shellinabox: adress CVE-2018-16789 and cosmetic fixes in Makefile

diff --git a/shellinabox/Makefile b/shellinabox/Makefile
index acad228fd335b26603b63e58478496baebf4a6bc..3727245bb2457b08913cd945f0cd04e91c8e2b34 100644 (file)
--- a/shellinabox/Makefile
+++ b/shellinabox/Makefile
@@ -3,7 +3,7 @@
 PKGBASE=       shellinabox
 SIB_VER=       v2.20
 DISTNAME=      ${PKGBASE}-${SIB_VER}
-PKGREVISION=   2
+PKGREVISION=   3
 CATEGORIES=    www
 
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=shellinabox/}
@@ -11,7 +11,7 @@ GITHUB_PROJECT=       ${PKGBASE}
 GITHUB_TAG=    ${SIB_VER}
 
 MAINTAINER=    ast@NetBSD.org
-HOMEPAGE=      https://code.google.com/archive/p/shellinabox/
+HOMEPAGE=      https://github.com/shellinabox/shellinabox
 COMMENT=       JavaScript/CSS web server instrumentation for terminal emulation
 LICENSE=       gnu-gpl-v2
 
@@ -34,7 +34,7 @@ PKG_GROUPS_VARS=      SIB_USER
 PKG_USERS_VARS=                SIB_GROUP
 
 RCD_SCRIPTS+=          shellinaboxd
-RCD_SCRIPT_SRC.shellinaboxd = ${WRKSRC}/shellinaboxd.in
+RCD_SCRIPT_SRC.shellinaboxd= ${WRKSRC}/shellinaboxd.in
 
 SUBST_CLASSES+=                sib
 SUBST_STAGE.sib=       pre-configure

diff --git a/shellinabox/distinfo b/shellinabox/distinfo
index 613749b6e83e95f70b7545c12def76079d2ff277..0caf746fa5eb5aa2c7acd312fc2585a390c797a3 100644 (file)
--- a/shellinabox/distinfo
+++ b/shellinabox/distinfo
@@ -6,4 +6,5 @@ SHA512 (shellinabox-v2.20.tar.gz) = 369fb6e0041fc3eb52a533f14d1f856a71ec1bf16644
 Size (shellinabox-v2.20.tar.gz) = 745920 bytes
 SHA1 (patch-configure-ptsname_r) = 40c44f37afb09b99b40ee5b4faf470d95add10b7
 SHA1 (patch-configure-shell-syntax) = f6341418e5cc7538935c4c8ee8b2fa812512d579
+SHA1 (patch-libhttp-url-broken-multipart-form-data) = 6bf678d939880bd029548aa85246aacb188fce5a
 SHA1 (patch-service-ssh-rm-rsa-options) = 7e085d515d63dfd4fa3c3975a93a8e0434795e73

diff --git a/shellinabox/patches/patch-libhttp-url-broken-multipart-form-data b/shellinabox/patches/patch-libhttp-url-broken-multipart-form-data
new file mode 100644 (file)
index 0000000..144cc49
--- /dev/null
+++ b/shellinabox/patches/patch-libhttp-url-broken-multipart-form-data
@@ -0,0 +1,18 @@
+$NetBSD$
+
+Merge https://github.com/shellinabox/shellinabox/pull/446/commits
+commit 7f47efe for CVE-2018-16789: fix for broken multipart/form-data
+to mitigate DoS attack.
+
+--- libhttp/url.c.orig 2019-04-07 08:39:04.352921385 +0200
++++ libhttp/url.c      2019-04-07 08:42:30.746080956 +0200
+@@ -312,6 +312,9 @@
+               }
+             }
+           }
++        } else {
++           warn("[http] broken multipart/form-data!");
++           break;
+         }
+       }
+       if (lastPart) {