Version in base suite: 3.1.47-2 Base version: smarty3_3.1.47-2 Target version: smarty3_3.1.47-2+deb12u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/smarty3/smarty3_3.1.47-2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/smarty3/smarty3_3.1.47-2+deb12u1.dsc changelog | 10 + patches/0001-CVE-2024-35226.patch | 155 +++++++++++++++++++ patches/0002-CVE-2023-28447.patch | 56 ++++++ patches/series | 2 tests/CVE-2018-25047 | 12 + tests/CVE-2018-25047-tests/output.html-good | 2 tests/CVE-2018-25047-tests/page1.tpl | 2 tests/CVE-2018-25047-tests/test.php | 11 + tests/CVE-2023-28447 | 12 + tests/CVE-2023-28447-tests/test.php | 25 +++ tests/CVE-2023-28447-tests/test2.php | 25 +++ tests/CVE-2023-28447-tests/test3.php | 27 +++ tests/CVE-2024-35226 | 12 + tests/CVE-2024-35226-tests/001_parent.tpl | 1 tests/CVE-2024-35226-tests/escaping.tpl | 1 tests/CVE-2024-35226-tests/escaping2.tpl | 1 tests/CVE-2024-35226-tests/escaping3.tpl | 1 tests/CVE-2024-35226-tests/helloworld.tpl | 1 tests/CVE-2024-35226-tests/test1.php | 22 ++ tests/CVE-2024-35226-tests/test2.php | 23 ++ tests/CVE-2024-35226-tests/test3.php | 23 ++ tests/CVE-2024-35226-tests/test4.php | 24 ++ tests/CVE-2024-35226-tests/test5.php | 22 ++ tests/CVE-2024-35226-tests/test_include_001.tpl | 1 tests/CVE-2024-35226-tests/test_include_001_2.tpl | 1 tests/CVE-2024-35226-tests/test_include_001_3.tpl | 1 tests/CVE-2024-35226-tests/test_include_security.tpl | 1 tests/control | 4 28 files changed, 478 insertions(+) diff -Nru smarty3-3.1.47/debian/changelog smarty3-3.1.47/debian/changelog --- smarty3-3.1.47/debian/changelog 2022-10-25 05:42:53.000000000 +0000 +++ smarty3-3.1.47/debian/changelog 2024-12-06 13:39:32.000000000 +0000 @@ -1,3 +1,13 @@ +smarty3 (3.1.47-2+deb12u1) bookworm-security; urgency=high + + * Non-maintainer upload by the Security Team. + * CVE-2023-28447 - JavaScript injection (Closes: #1033964) + * CVE-2024-35226 - PHP Code injection by untrusted template authors + (Closes: #1072530) + * Add simple autopkgtests for the three CVEs. + + -- Tobias Frost Fri, 06 Dec 2024 14:39:32 +0100 + smarty3 (3.1.47-2) unstable; urgency=medium * debian/control: diff -Nru smarty3-3.1.47/debian/patches/0001-CVE-2024-35226.patch smarty3-3.1.47/debian/patches/0001-CVE-2024-35226.patch --- smarty3-3.1.47/debian/patches/0001-CVE-2024-35226.patch 1970-01-01 00:00:00.000000000 +0000 +++ smarty3-3.1.47/debian/patches/0001-CVE-2024-35226.patch 2024-11-17 14:51:45.000000000 +0000 @@ -0,0 +1,155 @@ +Description: CVE-2024-35226 - code injection vulnerability in extends-tag +Origin: https://github.com/smarty-php/smarty/commit/76881c8d33d80648f70c9b0339f770f5f69a87a2 +Bug: https://github.com/smarty-php/smarty/security/advisories/GHSA-4rmg-292m-wg3w +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072530 + +From 76881c8d33d80648f70c9b0339f770f5f69a87a2 Mon Sep 17 00:00:00 2001 +From: Simon Wisselink +Date: Tue, 28 May 2024 22:44:30 +0200 +Subject: [PATCH] Merge pull request from GHSA-4rmg-292m-wg3w + +* Fixed a code injection vulnerability in extends-tag + +* update tests for smarty v4 +--- + changelog/GHSA-4rmg-292m-wg3w.md | 1 + + .../smarty_internal_compile_extends.php | 66 +------------------ + .../smarty_internal_templatecompilerbase.php | 24 +++++-- + .../BockExtend/CompileBlockExtendsTest.php | 36 +++++++++- + .../BockExtend/templates/escaping.tpl | 1 + + .../BockExtend/templates/escaping2.tpl | 1 + + .../BockExtend/templates/escaping3.tpl | 1 + + .../TagTests/Include/CompileIncludeTest.php | 12 ++++ + .../templates/test_include_security.tpl | 1 + + .../_Issues/419/ExtendsIssue419Test.php | 7 ++ + 10 files changed, 78 insertions(+), 72 deletions(-) + create mode 100644 changelog/GHSA-4rmg-292m-wg3w.md + create mode 100644 tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping.tpl + create mode 100644 tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping2.tpl + create mode 100644 tests/UnitTests/TemplateSource/TagTests/BockExtend/templates/escaping3.tpl + create mode 100644 tests/UnitTests/TemplateSource/TagTests/Include/templates/test_include_security.tpl + +--- a/libs/sysplugins/smarty_internal_compile_extends.php ++++ b/libs/sysplugins/smarty_internal_compile_extends.php +@@ -30,7 +30,7 @@ + * + * @var array + */ +- public $optional_attributes = array('extends_resource'); ++ public $optional_attributes = array(); + + /** + * Attribute definition: Overwrites base class. +@@ -62,29 +62,7 @@ + } + // add code to initialize inheritance + $this->registerInit($compiler, true); +- $file = trim($_attr[ 'file' ], '\'"'); +- if (strlen($file) > 8 && substr($file, 0, 8) === 'extends:') { +- // generate code for each template +- $files = array_reverse(explode('|', substr($file, 8))); +- $i = 0; +- foreach ($files as $file) { +- if ($file[ 0 ] === '"') { +- $file = trim($file, '".'); +- } else { +- $file = "'{$file}'"; +- } +- $i++; +- if ($i === count($files) && isset($_attr[ 'extends_resource' ])) { +- $this->compileEndChild($compiler); +- } +- $this->compileInclude($compiler, $file); +- } +- if (!isset($_attr[ 'extends_resource' ])) { +- $this->compileEndChild($compiler); +- } +- } else { +- $this->compileEndChild($compiler, $_attr[ 'file' ]); +- } ++ $this->compileEndChild($compiler, $_attr[ 'file' ]); + $compiler->has_code = false; + return ''; + } +@@ -115,44 +93,4 @@ + '') . ");\n?>" + ); + } +- +- /** +- * Add code for including subtemplate to end of template +- * +- * @param \Smarty_Internal_TemplateCompilerBase $compiler +- * @param string $template subtemplate name +- * +- * @throws \SmartyCompilerException +- * @throws \SmartyException +- */ +- private function compileInclude(Smarty_Internal_TemplateCompilerBase $compiler, $template) +- { +- $compiler->parser->template_postfix[] = new Smarty_Internal_ParseTree_Tag( +- $compiler->parser, +- $compiler->compileTag( +- 'include', +- array( +- $template, +- array('scope' => 'parent') +- ) +- ) +- ); +- } +- +- /** +- * Create source code for {extends} from source components array +- * +- * @param \Smarty_Internal_Template $template +- * +- * @return string +- */ +- public static function extendsSourceArrayCode(Smarty_Internal_Template $template) +- { +- $resources = array(); +- foreach ($template->source->components as $source) { +- $resources[] = $source->resource; +- } +- return $template->smarty->left_delimiter . 'extends file=\'extends:' . join('|', $resources) . +- '\' extends_resource=true' . $template->smarty->right_delimiter; +- } + } +--- a/libs/sysplugins/smarty_internal_templatecompilerbase.php ++++ b/libs/sysplugins/smarty_internal_templatecompilerbase.php +@@ -470,15 +470,29 @@ + $this->smarty->_current_file = $this->template->source->filepath; + // get template source + if (!empty($this->template->source->components)) { +- // we have array of inheritance templates by extends: resource +- // generate corresponding source code sequence +- $_content = +- Smarty_Internal_Compile_Extends::extendsSourceArrayCode($this->template); ++ $_compiled_code = '_loadInheritance(); $_smarty_tpl->inheritance->init($_smarty_tpl, true); ?>'; ++ ++ $i = 0; ++ $reversed_components = array_reverse($this->template->getSource()->components); ++ foreach ($reversed_components as $source) { ++ $i++; ++ if ($i === count($reversed_components)) { ++ $_compiled_code .= 'inheritance->endChild($_smarty_tpl); ?>'; ++ } ++ $_compiled_code .= $this->compileTag( ++ 'include', ++ [ ++ var_export($source->resource, true), ++ ['scope' => 'parent'], ++ ] ++ ); ++ } ++ $_compiled_code = $this->postFilter($_compiled_code, $this->template); + } else { + // get template source + $_content = $this->template->source->getContent(); ++ $_compiled_code = $this->postFilter($this->doCompile($this->preFilter($_content), true)); + } +- $_compiled_code = $this->postFilter($this->doCompile($this->preFilter($_content), true)); + if (!empty($this->required_plugins[ 'compiled' ]) || !empty($this->required_plugins[ 'nocache' ])) { + $_compiled_code = 'compileRequiredPlugins() . "?>\n" . $_compiled_code; + } diff -Nru smarty3-3.1.47/debian/patches/0002-CVE-2023-28447.patch smarty3-3.1.47/debian/patches/0002-CVE-2023-28447.patch --- smarty3-3.1.47/debian/patches/0002-CVE-2023-28447.patch 1970-01-01 00:00:00.000000000 +0000 +++ smarty3-3.1.47/debian/patches/0002-CVE-2023-28447.patch 2024-11-17 15:00:11.000000000 +0000 @@ -0,0 +1,56 @@ +Description: CVE-2023-28447 - potential arbitrary code execution in victim's browser +Origin: https://github.com/smarty-php/smarty/commit/7677db7bc9a1dcfcad1435fc9d3bac3f295ca3ad +Bug: https://github.com/smarty-php/smarty/security/advisories/GHSA-7j98-h7fp-4vwj +Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1033964 +From 7677db7bc9a1dcfcad1435fc9d3bac3f295ca3ad Mon Sep 17 00:00:00 2001 +From: Simon Wisselink +Date: Fri, 24 Mar 2023 12:19:34 +0100 +Subject: [PATCH] Implement fix and tests + +--- + libs/plugins/modifier.escape.php | 4 +++- + libs/plugins/modifiercompiler.escape.php | 4 +++- + .../PluginModifierEscapeTest.php | 21 +++++++++++++++++++ + .../Operators/templates_c/.gitignore | 2 ++ + 4 files changed, 29 insertions(+), 2 deletions(-) + create mode 100644 tests/UnitTests/TemplateSource/ValueTests/Operators/templates_c/.gitignore + +--- a/libs/plugins/modifier.escape.php ++++ b/libs/plugins/modifier.escape.php +@@ -176,7 +176,8 @@ + return $return; + case 'javascript': + // escape quotes and backslashes, newlines, etc. +- return strtr( ++ $_ret = ++ strtr( + $string, + array( + '\\' => '\\\\', +@@ -188,9 +189,12 @@ + // see https://html.spec.whatwg.org/multipage/scripting.html#restrictions-for-contents-of-script-elements + '