commit cefeec71e5b41ed06e7be9dd0da39e8a1e5c04d9
parent 5896420ae7c79503b2f00ba72001e1be8d215bbe
Author: Flor Chacón <14323496+florelis@users.noreply.github.com>
Date: Tue, 13 May 2025 10:45:27 -0700
Use more recent version for libyaml (#5455)
We have a Component Governance alert for libyaml. There is no release of
libyaml with this issue fixed, so the guidance was to apply the patch
manually, and that's what I did when moving to vcpkg, but that doesn't
play nicely with CG because it can't determine that the patch to fix the
vulnerability was applied.
Instead of manually patching, this PR uses a more recent commit of
libyaml (without an official release), which already has the changes we
want. It uses the same commit from the last time we did a subtree update
in #4583
---------
Co-authored-by: JohnMcPMS <johnmcp@microsoft.com>
Diffstat:
5 files changed, 80 insertions(+), 260 deletions(-)
diff --git a/cgmanifest.json b/cgmanifest.json
@@ -42,7 +42,7 @@
"type": "git",
"git": {
"repositoryUrl": "https://github.com/yaml/libyaml.git",
- "commitHash": "2c891fc7a770e8ba2fec34fc6b545c672beb37e6"
+ "commitHash": "840b65c40675e2d06bf40405ad3f12dec7f35923"
}
}
}
diff --git a/src/VcpkgPortOverlay/CreatePortOverlay.ps1 b/src/VcpkgPortOverlay/CreatePortOverlay.ps1
@@ -99,6 +99,21 @@ function Select-DirectoryInPatch
return $result
}
+<#
+ When updating a portfile, we look for a section that looks like this:
+
+ vcpkg_from_github(
+ OUT_SOURCE_PATH SOURCE_PATH
+ REPO <user/repo>
+ REF <commith hash>
+ SHA512 <code .tar.gz hash>
+ HEAD_REF master
+ PATCHES
+ patch-1.patch
+ patch-2.patch
+ )
+#>
+
# Adds a patch to a portfile.cmake
function Add-PatchToPortFile
{
@@ -109,22 +124,7 @@ function Add-PatchToPortFile
[string]$PatchName
)
- <#
- We're looking for a section that looks like this:
-
- vcpkg_from_github(
- OUT_SOURCE_PATH SOURCE_PATH
- REPO <user/repo>
- REF <commith hash>
- SHA512 <hash>
- HEAD_REF master
- PATCHES
- patch-1.patch
- patch-2.patch
- )
-
- We look for the line that says "PATCHES" and add the new patch before the closing parenthesis
- #>
+ # Look for the line that says "PATCHES" and add the new patch before the closing parenthesis
$portFilePath = Join-Path $OverlayRoot $Port "portfile.cmake"
$originalPortFile = Get-Content $portFilePath
@@ -179,8 +179,57 @@ function Add-PatchToPort
Add-PatchToPortFile -Port $Port -PatchName $PatchName
}
+# Sets the value of an existing function parameter.
+# For example, REF in vcpkg_from_github
+function Set-ParameterInPortFile
+{
+ param(
+ [Parameter(Mandatory)]
+ [string]$Port,
+ [Parameter(Mandatory)]
+ [string]$ParameterName,
+ [Parameter(Mandatory)]
+ [string]$CurrentValuePattern,
+ [Parameter(Mandatory)]
+ [string]$NewValue
+ )
+
+ $portFilePath = Join-Path $OverlayRoot $Port 'portfile.cmake'
+ $originalPortFile = Get-Content $portFilePath
+
+ # Explanation for the regex:
+ # '(?<=)' - lookbehind without matching
+ # '^ +' - the parameter is only preceeded by spaces (and followed by a single space)
+ # '(?=)' - lookahead without matching
+ # ' |$' - the parameter may be the end of the line, or be followed by something else after a space (e.g. a comment)
+ $regex = "(?<=^ +$ParameterName )$CurrentValuePattern(?= |$)"
+
+ $modifiedPortFile = $originalPortFile -replace $regex, $NewValue
+ $modifiedPortFile | Out-File $portFilePath
+}
+
+# Updates the source commit used for a port.
+# Takes the commit hash, and the hash of the archive with the code that vcpkg will download.
+function Update-PortSource
+{
+ param(
+ [Parameter(Mandatory)]
+ [string]$Port,
+ [Parameter(Mandatory)]
+ [string]$Commit,
+ [Parameter(Mandatory)]
+ [string]$SourceHash
+ )
+
+ $portDir = Join-Path $OverlayRoot $Port
+
+ Set-ParameterInPortFile $Port -ParameterName 'REF' -CurrentValuePattern '[0-9a-f]{40}' -NewValue $Commit
+ Set-ParameterInPortFile $Port -ParameterName 'SHA512' -CurrentValuePattern '[0-9a-f]{128}' -NewValue $SourceHash
+}
+
+
New-PortOverlay cpprestsdk
-Add-PatchToPort cpprestsdk -PatchRepo "microsoft/winget-cli" -PatchCommit "888b4ed8f4f7d25cb05a47210e083fe29348163b" -PatchName "add-server-certificate-validation.patch" -PatchRoot "src/cpprestsdk/cpprestsdk"
+Add-PatchToPort cpprestsdk -PatchRepo 'microsoft/winget-cli' -PatchCommit '888b4ed8f4f7d25cb05a47210e083fe29348163b' -PatchName 'add-server-certificate-validation.patch' -PatchRoot 'src/cpprestsdk/cpprestsdk'
New-PortOverlay libyaml
-Add-PatchToPort libyaml -PatchRepo "yaml/libyaml" -PatchCommit "51843fe48257c6b7b6e70cdec1db634f64a40818" -PatchName "fix-parser-nesting.patch"-
\ No newline at end of file
+Update-PortSource libyaml -Commit '840b65c40675e2d06bf40405ad3f12dec7f35923' -SourceHash 'de85560312d53a007a2ddf1fe403676bbd34620480b1ba446b8c16bb366524ba7a6ed08f6316dd783bf980d9e26603a9efc82f134eb0235917b3be1d3eb4b302'+
\ No newline at end of file
diff --git a/src/VcpkgPortOverlay/README.md b/src/VcpkgPortOverlay/README.md
@@ -1,7 +1,7 @@
# Overlay ports
-This directory contains an overlay for vcpkg ports, for cases where we need to apply local patches.
-In all cases, most of the recipe is taken from the [official vcpkg registry](https://github.com/Microsoft/vcpkg), and we only add a patch.
+This directory contains an overlay for vcpkg ports, for cases where we need local modifications to a port.
+In all cases, most of the recipe is taken from the [official vcpkg registry](https://github.com/Microsoft/vcpkg), and we only make small changes.
The whole directory can be re-created with `.\CreatePortOverlay.ps1`
@@ -9,12 +9,13 @@ The whole directory can be re-created with `.\CreatePortOverlay.ps1`
We add support for certificate pinning.
-Patch file: `add-server-certificate-validation.patch`
-Source for the change: https://github.com/microsoft/winget-cli/commit/888b4ed8f4f7d25cb05a47210e083fe29348163b
+Changes:
+* Add patch file: `add-server-certificate-validation.patch`
+ Patch source: https://github.com/microsoft/winget-cli/commit/888b4ed8f4f7d25cb05a47210e083fe29348163b
## libyaml
-We apply a patch for a vulnerability.
+We use an unreleased version that fixes a vulnerability.
-Patch file: `fix-parser-nesting.patch`
-Source for the change: https://github.com/yaml/libyaml/commit/51843fe48257c6b7b6e70cdec1db634f64a40818-
\ No newline at end of file
+Changes:
+* New source commit: https://github.com/yaml/libyaml/commit/840b65c40675e2d06bf40405ad3f12dec7f35923+
\ No newline at end of file
diff --git a/src/VcpkgPortOverlay/libyaml/fix-parser-nesting.patch b/src/VcpkgPortOverlay/libyaml/fix-parser-nesting.patch
@@ -1,229 +0,0 @@
-From 51843fe48257c6b7b6e70cdec1db634f64a40818 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Tina=20M=C3=BCller?= <cpan2@tinita.de>
-Date: Tue, 2 Apr 2024 00:50:40 +0200
-Subject: [PATCH] Limit depth of nesting by default
-
-Each nesting level increases the stack and the number of previous
-starting events that the parser has to check.
-
-The default maximum is 1000 and can be set via yaml_set_max_nest_level()
-
-I also added new options to run-parser and run-parser-test-suite:
-* --max-level: you can now try out this feature on the command line
-* --show-error: By default, run-parser doesn't show errors. The new option
- helps with debugging
----
- include/yaml.h | 14 ++++++++++++++
- src/parser.c | 36 +++++++++++++++++++++++++++++++++++
- tests/run-parser-test-suite.c | 9 ++++++++-
- tests/run-parser.c | 31 +++++++++++++++++++++++++++---
- 4 files changed, 86 insertions(+), 4 deletions(-)
-
-diff --git a/include/yaml.h b/include/yaml.h
-index 89050e4f..e1467b0b 100644
---- a/include/yaml.h
-+++ b/include/yaml.h
-@@ -1456,6 +1456,20 @@ yaml_parser_parse(yaml_parser_t *parser, yaml_event_t *event);
- YAML_DECLARE(int)
- yaml_parser_load(yaml_parser_t *parser, yaml_document_t *document);
-
-+/**
-+ * Set the maximum depth of nesting.
-+ *
-+ * Default: 1000
-+ *
-+ * Each nesting level increases the stack and the number of previous
-+ * starting events that the parser has to check.
-+ *
-+ * @param[in] max The maximum number of allowed nested events
-+ */
-+
-+YAML_DECLARE(void)
-+yaml_set_max_nest_level(int max);
-+
- /** @} */
-
- /**
-diff --git a/src/parser.c b/src/parser.c
-index ec2f8d3e..9c266de6 100644
---- a/src/parser.c
-+++ b/src/parser.c
-@@ -64,6 +64,8 @@
- * Public API declarations.
- */
-
-+int MAX_NESTING_LEVEL = 1000;
-+
- YAML_DECLARE(int)
- yaml_parser_parse(yaml_parser_t *parser, yaml_event_t *event);
-
-@@ -80,6 +82,10 @@ yaml_parser_set_parser_error_context(yaml_parser_t *parser,
- const char *context, yaml_mark_t context_mark,
- const char *problem, yaml_mark_t problem_mark);
-
-+static int
-+yaml_maximum_level_reached(yaml_parser_t *parser,
-+ yaml_mark_t context_mark, yaml_mark_t problem_mark);
-+
- /*
- * State functions.
- */
-@@ -162,6 +168,12 @@ static int
- yaml_parser_append_tag_directive(yaml_parser_t *parser,
- yaml_tag_directive_t value, int allow_duplicates, yaml_mark_t mark);
-
-+YAML_DECLARE(void)
-+yaml_set_max_nest_level(int max)
-+{
-+ MAX_NESTING_LEVEL = max;
-+}
-+
- /*
- * Get the next event.
- */
-@@ -217,6 +229,14 @@ yaml_parser_set_parser_error_context(yaml_parser_t *parser,
- return 0;
- }
-
-+static int
-+yaml_maximum_level_reached(yaml_parser_t *parser,
-+ yaml_mark_t context_mark, yaml_mark_t problem_mark)
-+{
-+ yaml_parser_set_parser_error_context(parser,
-+ "while parsing", context_mark, "Maximum nesting level reached, set with yaml_set_max_nest_level())", problem_mark);
-+ return 0;
-+}
-
- /*
- * State dispatcher.
-@@ -657,6 +677,10 @@ yaml_parser_parse_node(yaml_parser_t *parser, yaml_event_t *event,
- return 1;
- }
- else if (token->type == YAML_FLOW_SEQUENCE_START_TOKEN) {
-+ if (!STACK_LIMIT(parser, parser->indents, MAX_NESTING_LEVEL - parser->flow_level)) {
-+ yaml_maximum_level_reached(parser, start_mark, token->start_mark);
-+ goto error;
-+ }
- end_mark = token->end_mark;
- parser->state = YAML_PARSE_FLOW_SEQUENCE_FIRST_ENTRY_STATE;
- SEQUENCE_START_EVENT_INIT(*event, anchor, tag, implicit,
-@@ -664,6 +688,10 @@ yaml_parser_parse_node(yaml_parser_t *parser, yaml_event_t *event,
- return 1;
- }
- else if (token->type == YAML_FLOW_MAPPING_START_TOKEN) {
-+ if (!STACK_LIMIT(parser, parser->indents, MAX_NESTING_LEVEL - parser->flow_level)) {
-+ yaml_maximum_level_reached(parser, start_mark, token->start_mark);
-+ goto error;
-+ }
- end_mark = token->end_mark;
- parser->state = YAML_PARSE_FLOW_MAPPING_FIRST_KEY_STATE;
- MAPPING_START_EVENT_INIT(*event, anchor, tag, implicit,
-@@ -671,6 +699,10 @@ yaml_parser_parse_node(yaml_parser_t *parser, yaml_event_t *event,
- return 1;
- }
- else if (block && token->type == YAML_BLOCK_SEQUENCE_START_TOKEN) {
-+ if (!STACK_LIMIT(parser, parser->indents, MAX_NESTING_LEVEL - parser->flow_level)) {
-+ yaml_maximum_level_reached(parser, start_mark, token->start_mark);
-+ goto error;
-+ }
- end_mark = token->end_mark;
- parser->state = YAML_PARSE_BLOCK_SEQUENCE_FIRST_ENTRY_STATE;
- SEQUENCE_START_EVENT_INIT(*event, anchor, tag, implicit,
-@@ -678,6 +710,10 @@ yaml_parser_parse_node(yaml_parser_t *parser, yaml_event_t *event,
- return 1;
- }
- else if (block && token->type == YAML_BLOCK_MAPPING_START_TOKEN) {
-+ if (!STACK_LIMIT(parser, parser->indents, MAX_NESTING_LEVEL - parser->flow_level)) {
-+ yaml_maximum_level_reached(parser, start_mark, token->start_mark);
-+ goto error;
-+ }
- end_mark = token->end_mark;
- parser->state = YAML_PARSE_BLOCK_MAPPING_FIRST_KEY_STATE;
- MAPPING_START_EVENT_INIT(*event, anchor, tag, implicit,
-diff --git a/tests/run-parser-test-suite.c b/tests/run-parser-test-suite.c
-index 5bdd6623..5e29caff 100644
---- a/tests/run-parser-test-suite.c
-+++ b/tests/run-parser-test-suite.c
-@@ -14,9 +14,16 @@ int main(int argc, char *argv[])
- int flow = -1; /** default no flow style collections */
- int i = 0;
- int foundfile = 0;
-+ int max_level;
-+ char *output;
-
- for (i = 1; i < argc; i++) {
-- if (strncmp(argv[i], "--flow", 6) == 0) {
-+ if (strncmp(argv[i], "--max-level", 11) == 0) {
-+ i++;
-+ max_level = strtol(argv[i], &output, 10);
-+ yaml_set_max_nest_level(max_level);
-+ }
-+ else if (strncmp(argv[i], "--flow", 6) == 0) {
- if (i+1 == argc)
- return usage(1);
- i++;
-diff --git a/tests/run-parser.c b/tests/run-parser.c
-index 13031121..9e382504 100644
---- a/tests/run-parser.c
-+++ b/tests/run-parser.c
-@@ -12,13 +12,31 @@ int
- main(int argc, char *argv[])
- {
- int number;
-+ int start = 0;
-+ int i = 0;
-+ char *filename;
-+ char *output;
-+ int max_level;
-+ int show_error = 0;
-
- if (argc < 2) {
- printf("Usage: %s file1.yaml ...\n", argv[0]);
- return 0;
- }
-+ for (i = 1; i < argc; i++) {
-+ if (strncmp(argv[i], "--max-level", 11) == 0) {
-+ i++;
-+ max_level = strtol(argv[i], &output, 10);
-+ yaml_set_max_nest_level(max_level);
-+ start = i+1;
-+ }
-+ else if (strncmp(argv[i], "--show-error", 12) == 0) {
-+ show_error = 1;
-+ start = i+1;
-+ }
-+ }
-
-- for (number = 1; number < argc; number ++)
-+ for (number = start; number < argc; number ++)
- {
- FILE *file;
- yaml_parser_t parser;
-@@ -27,10 +45,11 @@ main(int argc, char *argv[])
- int count = 0;
- int error = 0;
-
-- printf("[%d] Parsing '%s': ", number, argv[number]);
-+ filename = argv[number];
-+ printf("[%d] Parsing '%s': ", number, filename);
- fflush(stdout);
-
-- file = fopen(argv[number], "rb");
-+ file = fopen(filename, "rb");
- assert(file);
-
- assert(yaml_parser_initialize(&parser));
-@@ -41,6 +60,12 @@ main(int argc, char *argv[])
- {
- if (!yaml_parser_parse(&parser, &event)) {
- error = 1;
-+ if (show_error) {
-+ fprintf(stderr, "Parse error: %s\nLine: %lu Column: %lu\n",
-+ parser.problem,
-+ (unsigned long)parser.problem_mark.line + 1,
-+ (unsigned long)parser.problem_mark.column + 1);
-+ }
- break;
- }
-
-
diff --git a/src/VcpkgPortOverlay/libyaml/portfile.cmake b/src/VcpkgPortOverlay/libyaml/portfile.cmake
@@ -5,13 +5,12 @@ endif()
vcpkg_from_github(
OUT_SOURCE_PATH SOURCE_PATH
REPO yaml/libyaml
- REF 2c891fc7a770e8ba2fec34fc6b545c672beb37e6 # 0.2.5
- SHA512 7cdde7b48c937777b851747f7e0b9a74cb7da30173e09305dad931ef83c3fcee3e125e721166690fe6a0987ba897564500530e5518e4b66b1c9b1db8900bf320
+ REF 840b65c40675e2d06bf40405ad3f12dec7f35923 # Unreleased
+ SHA512 de85560312d53a007a2ddf1fe403676bbd34620480b1ba446b8c16bb366524ba7a6ed08f6316dd783bf980d9e26603a9efc82f134eb0235917b3be1d3eb4b302
HEAD_REF master
PATCHES
${PATCHES}
export-pkgconfig.patch
- fix-parser-nesting.patch
)
vcpkg_cmake_configure(
