1.28", "Time::Zone" => 0, "strict" => 0, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/README.md new/HTTP-Date-6.08/README.md --- old/HTTP-Date-6.07/README.md 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/README.md 2026-07-09 04:04:24.000000000 +0200 @@ -4,7 +4,7 @@ # VERSION -version 6.07 +version 6.08 # SYNOPSIS @@ -63,6 +63,12 @@ If the date is unrecognized, then the empty list is returned (`undef` in scalar context). + As a safeguard against pathological input, strings longer than 64 + characters are rejected without being parsed. The length is measured on the + string as given, before any leading or trailing whitespace is trimmed, so + heavily padded input may be rejected even if its trimmed payload would fit. + Every date format this module recognizes is far shorter than this limit. + The function is able to parse the following formats: "Wed, 09 Feb 1994 22:23:32 GMT" -- HTTP format diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/cpanfile new/HTTP-Date-6.08/cpanfile --- old/HTTP-Date-6.07/cpanfile 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/cpanfile 2026-07-09 04:04:24.000000000 +0200 @@ -12,7 +12,8 @@ requires "File::Spec" => "0"; requires "IO::Handle" => "0"; requires "IPC::Open3" => "0"; - requires "Test::More" => "0"; + requires "Test::More" => "0.96"; + requires "Time::HiRes" => "0"; requires "warnings" => "0"; }; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/dist.ini new/HTTP-Date-6.08/dist.ini --- old/HTTP-Date-6.07/dist.ini 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/dist.ini 2026-07-09 04:04:24.000000000 +0200 @@ -21,6 +21,11 @@ perl = 5.006002 Time::Local = 1.28 +; t/redos.t uses subtest(), which needs a Test::More newer than the one +; bundled with older perls (e.g. 5.10/5.12 ship < 0.96). +[Prereqs / TestRequires] +Test::More = 0.96 + ; We run release tests in travis. but make the changes-has-content test TODO only for master. ; This will prod pull request submitters to add a Changes entry. [Test::ChangesHasContent] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/lib/HTTP/Date.pm new/HTTP-Date-6.08/lib/HTTP/Date.pm --- old/HTTP-Date-6.07/lib/HTTP/Date.pm 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/lib/HTTP/Date.pm 2026-07-09 04:04:24.000000000 +0200 @@ -2,7 +2,7 @@ use strict; -our $VERSION = '6.07'; +our $VERSION = '6.08'; require Exporter; our @ISA = qw(Exporter); @@ -88,6 +88,14 @@ local ($_) = shift; return unless defined; + # Reject over-long input up front, before any regex runs, so hostile + # strings cannot drive the parsing regexes into pathological backtracking. + # Length is measured as given (leading/trailing whitespace included). This + # cap is a security limit, not a tunable: every format we accept is far + # shorter, and the parsing regexes still contain adjacent unbounded + # quantifiers, so raising it demands re-benchmarking against hostile input. + return if length($_) > 64; + # More lax parsing below s/^\s+//; # kill leading space s/^(?:Sun|Mon|Tue|Wed|Thu|Fri|Sat)[a-z]*,?\s*//i; # Useless weekday @@ -289,7 +297,7 @@ =head1 VERSION -version 6.07 +version 6.08 =head1 SYNOPSIS @@ -350,6 +358,12 @@ If the date is unrecognized, then the empty list is returned (C<undef> in scalar context). +As a safeguard against pathological input, strings longer than 64 +characters are rejected without being parsed. The length is measured on the +string as given, before any leading or trailing whitespace is trimmed, so +heavily padded input may be rejected even if its trimmed payload would fit. +Every date format this module recognizes is far shorter than this limit. + The function is able to parse the following formats: "Wed, 09 Feb 1994 22:23:32 GMT" -- HTTP format diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/t/00-report-prereqs.dd new/HTTP-Date-6.08/t/00-report-prereqs.dd --- old/HTTP-Date-6.07/t/00-report-prereqs.dd 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/t/00-report-prereqs.dd 2026-07-09 04:04:24.000000000 +0200 @@ -53,7 +53,8 @@ 'File::Spec' => '0', 'IO::Handle' => '0', 'IPC::Open3' => '0', - 'Test::More' => '0', + 'Test::More' => '0.96', + 'Time::HiRes' => '0', 'warnings' => '0' } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/t/redos.t new/HTTP-Date-6.08/t/redos.t --- old/HTTP-Date-6.07/t/redos.t 1970-01-01 01:00:00.000000000 +0100 +++ new/HTTP-Date-6.08/t/redos.t 2026-07-09 04:04:24.000000000 +0200 @@ -0,0 +1,82 @@ +#!perl + +use strict; +use warnings; + +use Test::More; +use Time::HiRes qw(time); +use HTTP::Date qw(str2time parse_date); + +# Regression test: parse_date must not exhibit catastrophic (quadratic) +# backtracking on hostile input. A valid-looking date prefix followed by a +# long interior run of digits, letters, or whitespace and a trailing junk +# character used to force the parsing regex to explore O(N^2) states, so a +# ~40 KB string burned tens of seconds of CPU -- a denial of service. +# parse_date now rejects input longer than the cap below, up front, so such +# strings are handled instantly. + +# The length cap parse_date enforces. It is hardcoded in HTTP::Date (a +# security limit, not a knob), so mirror the value here; keep the two in sync. +my $LIMIT = 64; + +subtest 'length guard rejects over-long input' => sub { + my $good = 'Wed, 09 Feb 1994 22:23:32 GMT'; + ok( defined parse_date($good), 'a normal date parses' ); + + # Padding a date that parses fine on its own pushes it past the limit and + # it is rejected -- a deterministic proof the guard fires, no timing needed. + my $padded = $good . ( q{ } x $LIMIT ); + cmp_ok( + length $padded, '>', $LIMIT, + 'padded string exceeds the length limit' + ); + is( parse_date($padded), undef, 'parse_date rejects over-length input' ); + is( str2time($padded), undef, 'str2time rejects over-length input too' ); +}; + +subtest 'length guard boundary is exactly the cap' => sub { + + # The check is "> $LIMIT", so a string of exactly the limit is still + # considered and one character longer is rejected. Guards against a future + # off-by-one turning the cap into >= (which would reject a legal boundary). + my $limit = $LIMIT; + + my $at_limit = 'Wed, 09 Feb 1994 22:23:32 GMT'; + $at_limit .= q{ } x ( $limit - length $at_limit ); # pad up to the limit + is( length $at_limit, $limit, "test string is exactly $limit bytes" ); + ok( defined parse_date($at_limit), 'input at the limit is still parsed' ); + + my $over_limit = $at_limit . q{ }; # one byte too long + is( length $over_limit, $limit + 1, "test string is $limit + 1 bytes" ); + is( parse_date($over_limit), undef, 'input past the limit is rejected' ); +}; + +subtest 'hostile input is rejected promptly' => sub { + + # Unguarded these scale as O(N^2) and take many seconds; guarded they + # return immediately. The 1-second threshold is deliberately generous so + # the test is not flaky on a loaded machine. Each case targets a distinct + # ambiguous seam in the parsing regex. + my %evil = ( + 'letter run' => '01 Jan 2000 ' . ( 'a' x 10000 ) . '!', + 'digit run' => '01 Jan ' . ( '1' x 10000 ) . '!', + 'space run' => '01 Jan 2000' . ( ' ' x 10000 ) . '!', + ); + + for my $branch ( sort keys %evil ) { + my $str = $evil{$branch}; + + my $t0 = time; + my $got = parse_date($str); + my $elapsed = time - $t0; + + is( $got, undef, "hostile input ($branch) is rejected" ); + cmp_ok( + $elapsed, '<', 1, + sprintf '%s: %d-byte input handled promptly (%.3fs)', + $branch, length $str, $elapsed + ); + } +}; + +done_testing; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/xt/author/eol.t new/HTTP-Date-6.08/xt/author/eol.t --- old/HTTP-Date-6.07/xt/author/eol.t 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/xt/author/eol.t 2026-07-09 04:04:24.000000000 +0200 @@ -13,6 +13,7 @@ 't/00-report-prereqs.t', 't/date.t', 't/numeric-date-order.t', + 't/redos.t', 't/unicode-digits.t' ); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HTTP-Date-6.07/xt/release/changes_has_content.t new/HTTP-Date-6.08/xt/release/changes_has_content.t --- old/HTTP-Date-6.07/xt/release/changes_has_content.t 2026-06-25 17:12:11.000000000 +0200 +++ new/HTTP-Date-6.08/xt/release/changes_has_content.t 2026-07-09 04:04:24.000000000 +0200 @@ -8,7 +8,7 @@ note 'Checking Changes'; my $changes_file = 'Changes'; -my $newver = '6.07'; +my $newver = '6.08'; my $trial_token = '-TRIAL'; my $encoding = 'UTF-8'; ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.0U8txW/_old 2026-07-23 23:08:32.016477084 +0200 +++ /var/tmp/diff_new_pack.0U8txW/_new 2026-07-23 23:08:32.024477362 +0200 @@ -1,6 +1,6 @@ -mtime: 1782463161 -commit: d32addd87af51ae6d9ba50e21140c9c005e34eee058ffab043a9e37cfb928728 +mtime: 1784569350 +commit: d6b8c7dd170100be843628cfc400ae97b67c57ffd18b951fdc031404ae00bc69 url: https://src.opensuse.org/perl/perl-HTTP-Date -revision: d32addd87af51ae6d9ba50e21140c9c005e34eee058ffab043a9e37cfb928728 +revision: d6b8c7dd170100be843628cfc400ae97b67c57ffd18b951fdc031404ae00bc69 projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-20 19:42:30.000000000 +0200 @@ -0,0 +1 @@ +.osc
