There is a security release for doctrine that includes annotations, cache and common.
http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vul...
composer update doctrine/common

Proposed resolution

Bring doctrine/common up to 2.4.3, annotations to 1.2.7 and cache to 1.3.2

Beta phase evaluation

Reference: https://www.drupal.org/core/beta-changes
Issue category Task because no functionality changes.
Issue priority Major because security release
CommentFileSizeAuthor
#21 update_doctrine_common-2105825-21.patch650.32 KBhussainweb
#21 update_doctrine_common-2105825-21-do-not-test.patch14.89 KBhussainweb
#17 doctrine-2105825.10.patch588.17 KBlarowlan
#16 doctrine-2105825.16.patch544.97 KBlarowlan
#16 doctrine-2105825.do-not-test.patch13.84 KBlarowlan
#6 update_doctrine-2105825-5.patch92.57 KBnitesh sethia
#5 update_doctrine-2105825-5.patch92.57 KBnitesh sethia
#3 UpdateDoctrine.patch123.93 KBcosmicdreams
#1 Doctrine241.patch123.92 KBcosmicdreams
DoctrineUpdates.patch27.62 KBcosmicdreams

Comments

cosmicdreams’s picture

cosmicdreams commented
StatusFileSize
new Doctrine241.patch123.92 KB

I messed up other similar patches earlier today. So I'm resubmitting this one to be sure I'm submitting a patch and contains the entire update.

This issue is actually rather important because the previous version was an RC candidate and this one is 2.4.1.
Looks like there are some caching stuff that was included.

cosmicdreams’s picture

cosmicdreams commented
Title: Updated Doctrine Component » Updat Doctrine Component to 2.4.1
cosmicdreams’s picture

cosmicdreams commented
Title: Updat Doctrine Component to 2.4.1 » Update Doctrine Component to 2.4.1
StatusFileSize
new UpdateDoctrine.patch123.93 KB

reroll because another library was updated. Upgrade to stable.

jhedstrom’s picture

jhedstrom
Primary language English
Location Portland, OR
commented
Issue summary: View changes
Status: Needs review » Needs work
Issue tags: +Needs reroll

Patch no longer applies.

Also, related #2325779: Upgrade to Doctrine v1.2.0.

nitesh sethia’s picture

nitesh sethia commented
StatusFileSize
new update_doctrine-2105825-5.patch92.57 KB

Rerolled the patch successfully.

nitesh sethia’s picture

nitesh sethia commented
Status: Needs work » Needs review
StatusFileSize
new update_doctrine-2105825-5.patch92.57 KB

Rerolled the patch.

dawehner’s picture

dawehner
Primary language German
commented

Mh, the patch removes lines related to behat/mink, but never adds something like that back ... are we sure that this is something what we want? (not sure either)

cosmicdreams’s picture

cosmicdreams commented

This patch was first created before the inclusion of behat / mink. This patch will require more than a straight reroll in order to be accepted.

dawehner’s picture

dawehner
Primary language German
commented
Status: Needs review » Needs work
Issue tags: -Needs reroll

Yeah this is what I thought as well.

Let's be clear, the reroll tag is confusing to start with .

cosmicdreams’s picture

cosmicdreams commented

Futhermore, the current version of doctrine/common is 2.4.2. That's the most current 2.4.x version of the package.

It is more difficult to discern but I think we're using doctrine/annotations 1.2.1. That could be updated to 1.2.4 without much conflict.

So perhaps I should rename this issue to focus it better.

cosmicdreams’s picture

cosmicdreams commented
Title: Update Doctrine Component to 2.4.1 » Update Doctrine Annotations Component to 1.2.4
Category: Bug report » Task
Issue summary: View changes

Rewrote issue summary and added a beta evaluation here. This is a small task that could be knocked out at an upcoming Drupal Camp like TC Drupal Camp

cosmicdreams’s picture

cosmicdreams commented
Issue summary: View changes

Ha, looksl like I added two beta summaries.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Title: Update Doctrine Annotations Component to 1.2.4 » Update Doctrine Annotations Component to 1.2.7
Issue summary: View changes
Priority: Normal » Major

1.2.7 is out and is a security release http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vul...

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Title: Update Doctrine Annotations Component to 1.2.7 » Update Doctrine/common Component to 2.4.3 (security) (includes cache/annotations too)
Issue summary: View changes
Issue tags: +Security

Closed #2493909: Update doctrine/cache to the latest stable release as duplicate.

Please add naveenvalecha, iMiksu, edysmp to commit credits.

larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Issue summary: View changes
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
Status: Needs work » Needs review
StatusFileSize
new doctrine-2105825.do-not-test.patch13.84 KB
new doctrine-2105825.16.patch544.97 KB 
[rowlands@Lees-MacBook-Pro core (doctrine-2105825)]$ composer update "doctrine/*" --prefer-dist
Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Removing doctrine/annotations (v1.2.1)
  - Installing doctrine/annotations (v1.2.7)
    Downloading: 100%

  - Removing doctrine/collections (v1.2)
  - Installing doctrine/collections (v1.3.0)
    Loading from cache

  - Removing doctrine/cache (v1.3.1)
  - Installing doctrine/cache (v1.4.2)
    Downloading: 100%

  - Removing doctrine/inflector (v1.0)
  - Installing doctrine/inflector (v1.0.1)
    Loading from cache

  - Removing doctrine/common (v2.4.2)
  - Installing doctrine/common (v2.4.3)
    Downloading: 100%

  - Removing doctrine/instantiator (1.0.4)
  - Installing doctrine/instantiator (1.0.5)
    Loading from cache

Writing lock file
Generating autoload files
> Drupal\Core\Composer\Composer::preAutoloadDump
> Drupal\Core\Composer\Composer::ensureHtaccess
larowlan’s picture

larowlan
Location 🇦🇺🏝.au GMT+10
commented
StatusFileSize
new doctrine-2105825.10.patch588.17 KB

Missed new files

kim.pepper’s picture

kim.pepper
Primary language English
Location 🏄‍♂️🇦🇺Sydney, Australia
commented
Status: Needs review » Reviewed & tested by the community

This looks simple enough, and tests are green.

The last submitted patch, 5: update_doctrine-2105825-5.patch, failed testing.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented
Parent issue: » #2400407: [meta] Ensure vendor (PHP) libraries are on latest stable release

We should be able to get this in soon after tagging beta 15.

hussainweb’s picture

hussainweb
Primary language English
commented
Status: Reviewed & tested by the community » Needs review
StatusFileSize
new update_doctrine_common-2105825-21-do-not-test.patch14.89 KB
new update_doctrine_common-2105825-21.patch650.32 KB

2.5.1 is out, which contains the same security fix, and we could as well try to update the minor here. I don't want to hijack this issue but it seems wasteful to create another one.

hw@d8:/var/www/d8task/core-[git 8.0.x] $ composer require doctrine/common:"2.5.*"
./composer.json has been updated
Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Removing doctrine/common (v2.4.2)
  - Installing doctrine/common (v2.5.1)
    Loading from cache

Writing lock file
Generating autoload files
> Drupal\Core\Composer\Composer::preAutoloadDump
> Drupal\Core\Composer\Composer::ensureHtaccess
hw@d8:/var/www/d8task/core-[git 8.0.x] $ composer update "doctrine/*" --prefer-dist
Loading composer repositories with package information
Updating dependencies (including require-dev)
  - Removing doctrine/annotations (v1.2.1)
  - Installing doctrine/annotations (v1.2.7)
    Downloading: 100%

  - Removing doctrine/instantiator (1.0.4)
  - Installing doctrine/instantiator (1.0.5)
    Loading from cache

  - Removing doctrine/cache (v1.3.1)
  - Installing doctrine/cache (v1.4.2)
    Downloading: 100%

  - Removing doctrine/collections (v1.2)
  - Installing doctrine/collections (v1.3.0)
    Downloading: 100%

  - Removing doctrine/inflector (v1.0)
  - Installing doctrine/inflector (v1.0.1)
    Downloading: 100%

Writing lock file
Generating autoload files
> Drupal\Core\Composer\Composer::preAutoloadDump
> Drupal\Core\Composer\Composer::ensureHtaccess

If you want to deal with that upgrade in another issue, this could go back to RTBC as per #18.

dawehner’s picture

dawehner
Primary language German
commented
Status: Needs review » Reviewed & tested by the community

+1

Well the other patch is not green anway

hussainweb’s picture

hussainweb
Primary language English
commented
Title: Update Doctrine/common Component to 2.4.3 (security) (includes cache/annotations too) » Update Doctrine/common Component to 2.5.1 (security) (includes cache/annotations too)
Priority: Major » Critical

Since we agree, lets update the metadata. :)
It is critical as per the parent issue (minor updates are critical).

naveenvalecha’s picture

naveenvalecha
He/Him
commented

Closed #2493907: Update doctrine/collections to the latest stable release as duplicate.

Already mentioned to add me and iMiksu to commit credits in #14

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented
Status: Reviewed & tested by the community » Fixed

Committed and pushed to 8.0.x. Thanks!

  • webchick committed ca850b8 on 8.0.x 
    Issue #2105825 by cosmicdreams, larowlan, hussainweb, Nitesh Sethia,...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.