Merge ~logan/ubuntu/+source/xdg-utils:merge into ubuntu/+source/xdg-utils:debian/sid

[Logan Rosen]

[Bryce Harrington (bryce)]

I've confirmed the patch is still needed for this release of the package.

I would recommend adding DEP3 headers for the patch, specifically Origin, Bug-Ubuntu, and Bug-Debian (https://dep-team.pages.debian.net/deps/dep3/). The bug has already been raised with Debian at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=975370, so that should be listed as Bug-Debian. It appears they are considering alternate solutions, but no recent activity it seems, so for now keeping the existing fix is the right course of action.

LGTM, +1

If you need sponsorship, let me know.

review: Approve

Unmerged commits

827b6c9... by Logan Rosen on 2021-04-07

finalize-changelog

e96cd62... by Logan Rosen on 2021-04-07

update-maintainer

66d873f... by Logan Rosen on 2021-04-07

reconstruct-changelog

76cc19a... by Logan Rosen on 2021-04-07

merge-changelogs

f790618... by Logan Rosen on 2021-04-07

Add debian/xdg-utils.links

   - Symlink /usr/bin/xdg-open to /usr/bin/browse (LP: #1624022)

337ea78... by Logan Rosen on 2021-04-07

SECURITY UPDATE: local file inclusion vulnerability

  - debian/patches/CVE-2020-27748.patch: remove attachment handling from
    mailto in scripts/xdg-email.in.
  - CVE-2020-27748

diff --git a/debian/changelog b/debian/changelog
index 7780970..76df7b1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+xdg-utils (1.1.3-4ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - SECURITY UPDATE: local file inclusion vulnerability
+      + debian/patches/CVE-2020-27748.patch: remove attachment handling from
+        mailto in scripts/xdg-email.in.
+      + CVE-2020-27748
+    - Add debian/xdg-utils.links:
+      + Symlink /usr/bin/xdg-open to /usr/bin/browse (LP #1624022)
+
+ -- Logan Rosen <[e-mail]>  Wed, 07 Apr 2021 17:12:40 -0400
+
 xdg-utils (1.1.3-4) unstable; urgency=medium
 
   * Set executable bit of the "ttyon" and the "ttyoff" utilities right before
@@ -34,6 +46,23 @@ xdg-utils (1.1.3-3) unstable; urgency=medium
 
  -- Nicholas Guriev <[e-mail]>  Sun, 10 Jan 2021 12:32:26 +0300
 
+xdg-utils (1.1.3-2ubuntu2) hirsute; urgency=medium
+
+  * SECURITY UPDATE: local file inclusion vulnerability
+    - debian/patches/CVE-2020-27748.patch: remove attachment handling from
+      mailto in scripts/xdg-email.in.
+    - CVE-2020-27748
+
+ -- Leonidas S. Barbosa <[e-mail]>  Tue, 24 Nov 2020 14:26:08 -0300
+
+xdg-utils (1.1.3-2ubuntu1) focal; urgency=medium
+
+  * Sync with Debian. Remaining change:
+    - Add debian/xdg-utils.links:
+      + Symlink /usr/bin/xdg-open to /usr/bin/browse (LP: #1624022)
+
+ -- Jeremy Bicha <[e-mail]>  Sun, 29 Mar 2020 19:38:09 -0400
+
 xdg-utils (1.1.3-2) unstable; urgency=medium
 
   [ Debian Janitor ]
diff --git a/debian/control b/debian/control
index 474ad23..bb7e0b7 100644
--- a/debian/control
+++ b/debian/control
@@ -1,5 +1,6 @@
 Source: xdg-utils
-Maintainer: Debian freedesktop.org maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian freedesktop.org maintainers <[e-mail]>
 Uploaders: Nicholas Guriev <[e-mail]>
 Section: utils
 Priority: optional
diff --git a/debian/patches/CVE-2020-27748.patch b/debian/patches/CVE-2020-27748.patch
new file mode 100644
index 0000000..de04492
--- /dev/null
+++ b/debian/patches/CVE-2020-27748.patch
@@ -0,0 +1,55 @@
+From 1f199813e0eb0246f63b54e9e154970e609575af Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <[e-mail]>
+Date: Tue, 18 Aug 2020 16:52:24 +0100
+Subject: [PATCH] xdg-email: remove attachment handling from mailto
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This allows attacker to extract secrets from users:
+
+mailto:[e-mail]?attach=/.gnupg/secring.gpg
+
+See also https://bugzilla.mozilla.org/show_bug.cgi?id=1613425
+and https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177
+
+Signed-off-by: Jörg Thalheim <[e-mail]>
+---
+ scripts/xdg-email.in | 7 +------
+ 1 file changed, 1 insertion(+), 6 deletions(-)
+
+diff --git a/scripts/xdg-email.in b/scripts/xdg-email.in
+index 6db58ad..5d2f4f3 100644
+--- a/scripts/xdg-email.in
++++ b/scripts/xdg-email.in
+@@ -32,7 +32,7 @@ _USAGE
+ 
+ run_thunderbird()
+ {
+-    local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH
++    local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY
+     THUNDERBIRD="$1"
+     MAILTO=$(echo "$2" | sed 's/^mailto://')
+     echo "$MAILTO" | grep -qs "^?"
+@@ -48,7 +48,6 @@ run_thunderbird()
+     BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }'))
+     SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1)
+     BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1)
+-    ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//'))
+ 
+     if [ -z "$TO" ] ; then
+         NEWMAILTO=
+@@ -68,10 +67,6 @@ run_thunderbird()
+         NEWMAILTO="${NEWMAILTO},$BODY"
+     fi
+ 
+-    if [ -n "$ATTACH" ] ; then
+-        NEWMAILTO="${NEWMAILTO},attachment='${ATTACH}'"
+-    fi
+-
+     NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//')
+     DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\""
+     "$THUNDERBIRD" -compose "$NEWMAILTO"
+-- 
+GitLab
+
diff --git a/debian/patches/debian-changes b/debian/patches/debian-changes
index aceba81..82ef001 100644
--- a/debian/patches/debian-changes
+++ b/debian/patches/debian-changes
@@ -475,7 +475,7 @@ repository.
  
 --- xdg-utils-1.1.3.orig/scripts/xdg-email.in
 +++ xdg-utils-1.1.3/scripts/xdg-email.in
-@@ -91,13 +91,13 @@ open_kde()
+@@ -86,13 +86,13 @@ open_kde()
      fi
  
      if which $kreadconfig >/dev/null 2>&1; then
@@ -495,7 +495,7 @@ repository.
  
              if echo "$client" | grep -Eq 'thunderbird|icedove'; then
                  run_thunderbird "$client" "$1"
-@@ -472,7 +472,7 @@ case "$DE" in
+@@ -467,7 +467,7 @@ case "$DE" in
      open_gnome "${mailto}"
      ;;
  
diff --git a/debian/patches/series b/debian/patches/series
index 7bb8252..80f7a23 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
+CVE-2020-27748.patch
 debian-changes
diff --git a/debian/xdg-utils.links b/debian/xdg-utils.links
new file mode 100644
index 0000000..c87b9d2
--- /dev/null
+++ b/debian/xdg-utils.links
@@ -0,0 +1 @@
+/usr/bin/xdg-open /usr/bin/browse