On 3 Nov, pfg.apache.org via commits wrote:
> This is an automated email from the ASF dual-hosted git repository.
>
> asf-gitbox-commits pushed a commit to branch trunk
> in repository https://gitbox.apache.org/repos/asf/openoffice.git
>
>
> The following commit(s) were added to refs/heads/trunk by this push:
> new a0d841013a Rhino 1.7.7.2 integration: security hardening, patch
> fixes, ES6 default mode
> a0d841013a is described below
>
> commit a0d841013a7b93e3bcedcaed86403bb1797490bd
> Author: Pedro Giffuni <[email protected]>
> AuthorDate: Tue Nov 3 03:37:55 2026 -0500
>
> Rhino 1.7.7.2 integration: security hardening, patch fixes, ES6 default
> mode
>
> Security hardening:
> - E4X/XML: harden XmlProcessor against XXE (external entities, parameter
> entities, external DTD, XInclude, external stylesheet).
> TransformerFactory
> configured with FEATURE_SECURE_PROCESSING and ACCESS_EXTERNAL_*;
> explicit
> empty entity resolver as defense-in-depth.
> - toFixed(): bound computational cost for tiny/subnormal values using
> 0.5 * 10^(-precision) comparison (no overflow, numerically stable),
> preventing DoS on inputs like (4.47118444E-314).toFixed(2).
> - DefiningClassLoader: call Thread.getContextClassLoader() directly
> instead
> of reflection (available since Java 2, no Java2 concern on Java 8).
>
> Patch fixes:
> - java-version.patch: target-jvm/source-level 1.6 -> 1.8 (Java 8 minimum).
> - Main: getIn()/getOut()/getErr() fall back to System.in/out/err instead
> of
> returning null when debugger console unavailable.
> - build.xml: inline manifest (Implementation-Version: 1.7.7.2), ships
> Messages.properties in JAR; full js.jar with debugger+tools preserved.
>
> Language mode:
> - Default Context.VERSION_ES6 in ScriptProviderForJavaScript and
> ScriptEditorForJavaScript.
>
> Build note:
> - Rhino 1.7.7.2 is the last Rhino version supporting the Ant build;
> upstream migrated to Gradle thereafter.
>
> Regression tests (not committed): TestXXEResgression (11 pass),
> TestToFixedRegression (32 pass), TestES6Smoke (5 pass).
> ---
> main/LICENSE_category_b | 4 +-
> main/external_deps.lst | 6 +-
> main/rhino/README | 23 +-
> main/rhino/makefile.mk | 11 +-
> main/rhino/prj/d.lst | 2 +-
> main/rhino/rhino-1.7.7.2-definingclassloader.patch | 66 ++
> main/rhino/rhino-1.7.7.2-main.patch | 38 +
> main/rhino/rhino-1.7.7.2-tofixed-fix.patch | 43 +
> main/rhino/rhino-1.7.7.2-xxe-fix.patch | 61 +
> main/rhino/rhino1_7R3-java-version.patch | 13 -
> main/rhino/rhino1_7_7_2-java-version.patch | 14 +
> .../rhino/{rhino1_7R3.patch => rhino1_7_7_2.patch} | 1228
> +++++++++-----------
> .../script/framework/provider/ScriptContext.java | 11 +-
> .../script/framework/provider/ScriptProvider.java | 2 +-
> .../javascript/ScriptEditorForJavaScript.java | 21 +-
> .../javascript/ScriptProviderForJavaScript.java | 24 +-
> 16 files changed, 825 insertions(+), 742 deletions(-)
>
> diff --git a/main/LICENSE_category_b b/main/LICENSE_category_b
> index 5603eeb568..f512564201 100644
> --- a/main/LICENSE_category_b
> +++ b/main/LICENSE_category_b
> @@ -20,8 +20,8 @@ ____
> -- GPL 2.0/LGPL 2.1/MPL 1.1 tri-license
> MPL 1.1 is chosen for Apache OpenOffice
> - For Rhino
> --- MPL 1.1 / GPL 2.0 dual licensed
> - MPL 1.1 is chosen for Apache OpenOffice
> +-- MPL 2.0
> + MPL 2.0 is chosen for Apache OpenOffice
>
>
> MOZILLA PUBLIC LICENSE
> diff --git a/main/external_deps.lst b/main/external_deps.lst
> index b7ddf2a260..95db5cb62f 100644
> --- a/main/external_deps.lst
> +++ b/main/external_deps.lst
> @@ -292,9 +292,9 @@ if (ENABLE_CATEGORY_B==YES && SYSTEM_HUNSPELL!=YES)
> URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
>
> if (ENABLE_CATEGORY_B==YES && SOLAR_JAVA==TRUE && ENABLE_JAVASCRIPT==YES)
> - MD5 = 99d94103662a8d0b571e247a77432ac5
> - name = rhino1_7R3.zip
> - URL1 = https://ftp.mozilla.org/pub/js/$(name)
> + MD5 = afcf570784ebd919c1d484a6d0d3fcd6
> + name = rhino-1.7.7.2.zip
> + URL1 =
> https://github.com/mozilla/rhino/releases/download/Rhino1_7_7_2_Release/$(name)
> URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
>
> if (ENABLE_CATEGORY_B==YES && ENABLE_NSS_MODULE==YES)
To get the FreeBSD port to build, I need something like the following
patch. Both 1.7.7.2 and 1.7.15.1 are broken. I don't see anything that
create the version of the filename with underscores, which causes the
rhino source to fail to unpack.
diff --git a/main/external_deps.lst b/main/external_deps.lst
index 4e02cbfad0..4cb1f241da 100644
--- a/main/external_deps.lst
+++ b/main/external_deps.lst
@@ -306,8 +306,8 @@ if (ENABLE_CATEGORY_B==YES && SYSTEM_HUNSPELL!=YES)
if (ENABLE_CATEGORY_B==YES && SOLAR_JAVA==TRUE && ENABLE_JAVASCRIPT==YES)
MD5 = b98c6c3ec884277f253028abf91d257b
- name = rhino1_7_15_1.zip
- URL1 = https://github.com/mozilla/rhino/releases/download/Rhino1_7_15_1_Release/rhino-1.7.15.1.zip
+ name = rhino-1.7.15.1.zip
+ URL1 = https://github.com/mozilla/rhino/releases/download/Rhino1_7_15_1_Release/$(name)
URL2 = $(OOO_EXTRAS)$(MD5)-$(name)
if (ENABLE_CATEGORY_B==YES && ENABLE_NSS_MODULE==YES)
diff --git a/main/rhino/makefile.mk b/main/rhino/makefile.mk
index cade0e3192..51c35b55c8 100644
--- a/main/rhino/makefile.mk
+++ b/main/rhino/makefile.mk
@@ -44,7 +44,7 @@ all:
#.IF "$(DISABLE_RHINO)" == ""
-TARFILE_NAME=rhino1_7_15_1
+TARFILE_NAME=rhino-1.7.15.1
TARFILE_MD5=b98c6c3ec884277f253028abf91d257b
TARFILE_ROOTDIR=rhino1.7.15.1
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
