fix(cve): CVE-2026-10805 - libnm-sd-shared: reject urls containing unexpected characters

debian/changelog

@@ -1,3 +1,9 @@
+network-manager (1.44.2-7deepin11) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-10805
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 13:06:30 +0800
+
 network-manager (1.44.2-7deepin10) unstable; urgency=medium
 
   * Non-maintainer upload.

debian/patches/CVE-2026-10805.patch

@@ -0,0 +1,57 @@
+Description: CVE-2026-10805 - 安全修复
+Author: Jan Vaclav <jvaclav@redhat.com>
+Origin: https://gitlab.freedesktop.org/NetworkManager/NetworkManager/commit/5326760073c06157652b7e0d0865ada2eb0e393b
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-10805
+Last-Update: 2026-06-08
+---
+diff --git a/src/libnm-systemd-shared/nm-sd-utils-shared.c b/src/libnm-systemd-shared/nm-sd-utils-shared.c
+index dad2159..b51faeb 100644
+--- a/src/libnm-systemd-shared/nm-sd-utils-shared.c
++++ b/src/libnm-systemd-shared/nm-sd-utils-shared.c
+@@ -53,6 +53,20 @@ nm_sd_dns_name_normalize(const char *s)
+
+ /*****************************************************************************/
+
++static gboolean
++_http_url_is_valid_char(char ch)
++{
++    if (g_ascii_isalnum(ch))
++        return TRUE;
++
++    /* Allow symbols which are allowed by the URL standard, or unlikely
++     * to be problematic in this scenario. */
++    if (strchr(":/%=;&+|^`-._~?#<>{}[]@!$'()*, ", ch) != NULL)
++        return TRUE;
++
++    return FALSE;
++}
++
+ static gboolean
+ _http_url_is_valid(const char *url, gboolean only_https)
+ {
+@@ -69,7 +83,7 @@ _http_url_is_valid(const char *url, gboolean only_https)
+     if (!url[0])
+         return FALSE;
+
+-    return !NM_STRCHAR_ANY(url, ch, (guchar) ch >= 128u);
++    return NM_STRCHAR_ALL(url, ch, _http_url_is_valid_char(ch));
+ }
+
+ gboolean
+@@ -82,12 +96,13 @@ nm_sd_http_url_is_valid_https(const char *url)
+      * assert with http_url_is_valid() that the argument is valid. We thus must make
+      * sure to only pass URLs that are valid according to http_url_is_valid().
+      *
+-     * This is given, because our nm_sd_http_url_is_valid_https() is more strict
+-     * than http_url_is_valid().
++     * This is given, because our nm_sd_http_url_is_valid_https() is more restrictive
++     * than http_url_is_valid(). The assertion below checks that anything we accept,
++     * systemd must also accept.
+      *
+      * We only must make sure that this is also correct in the future, when we
+      * re-import systemd code. */
+-    nm_assert(_http_url_is_valid(url, FALSE) == http_url_is_valid(url));
++    nm_assert(!_http_url_is_valid(url, FALSE) || http_url_is_valid(url));
+     return _http_url_is_valid(url, TRUE);
+ }
+

debian/patches/series

@@ -13,3 +13,4 @@ uniontech004-add-autoresetretry-config.patch
 uniontech005-hotspot-retry-when-failure.patch
 uniontech004-update-unittest.patch
 uniontech006-add-preserve-dhcp.patch
+CVE-2026-10805.patch