diff -Nru symfony-5.4.23+dfsg/debian/changelog symfony-5.4.23+dfsg/debian/changelog --- symfony-5.4.23+dfsg/debian/changelog 2024-11-14 12:16:18.000000000 +0100 +++ symfony-5.4.23+dfsg/debian/changelog 2025-11-13 07:56:38.000000000 +0100 @@ -1,3 +1,12 @@ +symfony (5.4.23+dfsg-1+deb12u5) bookworm; urgency=medium + + * Backport security fix from Symfony 5.4.50 + - [HttpFoundation] Fix parsing pathinfo with no leading slash + [CVE-2025-64500] + * [Finder] Drop data from testsuite + + -- David Prévot Thu, 13 Nov 2025 07:56:38 +0100 + symfony (5.4.23+dfsg-1+deb12u4) bookworm-security; urgency=medium * Backport security fixes from Symfony 5.4.47 diff -Nru symfony-5.4.23+dfsg/debian/patches/Finder-Drop-data-from-testsuite.patch symfony-5.4.23+dfsg/debian/patches/Finder-Drop-data-from-testsuite.patch --- symfony-5.4.23+dfsg/debian/patches/Finder-Drop-data-from-testsuite.patch 1970-01-01 01:00:00.000000000 +0100 +++ symfony-5.4.23+dfsg/debian/patches/Finder-Drop-data-from-testsuite.patch 2025-11-13 07:56:38.000000000 +0100 @@ -0,0 +1,22 @@ +From: =?utf-8?q?David_Pr=C3=A9vot?= +Date: Thu, 13 Nov 2025 08:24:17 +0100 +Subject: [Finder] Drop data from testsuite + +It seems to be failing in current Debian (old)stable now. +--- + .../Component/Finder/Tests/Iterator/DateRangeFilterIteratorTest.php | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/src/Symfony/Component/Finder/Tests/Iterator/DateRangeFilterIteratorTest.php b/src/Symfony/Component/Finder/Tests/Iterator/DateRangeFilterIteratorTest.php +index b02d8f4..908f8be 100644 +--- a/src/Symfony/Component/Finder/Tests/Iterator/DateRangeFilterIteratorTest.php ++++ b/src/Symfony/Component/Finder/Tests/Iterator/DateRangeFilterIteratorTest.php +@@ -36,8 +36,6 @@ class DateRangeFilterIteratorTest extends RealIteratorTestCase + '.git', + 'test.py', + 'foo', +- 'foo/bar.tmp', +- 'test.php', + 'toto', + 'toto/.git', + '.bar', diff -Nru symfony-5.4.23+dfsg/debian/patches/HttpClient-Temporary-test-hack.patch symfony-5.4.23+dfsg/debian/patches/HttpClient-Temporary-test-hack.patch --- symfony-5.4.23+dfsg/debian/patches/HttpClient-Temporary-test-hack.patch 2024-11-14 12:16:18.000000000 +0100 +++ symfony-5.4.23+dfsg/debian/patches/HttpClient-Temporary-test-hack.patch 1970-01-01 01:00:00.000000000 +0100 @@ -1,27 +0,0 @@ -From: =?utf-8?q?David_Pr=C3=A9vot?= -Date: Sun, 10 Nov 2024 08:56:23 +0100 -Subject: [HttpClient] Temporary test hack -MIME-Version: 1.0 -Content-Type: text/plain; charset="utf-8" -Content-Transfer-Encoding: 8bit - -Since php-symfony-http-client is part of the Build-Dependency chain, the -“old” version is used at build time, so the “new” error message is not -yet available. This patch can be dropped for the next upload. ---- - .../Component/HttpClient/Tests/NoPrivateNetworkHttpClientTest.php | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/Symfony/Component/HttpClient/Tests/NoPrivateNetworkHttpClientTest.php b/src/Symfony/Component/HttpClient/Tests/NoPrivateNetworkHttpClientTest.php -index 7130c09..9fdf110 100755 ---- a/src/Symfony/Component/HttpClient/Tests/NoPrivateNetworkHttpClientTest.php -+++ b/src/Symfony/Component/HttpClient/Tests/NoPrivateNetworkHttpClientTest.php -@@ -95,7 +95,7 @@ class NoPrivateNetworkHttpClientTest extends TestCase - - if ($mustThrow) { - $this->expectException(TransportException::class); -- $this->expectExceptionMessage(sprintf('Host "%s" is blocked for "%s".', $ipAddr, $url)); -+ $this->expectExceptionMessage(sprintf('"%s" is blocked for "%s".', $ipAddr, $url)); - } - - $previousHttpClient = $this->getHttpClientMock($url, $ipAddr, $content); diff -Nru symfony-5.4.23+dfsg/debian/patches/HttpFoundation-Fix-parsing-pathinfo-with-no-leading-slash.patch symfony-5.4.23+dfsg/debian/patches/HttpFoundation-Fix-parsing-pathinfo-with-no-leading-slash.patch --- symfony-5.4.23+dfsg/debian/patches/HttpFoundation-Fix-parsing-pathinfo-with-no-leading-slash.patch 1970-01-01 01:00:00.000000000 +0100 +++ symfony-5.4.23+dfsg/debian/patches/HttpFoundation-Fix-parsing-pathinfo-with-no-leading-slash.patch 2025-11-13 07:56:38.000000000 +0100 @@ -0,0 +1,49 @@ +From: Nicolas Grekas +Date: Fri, 31 Oct 2025 17:43:49 +0100 +Subject: [HttpFoundation] Fix parsing pathinfo with no leading slash + +Origin: upstream, https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac +Bug: https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm +Bug-Debian: https://security-tracker.debian.org/tracker/CVE-2025-64500 +--- + src/Symfony/Component/HttpFoundation/Request.php | 5 ++--- + src/Symfony/Component/HttpFoundation/Tests/RequestTest.php | 10 ++++++++++ + 2 files changed, 12 insertions(+), 3 deletions(-) + +diff --git a/src/Symfony/Component/HttpFoundation/Request.php b/src/Symfony/Component/HttpFoundation/Request.php +index acad3c9..40b68fc 100644 +--- a/src/Symfony/Component/HttpFoundation/Request.php ++++ b/src/Symfony/Component/HttpFoundation/Request.php +@@ -1983,9 +1983,8 @@ class Request + } + + $pathInfo = substr($requestUri, \strlen($baseUrl)); +- if (false === $pathInfo || '' === $pathInfo) { +- // If substr() returns false then PATH_INFO is set to an empty string +- return '/'; ++ if (false === $pathInfo || '' === $pathInfo || '/' !== $pathInfo[0]) { ++ return '/'.$pathInfo; + } + + return $pathInfo; +diff --git a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php +index 993d95c..772b5d4 100644 +--- a/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php ++++ b/src/Symfony/Component/HttpFoundation/Tests/RequestTest.php +@@ -1873,6 +1873,16 @@ class RequestTest extends TestCase + '', + '/foo/api/bar', + ], ++ [ ++ '/api/index.phpfoo', ++ [ ++ 'SCRIPT_FILENAME' => '/var/www/api/index.php', ++ 'SCRIPT_NAME' => '/api/index.php', ++ 'PHP_SELF' => '/api/index.php', ++ ], ++ '/api/index.php', ++ '/foo', ++ ], + ]; + } + diff -Nru symfony-5.4.23+dfsg/debian/patches/series symfony-5.4.23+dfsg/debian/patches/series --- symfony-5.4.23+dfsg/debian/patches/series 2024-11-14 12:16:18.000000000 +0100 +++ symfony-5.4.23+dfsg/debian/patches/series 2025-11-13 07:56:38.000000000 +0100 @@ -46,4 +46,6 @@ ErrorHandler-Extend-test-expectation.patch HttpClient-Resolve-hostnames-in-NoPrivateNetworkHttpClien.patch security-http-Check-owner-of-persisted-remember-me-cookie.patch -HttpClient-Temporary-test-hack.patch +HttpFoundation-Fix-parsing-pathinfo-with-no-leading-slash.patch +Finder-Drop-data-from-testsuite.patch +# DEP-8/Tests-against-installed-classes.patch