Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package yast2-packager for openSUSE:Factory checked in at 2021-12-16 21:18:45 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/yast2-packager (Old) and /work/SRC/openSUSE:Factory/.yast2-packager.new.2520 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "yast2-packager" Thu Dec 16 21:18:45 2021 rev:417 rq:940418 version:4.4.18 Changes: -------- --- /work/SRC/openSUSE:Factory/yast2-packager/yast2-packager.changes 2021-12-03 20:35:40.736161639 +0100 +++ /work/SRC/openSUSE:Factory/.yast2-packager.new.2520/yast2-packager.changes 2021-12-16 21:18:56.686512848 +0100 @@ -1,0 +2,8 @@ +Fri Dec 10 19:37:52 UTC 2021 - Josef Reidinger <jreidin...@suse.com> + +- Adapt iso handling to do properly double escaping ( fix for wrong + fix for bsc#954813) +- Prepare code for ruby3 (bsc#1193192) +- 4.4.18 + +------------------------------------------------------------------- Old: ---- yast2-packager-4.4.17.tar.bz2 New: ---- yast2-packager-4.4.18.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ yast2-packager.spec ++++++ --- /var/tmp/diff_new_pack.db3zKv/_old 2021-12-16 21:18:58.106513388 +0100 +++ /var/tmp/diff_new_pack.db3zKv/_new 2021-12-16 21:18:58.110513389 +0100 @@ -17,7 +17,7 @@ Name: yast2-packager -Version: 4.4.17 +Version: 4.4.18 Release: 0 Summary: YaST2 - Package Library License: GPL-2.0-or-later ++++++ yast2-packager-4.4.17.tar.bz2 -> yast2-packager-4.4.18.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/package/yast2-packager.changes new/yast2-packager-4.4.18/package/yast2-packager.changes --- old/yast2-packager-4.4.17/package/yast2-packager.changes 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/package/yast2-packager.changes 2021-12-14 10:43:27.000000000 +0100 @@ -1,4 +1,12 @@ ------------------------------------------------------------------- +Fri Dec 10 19:37:52 UTC 2021 - Josef Reidinger <jreidin...@suse.com> + +- Adapt iso handling to do properly double escaping ( fix for wrong + fix for bsc#954813) +- Prepare code for ruby3 (bsc#1193192) +- 4.4.18 + +------------------------------------------------------------------- Thu Dec 2 14:39:19 UTC 2021 - Ladislav Slez??k <lsle...@suse.cz> - Unify the Yes/No popup button IDs (bsc#1193326) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/package/yast2-packager.spec new/yast2-packager-4.4.18/package/yast2-packager.spec --- old/yast2-packager-4.4.17/package/yast2-packager.spec 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/package/yast2-packager.spec 2021-12-14 10:43:27.000000000 +0100 @@ -17,7 +17,7 @@ Name: yast2-packager -Version: 4.4.17 +Version: 4.4.18 Release: 0 Summary: YaST2 - Package Library License: GPL-2.0-or-later diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/src/lib/y2packager/clients/inst_productsources.rb new/yast2-packager-4.4.18/src/lib/y2packager/clients/inst_productsources.rb --- old/yast2-packager-4.4.17/src/lib/y2packager/clients/inst_productsources.rb 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/src/lib/y2packager/clients/inst_productsources.rb 2021-12-14 10:43:27.000000000 +0100 @@ -2,7 +2,7 @@ require "yast2/hw_detection" require "shellwords" -require "uri" +require "cgi" Yast.import "UI" Yast.import "Pkg" @@ -37,7 +37,6 @@ Yast.import "Language" Yast.import "String" Yast.import "URL" -# documentation cop is broken for this document, so lets disable it module Yast # This is a stand-alone YaST client that allows you to add suggested @@ -354,7 +353,8 @@ return url_string if url_string.nil? || url_string == "" # unescape it - url_string = URI.unescape(url_string) + url_string = CGI.unescape(url_string) + log.info "unescaped url_string #{Yast::URL.HidePassword(url_string)}" # removing all slashes at the end of the url url_string.sub(/(\/)+$/, "") diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/src/lib/y2packager/self_update_addon_repo.rb new/yast2-packager-4.4.18/src/lib/y2packager/self_update_addon_repo.rb --- old/yast2-packager-4.4.17/src/lib/y2packager/self_update_addon_repo.rb 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/src/lib/y2packager/self_update_addon_repo.rb 2021-12-14 10:43:27.000000000 +0100 @@ -18,7 +18,6 @@ # find current contact information at www.suse.com. require "fileutils" -require "uri" require "yast" require "y2packager/self_update_addon_filter" @@ -26,6 +25,7 @@ Yast.import "Directory" Yast.import "Pkg" +Yast.import "URLRecode" module Y2Packager # create a local add-on repository from a self-update repository @@ -88,8 +88,9 @@ # @return [Boolean] true on success, false if failed # def self.create_repo(path = REPO_PATH) - ret = Yast::Pkg.SourceCreateType("dir://#{URI.escape(path)}?alias=SelfUpdate0", - "", "Plaindir") + ret = Yast::Pkg.SourceCreateType( + "dir://#{Yast::URLRecode.EscapePath(path)}?alias=SelfUpdate0", "", "Plaindir" + ) log.info("Created self update addon repo: #{ret}") ret end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/src/modules/SourceDialogs.rb new/yast2-packager-4.4.18/src/modules/SourceDialogs.rb --- old/yast2-packager-4.4.17/src/modules/SourceDialogs.rb 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/src/modules/SourceDialogs.rb 2021-12-14 10:43:27.000000000 +0100 @@ -1,6 +1,7 @@ require "yast" require "uri" +require "cgi" require "shellwords" Yast.import "NetworkService" @@ -333,8 +334,8 @@ # for a local ISO image (see https://bugzilla.suse.com/show_bug.cgi?id=919138 # and https://en.opensuse.org/openSUSE:Libzypp_URIs#ISO_Images ) new_url.scheme = "dir" if uri.scheme.casecmp("iso").zero? - # url can be already escaped, so unescape double escaping (bsc#954813) - params["url"] = URI.unescape(new_url.to_s) + params["url"] = new_url.to_s + log.info "unescaped url param #{params["url"].inspect}" processed = URI("") # libzypp do not use web encoding as in https://www.w3.org/TR/html5/forms.html#url-encoded-form-data @@ -381,7 +382,8 @@ params = URI.decode_www_form(query.gsub(/%20/, "+")).to_h param_url = params.delete("url") || "" - processed = URI(URI.encode(param_url)) + processed = URI.parse(param_url) + log.info "processed URI after escaping #{URL.HidePassword(processed.to_s)}" processed.scheme = "iso" if processed.scheme.casecmp("dir").zero? # we need to construct path from more potential sources, as url can look like # `iso:/subdir?iso=test.iso&path=dir%3A%2Finstall` resulting in @@ -885,7 +887,8 @@ def IsoInit(_key) @_url = PreprocessISOURL(@_url) parsed = URI.parse(@_url) - path = URI.unescape(parsed.path) + path = CGI.unescape(parsed.path) + log.info "unescaped path #{path}" UI.ChangeWidget(Id(:dir), :Value, path) UI.SetFocus(:dir) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/test/lib/product_spec_readers/full_test.rb new/yast2-packager-4.4.18/test/lib/product_spec_readers/full_test.rb --- old/yast2-packager-4.4.17/test/lib/product_spec_readers/full_test.rb 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/test/lib/product_spec_readers/full_test.rb 2021-12-14 10:43:27.000000000 +0100 @@ -18,7 +18,7 @@ # find current contact information at www.suse.com. require_relative "../../test_helper" -require "uri" +require "cgi" require "y2packager/product_spec_readers/full" describe Y2Packager::ProductSpecReaders::Full do @@ -29,8 +29,9 @@ arr.find { |p| p.name == product } end + ESCAPED_DATA_PATH = DATA_PATH.to_s.split("/").map { |d| CGI.escape(d) }.join("/").freeze # URL of the local testing repository - REPO_URL = "dir://#{URI.escape(File.join(DATA_PATH, "zypp/test_offline_repo"))}".freeze + REPO_URL = "dir://#{File.join(ESCAPED_DATA_PATH, "zypp/test_offline_repo")}".freeze before do # the testing repository only contains the x86_64 packages/products diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/test/self_update_addon_repo_test.rb new/yast2-packager-4.4.18/test/self_update_addon_repo_test.rb --- old/yast2-packager-4.4.17/test/self_update_addon_repo_test.rb 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/test/self_update_addon_repo_test.rb 2021-12-14 10:43:27.000000000 +0100 @@ -34,6 +34,14 @@ .with("dir://#{path}?alias=SelfUpdate0", "", "Plaindir") Y2Packager::SelfUpdateAddonRepo.create_repo(path) end + + it "do proper escaping" do + path = "/home/j'O Donald/repo" + escaped_path = "/home/j'O%20Donald/repo" + expect(Yast::Pkg).to receive(:SourceCreateType) + .with("dir://#{escaped_path}?alias=SelfUpdate0", "", "Plaindir") + Y2Packager::SelfUpdateAddonRepo.create_repo(path) + end end describe ".copy_packages" do diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/yast2-packager-4.4.17/test/source_dialogs_test.rb new/yast2-packager-4.4.18/test/source_dialogs_test.rb --- old/yast2-packager-4.4.17/test/source_dialogs_test.rb 2021-12-02 16:22:46.000000000 +0100 +++ new/yast2-packager-4.4.18/test/source_dialogs_test.rb 2021-12-14 10:43:27.000000000 +0100 @@ -81,14 +81,16 @@ it "handles iso with part in url and part in path" do converted = "iso:/insta%20ll/Duomenys%20600%20GB/openSUSE-13.2-DVD-x86_64.iso" - url = "iso:/Duomenys%20600%20GB?iso=/openSUSE-13.2-DVD-x86_64.iso&url=dir%3A%2Finsta%20ll%2F" + url = "iso:/Duomenys%20600%20GB?iso=/openSUSE-13.2-DVD-x86_64.iso" \ + "&url=dir%3A%2Finsta%2520ll%2F" expect(subject.PreprocessISOURL(url)).to eq(converted) end it "handles properly escaped spaces" do converted = "iso:/install/Duomenys%20600%20GB/openSUSE-13.2-DVD-x86_64.iso" - url = "iso:///?iso=openSUSE-13.2-DVD-x86_64.iso&url=dir%3A%2Finstall%2FDuomenys%20600%20GB" + url = "iso:///?iso=openSUSE-13.2-DVD-x86_64.iso&" \ + "url=dir%3A%2Finstall%2FDuomenys%2520600%2520GB" expect(subject.PreprocessISOURL(url)).to eq(converted) end @@ -121,7 +123,8 @@ it "prevents double escaping if get already escaped string" do converted = "iso:///install/Duomenys%20600%20GB/openSUSE-13.2-DVD-x86_64.iso" - url = "iso:///?iso=openSUSE-13.2-DVD-x86_64.iso&url=dir%3A%2Finstall%2FDuomenys%20600%20GB" + url = "iso:///?iso=openSUSE-13.2-DVD-x86_64.iso" \ + "&url=dir%3A%2Finstall%2FDuomenys%2520600%2520GB" expect(subject.PostprocessISOURL(converted)).to eq(url) end @@ -129,7 +132,8 @@ describe ".IsISOURL" do it "returns true for iso with spaces" do - url = "iso:///?iso=openSUSE-13.2-DVD-x86_64.iso&url=dir%3A%2Finstall%2FDuomenys%20600%20GB" + url = "iso:///?iso=openSUSE-13.2-DVD-x86_64.iso&" \ + "url=dir%3A%2Finstall%2FDuomenys%2520600%2520GB" expect(subject.IsISOURL(url)).to eq true end