Skip to content

Commit aa09c6a

Browse files
jtojnarjtojnar
authored
Merge yelp: CVE-2025-3155 (#399185)
2 parents c78ecbe + 6a51c95 commit aa09c6a

File tree

4 files changed

+188
-0
lines changed

4 files changed

+188
-0
lines changed

‎pkgs/by-name/ye/yelp-xsl/cve-2025-3155.patch‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
diff --git a/xslt/common/html.xsl b/xslt/common/html.xsl
2+
index 77aed075..82832fb4 100644
3+
--- a/xslt/common/html.xsl
4+
+++ b/xslt/common/html.xsl
5+
@@ -266,6 +266,16 @@ certain tokens, and you can add your own with {html.sidebar.mode}. See
6+
-->
7+
<xsl:param name="html.sidebar.right" select="''"/>
8+
9+
+<!--@@==========================================================================
10+
+html.csp.nonce
11+
+An optional CSP nonce string to allow the execution of scripts and styles.
12+
+@revision[version=42.2 date=2025-02-22 status=final]
13+
+
14+
+This parameter takes a string value that will be added to the 'nonce' attribute
15+
+of all 'style' and 'script' tags in the generated HTML output. This paramter is used
16+
+to whitelist script and style tags that are allowed to be executed.
17+
+-->
18+
+<xsl:param name="html.csp.nonce" select="false()"/>
19+
20+
<!--**==========================================================================
21+
html.output
22+
@@ -1124,6 +1134,11 @@ dimensions. All parameters can be automatically computed if not provided.
23+
</xsl:call-template>
24+
</xsl:param>
25+
<style type="text/css">
26+
+ <xsl:if test="$html.csp.nonce">
27+
+ <xsl:attribute name="nonce">
28+
+ <xsl:value-of select="$html.csp.nonce" />
29+
+ </xsl:attribute>
30+
+ </xsl:if>
31+
<xsl:call-template name="html.css.content">
32+
<xsl:with-param name="node" select="$node"/>
33+
<xsl:with-param name="direction" select="$direction"/>
34+
@@ -1533,6 +1548,11 @@ copy, override this template and provide the necessary files.
35+
<xsl:param name="node" select="."/>
36+
<xsl:if test="$node//mml:*[1]">
37+
<script type="text/javascript">
38+
+ <xsl:if test="$html.csp.nonce">
39+
+ <xsl:attribute name="nonce">
40+
+ <xsl:value-of select="$html.csp.nonce" />
41+
+ </xsl:attribute>
42+
+ </xsl:if>
43+
<xsl:attribute name="src">
44+
<xsl:text>http://cdn.mathjax.org/mathjax/latest/MathJax.js?config=MML_HTMLorMML</xsl:text>
45+
</xsl:attribute>
46+
@@ -1558,6 +1578,11 @@ result of {html.js.content} to that file.
47+
<xsl:template name="html.js.script">
48+
<xsl:param name="node" select="."/>
49+
<script type="text/javascript">
50+
+ <xsl:if test="$html.csp.nonce">
51+
+ <xsl:attribute name="nonce">
52+
+ <xsl:value-of select="$html.csp.nonce" />
53+
+ </xsl:attribute>
54+
+ </xsl:if>
55+
<xsl:call-template name="html.js.content">
56+
<xsl:with-param name="node" select="$node"/>
57+
</xsl:call-template>
58+
@@ -2035,8 +2060,19 @@ on all `code` elements with `"syntax"` in the class value.
59+
<xsl:template name="html.js.syntax">
60+
<xsl:param name="node" select="."/>
61+
<xsl:if test="$html.syntax.highlight">
62+
- <script type="text/javascript" src="{$html.js.root}highlight.pack.js"></script>
63+
- <script><![CDATA[
64+
+ <script type="text/javascript" src="{$html.js.root}highlight.pack.js">
65+
+ <xsl:if test="$html.csp.nonce">
66+
+ <xsl:attribute name="nonce">
67+
+ <xsl:value-of select="$html.csp.nonce" />
68+
+ </xsl:attribute>
69+
+ </xsl:if>
70+
+ </script>
71+
+ <script>
72+
+ <xsl:if test="$html.csp.nonce">
73+
+ <xsl:attribute name="nonce">
74+
+ <xsl:value-of select="$html.csp.nonce" />
75+
+ </xsl:attribute>
76+
+ </xsl:if><![CDATA[
77+
document.addEventListener('DOMContentLoaded', function() {
78+
var matches = document.querySelectorAll('code.syntax')
79+
for (var i = 0; i < matches.length; i++) {

‎pkgs/by-name/ye/yelp-xsl/package.nix‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ stdenv.mkDerivation rec {
2929

3030
doCheck = true;
3131

32+
patches = [
33+
./cve-2025-3155.patch
34+
];
35+
3236
passthru = {
3337
updateScript = gnome.updateScript {
3438
packageName = "yelp-xsl";

‎pkgs/by-name/ye/yelp/cve-2025-3155.patch‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
diff --git a/data/xslt/mal2html.xsl.in b/data/xslt/mal2html.xsl.in
2+
index 9e44b734..0a74da55 100644
3+
--- a/data/xslt/mal2html.xsl.in
4+
+++ b/data/xslt/mal2html.xsl.in
5+
@@ -19,6 +19,11 @@
6+
<xsl:param name="mal.link.prefix" select="'xref:'"/>
7+
<xsl:param name="mal.link.extension" select="''"/>
8+
9+
+<xsl:template name="html.head.top.custom">
10+
+ <xsl:param name="node" select="."/>
11+
+ <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'nonce-{$html.csp.nonce}'; "/>
12+
+</xsl:template>
13+
+
14+
<xsl:template name="mal.link.target.custom">
15+
<xsl:param name="node" select="."/>
16+
<xsl:param name="action" select="$node/@action"/>
17+
diff --git a/data/xslt/man2html.xsl.in b/data/xslt/man2html.xsl.in
18+
index 676ce3eb..56bc1f5c 100644
19+
--- a/data/xslt/man2html.xsl.in
20+
+++ b/data/xslt/man2html.xsl.in
21+
@@ -131,7 +131,7 @@
22+
the correct styling and a single character which we measure the
23+
width of and update each sheet as required.
24+
-->
25+
-<script type="text/javascript" language="javascript">
26+
+<script type="text/javascript" language="javascript" nonce="{$html.csp.nonce}">
27+
<xsl:text>
28+
$(document).ready (function () {
29+
var div = document.getElementById("invisible-char");
30+
diff --git a/data/xslt/yelp-common.xsl.in b/data/xslt/yelp-common.xsl.in
31+
index 0c1ec9bb..421fc02d 100644
32+
--- a/data/xslt/yelp-common.xsl.in
33+
+++ b/data/xslt/yelp-common.xsl.in
34+
@@ -15,6 +15,13 @@
35+
<xsl:param name="html.syntax.highlight" select="true()"/>
36+
<xsl:param name="html.js.root" select="'file://@XSL_JSDIR@/'"/>
37+
38+
+<xsl:param name="html.csp.nonce" select="yelp:generate_nonce()"/>
39+
+
40+
+<xsl:template name="html.head.top.custom">
41+
+ <xsl:param name="node" select="."/>
42+
+ <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'unsafe-inline'; "/>
43+
+</xsl:template>
44+
+
45+
<xsl:template name="html.js.mathjax">
46+
<xsl:param name="node" select="."/>
47+
<xsl:if test="$node//mml:*[1]">
48+
diff --git a/libyelp/yelp-transform.c b/libyelp/yelp-transform.c
49+
index e74eb463..2ce1d05b 100644
50+
--- a/libyelp/yelp-transform.c
51+
+++ b/libyelp/yelp-transform.c
52+
@@ -71,6 +71,8 @@ static void xslt_yelp_cache (xsltTransformContextPtr ctxt,
53+
xsltStylePreCompPtr comp);
54+
static void xslt_yelp_aux (xmlXPathParserContextPtr ctxt,
55+
int nargs);
56+
+static void xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt,
57+
+ int nargs);
58+
59+
enum {
60+
PROP_0,
61+
@@ -412,6 +414,10 @@ transform_run (YelpTransform *transform)
62+
BAD_CAST "input",
63+
BAD_CAST YELP_NAMESPACE,
64+
(xmlXPathFunction) xslt_yelp_aux);
65+
+ xsltRegisterExtFunction (priv->context,
66+
+ BAD_CAST "generate_nonce",
67+
+ BAD_CAST YELP_NAMESPACE,
68+
+ (xmlXPathFunction) xslt_yelp_generate_nonce);
69+
70+
priv->output = xsltApplyStylesheetUser (priv->stylesheet,
71+
priv->input,
72+
@@ -607,3 +613,16 @@ xslt_yelp_aux (xmlXPathParserContextPtr ctxt, int nargs)
73+
xsltExtensionInstructionResultRegister (tctxt, ret);
74+
valuePush (ctxt, ret);
75+
}
76+
+
77+
+static void
78+
+xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt, int nargs)
79+
+{
80+
+ GRand* rand;
81+
+ gchar* nonce_str;
82+
+
83+
+ rand = g_rand_new ();
84+
+ nonce_str = g_strdup_printf("%08x%08x", g_rand_int (rand), g_rand_int (rand));
85+
+ xmlXPathReturnString (ctxt, xmlStrdup ((xmlChar *) nonce_str));
86+
+ g_free(nonce_str);
87+
+ g_rand_free(rand);
88+
+}
89+
diff --git a/libyelp/yelp-view.c b/libyelp/yelp-view.c
90+
index 32ae131e..d544c5df 100644
91+
--- a/libyelp/yelp-view.c
92+
+++ b/libyelp/yelp-view.c
93+
@@ -971,7 +971,7 @@ view_external_uri (YelpView *view,
94+
95+
if (app_info)
96+
{
97+
- if (!strstr (g_app_info_get_executable (app_info), "yelp"))
98+
+ if (!strstr (g_app_info_get_executable (app_info), "yelp") && !strstr (struri, "%3C") && !strstr (struri, "%3E"))
99+
{
100+
GList l;
101+

‎pkgs/by-name/ye/yelp/package.nix‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,10 @@ stdenv.mkDerivation rec {
4949
gst_all_1.gst-plugins-good
5050
];
5151

52+
patches = [
53+
./cve-2025-3155.patch
54+
];
55+
5256
passthru = {
5357
updateScript = gnome.updateScript {
5458
packageName = "yelp";

0 commit comments

Comments
 (0)