Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:php-league-flysystem User: [email protected] Usertags: pu
Hi, I’d like to fix CVE-2026-102601 in Trixie that has been tagged as no-dsa by the security team. The patch is straightforward (yet, had to be adapted) and includes an additional test case. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable Thanks in advance for considering. Regards, taffit
diff -Nru php-league-flysystem-3.29.1/debian/changelog php-league-flysystem-3.29.1/debian/changelog --- php-league-flysystem-3.29.1/debian/changelog 2025-02-22 16:43:13.000000000 +0100 +++ php-league-flysystem-3.29.1/debian/changelog 2026-10-25 11:21:51.000000000 +0100 @@ -1,3 +1,10 @@ +php-league-flysystem (3.29.1-2+deb13u1) trixie; urgency=medium + + * New debian/trixie branch for Trixie + * Report broken utf-8 as a corrupted path [CVE-2026-102601] (Closes: #1149886) + + -- David Prévot <[email protected]> Sun, 25 Oct 2026 11:21:51 +0100 + php-league-flysystem (3.29.1-2) unstable; urgency=medium * Team upload diff -Nru php-league-flysystem-3.29.1/debian/control php-league-flysystem-3.29.1/debian/control --- php-league-flysystem-3.29.1/debian/control 2025-02-22 16:41:29.000000000 +0100 +++ php-league-flysystem-3.29.1/debian/control 2026-10-25 11:13:52.000000000 +0100 @@ -14,7 +14,7 @@ Standards-Version: 4.7.1 Homepage: https://flysystem.thephpleague.com/ Vcs-Browser: https://salsa.debian.org/php-team/pear/php-league-flysystem -Vcs-Git: https://salsa.debian.org/php-team/pear/php-league-flysystem.git +Vcs-Git: https://salsa.debian.org/php-team/pear/php-league-flysystem.git -b debian/trixie Rules-Requires-Root: no Package: php-league-flysystem diff -Nru php-league-flysystem-3.29.1/debian/gbp.conf php-league-flysystem-3.29.1/debian/gbp.conf --- php-league-flysystem-3.29.1/debian/gbp.conf 2024-07-24 08:42:28.000000000 +0200 +++ php-league-flysystem-3.29.1/debian/gbp.conf 2026-10-25 11:13:52.000000000 +0100 @@ -1,5 +1,5 @@ [DEFAULT] -debian-branch = debian/latest +debian-branch = debian/trixie pristine-tar = True pristine-tar-commit = True sign-tags = True diff -Nru php-league-flysystem-3.29.1/debian/patches/0003-Report-broken-utf-8-as-a-corrupted-path.patch php-league-flysystem-3.29.1/debian/patches/0003-Report-broken-utf-8-as-a-corrupted-path.patch --- php-league-flysystem-3.29.1/debian/patches/0003-Report-broken-utf-8-as-a-corrupted-path.patch 1970-01-01 01:00:00.000000000 +0100 +++ php-league-flysystem-3.29.1/debian/patches/0003-Report-broken-utf-8-as-a-corrupted-path.patch 2026-10-25 11:18:09.000000000 +0100 @@ -0,0 +1,40 @@ +From: Frank de Jonge <[email protected]> +Date: Sat, 22 Aug 2026 14:53:53 +0200 +Subject: Report broken utf-8 as a corrupted path. + +Origin: backport, https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c403125716706a0d9cc77 +Bug: https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvpr +Bug-Debian: https://bugs.debian.org/1149886 +--- + src/WhitespacePathNormalizer.php | 4 +++- + src/WhitespacePathNormalizerTest.php | 2 +- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/src/WhitespacePathNormalizer.php b/src/WhitespacePathNormalizer.php +index 135b22a..2edd943 100644 +--- a/src/WhitespacePathNormalizer.php ++++ b/src/WhitespacePathNormalizer.php +@@ -16,7 +16,9 @@ class WhitespacePathNormalizer implements PathNormalizer + + private function rejectFunkyWhiteSpace(string $path): void + { +- if (preg_match('#\p{C}+#u', $path)) { ++ $match = preg_match('#\p{C}+#u', $path); ++ ++ if ($match !== 0) { + throw CorruptedPathDetected::forPath($path); + } + } +diff --git a/src/WhitespacePathNormalizerTest.php b/src/WhitespacePathNormalizerTest.php +index bfafe6d..8066482 100644 +--- a/src/WhitespacePathNormalizerTest.php ++++ b/src/WhitespacePathNormalizerTest.php +@@ -76,7 +76,7 @@ class WhitespacePathNormalizerTest extends TestCase + + public static function dpFunkyWhitespacePaths(): iterable + { +- return [["some\0/path.txt"], ["s\x09i.php"]]; ++ return [["some\0/path.txt"], ["s\x09i.php"], ["foo\x80\x1bbar"]]; + } + + /** diff -Nru php-league-flysystem-3.29.1/debian/patches/series php-league-flysystem-3.29.1/debian/patches/series --- php-league-flysystem-3.29.1/debian/patches/series 2025-02-22 16:36:38.000000000 +0100 +++ php-league-flysystem-3.29.1/debian/patches/series 2026-10-25 11:18:09.000000000 +0100 @@ -1,2 +1,3 @@ 0001-Group-require-root-for-failing-autopkgtests.patch 0002-Modernize-PHPUnit-syntax.patch +0003-Report-broken-utf-8-as-a-corrupted-path.patch
signature.asc
Description: PGP signature
