francis.wang
4c86c082a2
Combine poky (Yocto scarthgap), meta-openembedded (scarthgap), and meta-openwrt into a single repository. Components: - poky/ Yocto core framework (BitBake + OE-Core) - meta-openembedded/ Community layers (meta-oe, meta-python, meta-networking) - meta-openwrt/ OpenWrt customization layer - setup-env.sh One-click build environment setup - README.md Project documentation
58 lines
2.0 KiB
Diff
58 lines
2.0 KiB
Diff
From 9e1a427d2f047439d0320defe1593e6352595788 Mon Sep 17 00:00:00 2001
|
|
From: Alynx Zhou <alynx.zhou@gmail.com>
|
|
Date: Sat, 11 Oct 2025 15:52:47 +0800
|
|
Subject: [PATCH] cookies: Avoid expires attribute if date is invalid
|
|
|
|
According to CVE-2025-11021, we may get invalid on processing date
|
|
string with timezone offset, this commit will ignore it.
|
|
|
|
Closes #459
|
|
|
|
CVE: CVE-2025-11021
|
|
Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libsoup/-/commit/9e1a427d2f047439d0320defe1593e6352595788]
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
libsoup/cookies/soup-cookie.c | 9 +++++----
|
|
libsoup/soup-date-utils.c | 3 +++
|
|
2 files changed, 8 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/libsoup/cookies/soup-cookie.c b/libsoup/cookies/soup-cookie.c
|
|
index 7c41b1d..5af154d 100644
|
|
--- a/libsoup/cookies/soup-cookie.c
|
|
+++ b/libsoup/cookies/soup-cookie.c
|
|
@@ -726,12 +726,13 @@ serialize_cookie (SoupCookie *cookie, GString *header, gboolean set_cookie)
|
|
|
|
if (cookie->expires) {
|
|
char *timestamp;
|
|
-
|
|
- g_string_append (header, "; expires=");
|
|
timestamp = soup_date_time_to_string (cookie->expires,
|
|
SOUP_DATE_COOKIE);
|
|
- g_string_append (header, timestamp);
|
|
- g_free (timestamp);
|
|
+ if (timestamp) {
|
|
+ g_string_append (header, "; expires=");
|
|
+ g_string_append (header, timestamp);
|
|
+ g_free (timestamp);
|
|
+ }
|
|
}
|
|
if (cookie->path) {
|
|
g_string_append (header, "; path=");
|
|
diff --git a/libsoup/soup-date-utils.c b/libsoup/soup-date-utils.c
|
|
index 34ca995..ae5504d 100644
|
|
--- a/libsoup/soup-date-utils.c
|
|
+++ b/libsoup/soup-date-utils.c
|
|
@@ -95,6 +95,9 @@ soup_date_time_to_string (GDateTime *date,
|
|
char *date_format;
|
|
char *formatted_date;
|
|
|
|
+ if (!utcdate)
|
|
+ return NULL;
|
|
+
|
|
// We insert days/months ourselves to avoid locale specific formatting
|
|
if (format == SOUP_DATE_HTTP) {
|
|
/* "Sun, 06 Nov 1994 08:49:37 GMT" */
|
|
--
|
|
2.50.1
|
|
|