Apply upstream fix of XSS vulnerability

Closes: #1001333

debian/patches/0002-Fix-parent-call.patch

+From: Dries Vints <dries@vints.io>
+Date: Mon, 6 Dec 2021 18:14:03 +0100
+Subject: Fix parent call
+
+Origin: https://github.com/laravel/framework/commit/b8174169b1807f36de1837751599e2828ceddb9b
+Applied-Upstream: 6.20.42
+---
+ src/Illuminate/View/Compilers/Compiler.php         |  2 +-
+ .../View/Compilers/Concerns/CompilesLayouts.php    |  6 ++---
+ src/Illuminate/View/Concerns/ManagesLayouts.php    | 26 +++++++++++++++++++++-
+ tests/View/ViewBladeCompilerTest.php               | 20 ++++++++---------
+ 4 files changed, 39 insertions(+), 15 deletions(-)
+
+diff --git a/src/Illuminate/View/Compilers/Compiler.php b/src/Illuminate/View/Compilers/Compiler.php
+index 08648ad..d2a9f26 100755
+--- a/src/Illuminate/View/Compilers/Compiler.php
++++ b/src/Illuminate/View/Compilers/Compiler.php
+@@ -48,7 +48,7 @@ abstract class Compiler
+      */
+     public function getCompiledPath($path)
+     {
+-        return $this->cachePath.'/'.sha1($path).'.php';
++        return $this->cachePath.'/'.sha1('v2'.$path).'.php';
+     }
+ 
+     /**
+diff --git a/src/Illuminate/View/Compilers/Concerns/CompilesLayouts.php b/src/Illuminate/View/Compilers/Concerns/CompilesLayouts.php
+index aaef617..fc6a63a 100644
+--- a/src/Illuminate/View/Compilers/Concerns/CompilesLayouts.php
++++ b/src/Illuminate/View/Compilers/Concerns/CompilesLayouts.php
+@@ -2,8 +2,6 @@
+ 
+ namespace Illuminate\View\Compilers\Concerns;
+ 
+-use Illuminate\View\Factory as ViewFactory;
+-
+ trait CompilesLayouts
+ {
+     /**
+@@ -50,7 +48,9 @@ trait CompilesLayouts
+      */
+     protected function compileParent()
+     {
+-        return ViewFactory::parentPlaceholder($this->lastSection ?: '');
++        $escapedLastSection = strtr($this->lastSection, ['\\' => '\\\\', "'" => "\\'"]);
++
++        return "<?php echo \Illuminate\View\Factory::parentPlaceholder('{$escapedLastSection}'); ?>";
+     }
+ 
+     /**
+diff --git a/src/Illuminate/View/Concerns/ManagesLayouts.php b/src/Illuminate/View/Concerns/ManagesLayouts.php
+index 29d7155..82fb77b 100644
+--- a/src/Illuminate/View/Concerns/ManagesLayouts.php
++++ b/src/Illuminate/View/Concerns/ManagesLayouts.php
+@@ -3,6 +3,7 @@
+ namespace Illuminate\View\Concerns;
+ 
+ use Illuminate\Contracts\View\View;
++use Illuminate\Support\Str;
+ use InvalidArgumentException;
+ 
+ trait ManagesLayouts
+@@ -28,6 +29,13 @@ trait ManagesLayouts
+      */
+     protected static $parentPlaceholder = [];
+ 
++    /**
++     * The parent placeholder salt for the request.
++     *
++     * @var string
++     */
++    protected static $parentPlaceholderSalt;
++
+     /**
+      * Start injecting content into a section.
+      *
+@@ -168,12 +176,28 @@ trait ManagesLayouts
+     public static function parentPlaceholder($section = '')
+     {
+         if (! isset(static::$parentPlaceholder[$section])) {
+-            static::$parentPlaceholder[$section] = '##parent-placeholder-'.sha1($section).'##';
++            $salt = static::parentPlaceholderSalt();
++
++            static::$parentPlaceholder[$section] = '##parent-placeholder-'.sha1($salt.$section).'##';
+         }
+ 
+         return static::$parentPlaceholder[$section];
+     }
+ 
++    /**
++     * Get the parent placeholder salt.
++     *
++     * @return string
++     */
++    protected static function parentPlaceholderSalt()
++    {
++        if (! static::$parentPlaceholderSalt) {
++            return static::$parentPlaceholderSalt = Str::random(40);
++        }
++
++        return static::$parentPlaceholderSalt;
++    }
++
+     /**
+      * Check if section exists.
+      *
+diff --git a/tests/View/ViewBladeCompilerTest.php b/tests/View/ViewBladeCompilerTest.php
+index fd61b8c..eddf9e2 100644
+--- a/tests/View/ViewBladeCompilerTest.php
++++ b/tests/View/ViewBladeCompilerTest.php
+@@ -18,7 +18,7 @@ class ViewBladeCompilerTest extends TestCase
+     public function testIsExpiredReturnsTrueIfCompiledFileDoesntExist()
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+-        $files->shouldReceive('exists')->once()->with(__DIR__.'/'.sha1('foo').'.php')->andReturn(false);
++        $files->shouldReceive('exists')->once()->with(__DIR__.'/'.sha1('v2foo').'.php')->andReturn(false);
+         $this->assertTrue($compiler->isExpired('foo'));
+     }
+ 
+@@ -33,23 +33,23 @@ class ViewBladeCompilerTest extends TestCase
+     public function testIsExpiredReturnsTrueWhenModificationTimesWarrant()
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+-        $files->shouldReceive('exists')->once()->with(__DIR__.'/'.sha1('foo').'.php')->andReturn(true);
++        $files->shouldReceive('exists')->once()->with(__DIR__.'/'.sha1('v2foo').'.php')->andReturn(true);
+         $files->shouldReceive('lastModified')->once()->with('foo')->andReturn(100);
+-        $files->shouldReceive('lastModified')->once()->with(__DIR__.'/'.sha1('foo').'.php')->andReturn(0);
++        $files->shouldReceive('lastModified')->once()->with(__DIR__.'/'.sha1('v2foo').'.php')->andReturn(0);
+         $this->assertTrue($compiler->isExpired('foo'));
+     }
+ 
+     public function testCompilePathIsProperlyCreated()
+     {
+         $compiler = new BladeCompiler($this->getFiles(), __DIR__);
+-        $this->assertEquals(__DIR__.'/'.sha1('foo').'.php', $compiler->getCompiledPath('foo'));
++        $this->assertEquals(__DIR__.'/'.sha1('v2foo').'.php', $compiler->getCompiledPath('foo'));
+     }
+ 
+     public function testCompileCompilesFileAndReturnsContents()
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+         $files->shouldReceive('get')->once()->with('foo')->andReturn('Hello World');
+-        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('foo').'.php', 'Hello World<?php /**PATH foo ENDPATH**/ ?>');
++        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('v2foo').'.php', 'Hello World<?php /**PATH foo ENDPATH**/ ?>');
+         $compiler->compile('foo');
+     }
+ 
+@@ -57,7 +57,7 @@ class ViewBladeCompilerTest extends TestCase
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+         $files->shouldReceive('get')->once()->with('foo')->andReturn('Hello World');
+-        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('foo').'.php', 'Hello World<?php /**PATH foo ENDPATH**/ ?>');
++        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('v2foo').'.php', 'Hello World<?php /**PATH foo ENDPATH**/ ?>');
+         $compiler->compile('foo');
+         $this->assertSame('foo', $compiler->getPath());
+     }
+@@ -73,7 +73,7 @@ class ViewBladeCompilerTest extends TestCase
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+         $files->shouldReceive('get')->once()->with('foo')->andReturn('Hello World');
+-        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('foo').'.php', 'Hello World<?php /**PATH foo ENDPATH**/ ?>');
++        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('v2foo').'.php', 'Hello World<?php /**PATH foo ENDPATH**/ ?>');
+         // set path before compilation
+         $compiler->setPath('foo');
+         // trigger compilation with $path
+@@ -103,7 +103,7 @@ class ViewBladeCompilerTest extends TestCase
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+         $files->shouldReceive('get')->once()->with('foo')->andReturn($content);
+-        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('foo').'.php', $compiled);
++        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('v2foo').'.php', $compiled);
+ 
+         $compiler->compile('foo');
+     }
+@@ -157,7 +157,7 @@ class ViewBladeCompilerTest extends TestCase
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+         $files->shouldReceive('get')->once()->with('')->andReturn('Hello World');
+-        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('').'.php', 'Hello World');
++        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('v2').'.php', 'Hello World');
+         $compiler->setPath('');
+         $compiler->compile();
+     }
+@@ -166,7 +166,7 @@ class ViewBladeCompilerTest extends TestCase
+     {
+         $compiler = new BladeCompiler($files = $this->getFiles(), __DIR__);
+         $files->shouldReceive('get')->once()->with(null)->andReturn('Hello World');
+-        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1(null).'.php', 'Hello World');
++        $files->shouldReceive('put')->once()->with(__DIR__.'/'.sha1('v2').'.php', 'Hello World');
+         $compiler->setPath(null);
+         $compiler->compile();
+     }

debian/patches/series

 0001-cast-to-int.patch
+0002-Fix-parent-call.patch