mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-08-08 08:30:47 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/ruby: security bump to v3.4.10

Browse Source 
See the release announcement:
https://www.ruby-lang.org/en/news/2026/06/30/ruby-3-4-10-released/

Also drop patch that is now included upstream

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[thomas: drop ignore_cves entry]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-07-06 15:55:30 +02:00
committed by Thomas Perale
parent fee844130b
commit 634b2da1f7
3 changed files with 3 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files

73
package/ruby/0001-fix-CVE-2026-41316.patch
View File

@@ -1,73 +0,0 @@
From c35379df5279777fb4e02d989064eecd9cbbf338 Mon Sep 17 00:00:00 2001
From: Takashi Kokubun <takashikkbn@gmail.com>
Date: Tue, 21 Apr 2026 16:27:44 +0900
Subject: [PATCH] [ruby/erb] Prohibit def_method on marshal-loaded ERB instances
Extends the @_init guard to def_method so that an ERB object created
via Marshal.load (which bypasses initialize) raises ArgumentError
instead of evaluating arbitrary source. def_module and def_class both
delegate to def_method and are covered by the same check.
Co-authored-by: Tristan Madani <TristanInSec@gmail.com>
Upstream: https://github.com/ruby/ruby/commit/c35379df5279777fb4e02d989064eecd9cbbf338
CVE: CVE-2026-41316
[Titouan: Rebase on top of Ruby 3.4.9]
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
---
lib/erb.rb | 3 +++
test/erb/test_erb.rb | 27 +++++++++++++++++++++++++++
2 files changed, 30 insertions(+)
diff --git a/lib/erb.rb b/lib/erb.rb
index bc1615d7da..a7317c0856 100644
--- a/lib/erb.rb
+++ b/lib/erb.rb
@@ -463,6 +463,9 @@ def new_toplevel(vars = nil)
# erb.def_method(MyClass, 'render(arg1, arg2)', filename)
# print MyClass.new.render('foo', 123)
def def_method(mod, methodname, fname='(ERB)')
+ unless @_init.equal?(self.class.singleton_class)
+ raise ArgumentError, "not initialized"
+ end
src = self.src.sub(/^(?!#|$)/) {"def #{methodname}\n"} << "\nend\n"
mod.module_eval do
eval(src, binding, fname, -1)
diff --git a/test/erb/test_erb.rb b/test/erb/test_erb.rb
index 09496d31e25ca2..9eec43da158c0c 100644
--- a/test/erb/test_erb.rb
+++ b/test/erb/test_erb.rb
@@ -664,6 +664,33 @@ def test_prohibited_marshal_load
assert_raise(ArgumentError) {erb.result}
end
+ def test_prohibited_marshal_load_def_method
+ erb = ERB.allocate
+ erb.instance_variable_set(:@src, "")
+ erb.instance_variable_set(:@lineno, 1)
+ erb.instance_variable_set(:@_init, true)
+ erb = Marshal.load(Marshal.dump(erb))
+ assert_raise(ArgumentError) {erb.def_method(Class.new, 'render')}
+ end
+
+ def test_prohibited_marshal_load_def_module
+ erb = ERB.allocate
+ erb.instance_variable_set(:@src, "")
+ erb.instance_variable_set(:@lineno, 1)
+ erb.instance_variable_set(:@_init, true)
+ erb = Marshal.load(Marshal.dump(erb))
+ assert_raise(ArgumentError) {erb.def_module}
+ end
+
+ def test_prohibited_marshal_load_def_class
+ erb = ERB.allocate
+ erb.instance_variable_set(:@src, "")
+ erb.instance_variable_set(:@lineno, 1)
+ erb.instance_variable_set(:@_init, true)
+ erb = Marshal.load(Marshal.dump(erb))
+ assert_raise(ArgumentError) {erb.def_class}
+ end
+
def test_multi_line_comment_lineno
erb = ERB.new(<<~EOS)
<%= __LINE__ %>

4
package/ruby/ruby.hash
View File

@@ -1,5 +1,5 @@
# https://www.ruby-lang.org/en/news/2026/03/11/ruby-3-4-9-released/
sha512 356fb47cc56f2d25198cb95253fc20ff7d9a6fd1fa53bc475e5c440012aebe27562537c399d271357235114ade263fd625029b66cb0f9b526f9c04f169fb9580 ruby-3.4.9.tar.xz
# https://www.ruby-lang.org/en/news/2026/06/30/ruby-3-4-10-released/
sha512 c28d59946c0a1b8e4385a772e0651c6f4154c18ab8a2a62289c3213eb4fe937cec0942e0076cda429576e58ad277b18f4b5611e644d15b122c1cd96baf10f284 ruby-3.4.10.tar.xz
# License files, Locally calculated
sha256 a2021e52d5d6adf7e3f45aab9d2b860ce03cdf6153776853e11d5668193eecfd LEGAL

5
package/ruby/ruby.mk
View File

@@ -5,7 +5,7 @@
################################################################################
RUBY_VERSION_MAJOR = 3.4
RUBY_VERSION = $(RUBY_VERSION_MAJOR).9
RUBY_VERSION = $(RUBY_VERSION_MAJOR).10
RUBY_VERSION_EXT = 3.4.0
RUBY_SITE = http://cache.ruby-lang.org/pub/ruby/$(RUBY_VERSION_MAJOR)
RUBY_SOURCE = ruby-$(RUBY_VERSION).tar.xz
@@ -19,9 +19,6 @@ RUBY_LICENSE_FILES = LEGAL COPYING BSDL
RUBY_CPE_ID_VENDOR = ruby-lang
# 0001-fix-CVE-2026-41316.patch
RUBY_IGNORE_CVES += CVE-2026-41316
RUBY_DEPENDENCIES = host-pkgconf host-ruby
HOST_RUBY_DEPENDENCIES = host-libyaml host-pkgconf host-openssl
RUBY_MAKE_ENV = $(TARGET_MAKE_ENV)