[Git][security-tracker-team/security-tracker][fix-gen-dla-empty-version] gen-DSA: don't leak unset version placeholders in generated advisories

[Utkarsh Gupta (@utkarsh)]

Utkarsh Gupta pushed to branch fix-gen-dla-empty-version at Debian Security Tracker / security-tracker


Commits:
863fa763 by Utkarsh Gupta at 2026-07-04T23:48:33+05:30
gen-DSA: don't leak unset version placeholders in generated advisories

- - - - -


1 changed file:

- bin/gen-DSA


Changes:

=====================================
bin/gen-DSA
=====================================
@@ -168,6 +168,27 @@ setvar() {
     sed -i "s=\$$var=$value=g" "$tmpf"
 }
 
+# Drop a suite with no version from $tmpf: strip its $<dist>_VERSION token
+# from any single-line field (e.g. "Version : ...") and remove any whole
+# paragraph that still references it, regardless of the template's wording.
+dropunsetversion() {
+    local dist="$1" token="\$${dist}_VERSION" token_re="\\\$${dist}_VERSION"
+
+    sed -Ei "/^[A-Za-z][A-Za-z0-9 ]*:[ 	]/ s/ ?$token_re//" "$tmpf"
+
+    awk -v token="$token" '
+	BEGIN { RS=""; FS="\n"; n=0 }
+	{ if (index($0, token) == 0) paras[n++]=$0 }
+	END {
+	    for (i=0; i<n; i++) {
+		printf "%s", paras[i]
+		if (i<n-1) printf "\n\n"
+	    }
+	}
+    ' "$tmpf" > "$tmpf.new"
+    mv "$tmpf.new" "$tmpf"
+}
+
 if $color && [ -z "$NO_COLOR" ] && command -v tput >/dev/null ; then
     RED=$(tput setaf 1)
     YELLOW=$(tput setaf 3)
@@ -383,8 +404,13 @@ for dist in $CODENAMES; do
 	    eval "${dist}_VERSION='$version'"
 	fi
     fi
-    [ -z "$version" ] || setvar "${dist}_VERSION" "$version"
-    [ -z "$version" ] || DISTS="${DISTS},${dist}"
+    if [ -n "$version" ]; then
+	setvar "${dist}_VERSION" "$version"
+	DISTS="${DISTS},${dist}"
+    elif $save; then
+	# no version for this suite: don't leak its unsubstituted placeholder
+	dropunsetversion "$dist"
+    fi
 done
 
 DISTS="${DISTS#,}"



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/863fa7639753f41c34dcbc6d7297ca73ec43968e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/863fa7639753f41c34dcbc6d7297ca73ec43968e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260704/35050612/attachment-0001.htm>