[bug#44492] [PATCH v7 06/51] gnu: Add rust-comrak-0.7.

[Leo Prikler]

* gnu/packages/patches/rust-comrak-0.7-rustsec-2021-0026.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it here.
* gnu/packages/crates-io.scm (rust-comrak-0.7): New variable.
---
 gnu/local.mk                                  |  1 +
 gnu/packages/crates-io.scm                    | 44 +++++++++++++++++++
 .../rust-comrak-0.7-rustsec-2021-0026.patch   | 41 +++++++++++++++++
 3 files changed, 86 insertions(+)
 create mode 100644 gnu/packages/patches/rust-comrak-0.7-rustsec-2021-0026.patch

diff --git a/gnu/local.mk b/gnu/local.mk
index cf8849cf59..d07aaeb90b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1642,6 +1642,7 @@ dist_patch_DATA =                                         
\
   %D%/packages/patches/rust-1.45-linker-locale.patch           \
   %D%/packages/patches/rust-1.48-linker-locale.patch           \
   %D%/packages/patches/rust-bootstrap-stage0-test.patch                \
+  %D%/packages/patches/rust-comrak-0.7-rustsec-2021-0026.patch         \
   %D%/packages/patches/rust-coresimd-doctest.patch             \
   %D%/packages/patches/rust-ndarray-remove-blas-src-dep.patch  \
   %D%/packages/patches/rust-nettle-disable-vendor.patch                 \
diff --git a/gnu/packages/crates-io.scm b/gnu/packages/crates-io.scm
index 91bcbacfae..17ac4a08b4 100644
--- a/gnu/packages/crates-io.scm
+++ b/gnu/packages/crates-io.scm
@@ -7766,6 +7766,50 @@ harness.")
         ("rust-rustc-serialize" ,rust-rustc-serialize-0.3)
         ("rust-tempdir" ,rust-tempdir-0.3))))))
 
+(define-public rust-comrak-0.7
+  (package
+    (name "rust-comrak")
+    (version "0.7.0")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (crate-uri "comrak" version))
+       (file-name
+        (string-append name "-" version ".tar.gz"))
+       (sha256
+        (base32
+         "07026j0ghwgv5z61fc4l893wwc30krxpsy487rb91wkcag65hw71"))
+       (patches
+        (search-patches
+         "rust-comrak-0.7-rustsec-2021-0026.patch"))
+       (modules '((guix build utils)))
+       (snippet
+        '(begin
+           (substitute* "src/tests.rs"
+             (("data:(png|jpeg|gif|webp)" all what)
+              (string-append "data:image/" what)))
+           #t))))
+    (build-system cargo-build-system)
+    (arguments
+      `(#:cargo-inputs
+        (("rust-clap" ,rust-clap-2)
+         ("rust-entities" ,rust-entities-1)
+         ("rust-lazy-static" ,rust-lazy-static-1)
+         ("rust-pest" ,rust-pest-2)
+         ("rust-pest-derive" ,rust-pest-derive-2)
+         ("rust-regex" ,rust-regex-1)
+         ("rust-twoway" ,rust-twoway-0.2)
+         ("rust-typed-arena" ,rust-typed-arena-1)
+         ("rust-unicode-categories"
+          ,rust-unicode-categories-0.1))
+        #:cargo-development-inputs
+        (("rust-timebomb" ,rust-timebomb-0.1))))
+    (home-page "https://github.com/kivikakk/comrak";)
+    (synopsis "Markdown parser and formatter")
+    (description "This package provides a parser and formatter for Github
+Flavored Markdown, that is compatible with CommonMark.")
+    (license license:bsd-2)))
+
 (define-public rust-concurrent-queue-1
   (package
     (name "rust-concurrent-queue")
diff --git a/gnu/packages/patches/rust-comrak-0.7-rustsec-2021-0026.patch 
b/gnu/packages/patches/rust-comrak-0.7-rustsec-2021-0026.patch
new file mode 100644
index 0000000000..9a74b7b971
--- /dev/null
+++ b/gnu/packages/patches/rust-comrak-0.7-rustsec-2021-0026.patch
@@ -0,0 +1,41 @@
+From 285e9647c6d2f90d8cb7af543b14c986a8efa631 Mon Sep 17 00:00:00 2001
+From: Asherah Connor <ashe@kivikakk.ee>
+Date: Fri, 12 Feb 2021 21:15:29 +1100
+Subject: [PATCH] SECURITY: match unsafe prefixes case-insensitively
+
+Many thanks to Kouhei Morita for reporting this.
+
+Co-authored-by: Kouhei Morita <mrtc0@ssrf.in>
+---
+ src/lexer.pest |   2 +-
+ src/tests.rs   | 146 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 147 insertions(+), 1 deletion(-)
+
+diff --git a/src/lexer.pest b/src/lexer.pest
+index e97647c..7f6cd3f 100644
+--- a/src/lexer.pest
++++ b/src/lexer.pest
+@@ -55,4 +55,4 @@ table_start = { "|"? ~ table_marker ~ ("|" ~ table_marker)* 
~ "|"? ~ table_space
+ table_cell_end = { "|" ~ table_spacechar* ~ table_newline? }
+ table_row_end = { table_spacechar* ~ table_newline }
+
+-dangerous_url = { "data:" ~ !("png" | "gif" | "jpeg" | "webp") | 
"javascript:" | "vbscript:" | "file:" }
++dangerous_url = { ^"data:" ~ !(^"image/" ~ (^"png" | ^"gif" | ^"jpeg" | 
^"webp")) | ^"javascript:" | ^"vbscript:" | ^"file:" }
+diff --git a/src/tests.rs b/src/tests.rs
+index c61a493..5f3e0cc 100644
+--- a/src/tests.rs
++++ b/src/tests.rs
+@@ -998,3 +998,11 @@ fn description_lists() {
+         ),
+     );
+ }
++
++#[test]
++fn case_insensitive_safety() {
++    html(
++        "[a](javascript:a) [b](Javascript:b) [c](jaVascript:c) [d](data:xyz) 
[e](Data:xyz) [f](vbscripT:f) [g](FILE:g)\n",
++        "<p><a href=\"\">a</a> <a href=\"\">b</a> <a href=\"\">c</a> <a 
href=\"\">d</a> <a href=\"\">e</a> <a href=\"\">f</a> <a href=\"\">g</a></p>\n",
++    );
++}
+--
+2.30.1
-- 
2.30.2