[rpms/cups-filters] rawhide: Reject FoomaticRIPOption values as well

[rpms/cups-filters] rawhide: Reject FoomaticRIPOption values as well

[Zdenek Dohnal]

            A new commit has been pushed.

            Repo   : rpms/cups-filters
            Branch : rawhide
            Commit : d718f04268b35439c643ad9be3aba60271635ddc
            Author : Zdenek Dohnal <zdohnal@redhat.com>
            Date   : 2026-09-01T10:03:52+02:00
            Stats  : +242/-23 in 2 file(s)
            URL    : https://src.fedoraproject.org/rpms/cups-filters/c/d718f04268b35439c643ad9be3aba60271635ddc?branch=rawhide

            Log:
            Reject FoomaticRIPOption values as well

As for component hardening foomatic-hash scans for FoomaticRIPOption
values as well, and foomatic-rip filter rejects them unless they are
defined in configuration (in files in /etc/foomatic/hashes.d) as safe.

---
diff --git a/0001-foomatic-rip-Reject-options-defined-by-FoomaticRIPOp.patch b/0001-foomatic-rip-Reject-options-defined-by-FoomaticRIPOp.patch
new file mode 100644
index 0000000..6f9180c
--- /dev/null
+++ b/0001-foomatic-rip-Reject-options-defined-by-FoomaticRIPOp.patch
@@ -0,0 +1,225 @@
+From 82acfaf1e1515555d570638875b819a213095b50 Mon Sep 17 00:00:00 2001
+From: zdohnal <zdohnal@redhat.com>
+Date: Tue, 11 Aug 2026 14:52:03 +0200
+Subject: [PATCH] foomatic-rip: Reject options defined by FoomaticRIPOption
+ (#719)
+
+Scan and hash functionality now supports options of CmdLine type
+defined by FoomaticRIPOption, and any unknown values of such options are
+rejected.
+
+Assisted-by: Claude Code by Anthropic
+---
+ filter/foomatic-rip/foomatic-hash.1   |  2 +-
+ filter/foomatic-rip/foomatic-hash.c   | 69 ++++++++++++++++++++++-----
+ filter/foomatic-rip/foomatic-rip.1.in |  5 +-
+ filter/foomatic-rip/options.c         | 12 +++++
+ 4 files changed, 72 insertions(+), 16 deletions(-)
+
+diff --git a/filter/foomatic-rip/foomatic-hash.1 b/filter/foomatic-rip/foomatic-hash.1
+index d53919838..0f5ea9989 100644
+--- a/filter/foomatic-rip/foomatic-hash.1
++++ b/filter/foomatic-rip/foomatic-hash.1
+@@ -23,7 +23,7 @@ foomatic-hash - tool for scanning provided drivers for problematic PPD options a
+ 
+ .SH "DESCRIPTION"
+ 
+-The tool scans the provided drivers for values of PPD keywords \fBFoomaticRIPCommandLine\fR, \fBFoomaticRIPCommandLinePDF\fR, and \fBFoomaticRIPOptionSetting\fR, puts the found values into a file for review, and prints out values hashes in hexadecimal format. The hashes are required for allowing the filter \fBfoomatic-rip\fR to process those values.
++The tool scans the provided drivers for values of PPD keywords \fBFoomaticRIPCommandLine\fR, \fBFoomaticRIPCommandLinePDF\fR, \fBFoomaticRIPOptionSetting\fR, and standard PPD option values for CmdLine-type options declared via \fBFoomaticRIPOption\fR. It puts the found values into a file for review and prints out value hashes in hexadecimal format. The hashes are required for allowing the filter \fBfoomatic-rip\fR to process those values.
+ 
+ 
+ .SH "OPTIONS"
+diff --git a/filter/foomatic-rip/foomatic-hash.c b/filter/foomatic-rip/foomatic-hash.c
+index 4fcffb6c9..f3068cf71 100644
+--- a/filter/foomatic-rip/foomatic-hash.c
++++ b/filter/foomatic-rip/foomatic-hash.c
+@@ -11,7 +11,8 @@
+ // The options in question:
+ // - FoomaticRIPCommandLine,
+ // - FoomaticRIPCommandLinePDF,
+-// - FoomaticRIPOptionSetting.
++// - FoomaticRIPOptionSetting,
++// - standard PPD option values for CmdLine-type options defined by FoomaticRIPOption.
+ //
+ // Licensed under Apache License v2.0.  See the file "LICENSE" for more
+ // information.
+@@ -131,11 +132,11 @@ generate_hash_file(cups_array_t *values, // I - File with values to hash
+ 
+ //
+ // `find_foomaticrip_keywords()` - reads PPD file, find FoomaticRIPCommandLine,
+-// FoomaticRIPCommandLinePDF and FoomaticRIPOptionSetting, save their values
+-// into CUPS array.
++// FoomaticRIPCommandLinePDF, FoomaticRIPOptionSetting and standard PPD option
++// values for CmdLine-type options, save their values into CUPS array.
+ //
+ 
+-void
++int					      // O - 0 on success, 1 on error
+ find_foomaticrip_keywords(cups_array_t *data, // O - Array with values of FoomaticRIP* PPD keywords
+ 			  cups_file_t  *file) // I - File descriptor opened via CUPS API
+ {
+@@ -143,7 +144,9 @@ find_foomaticrip_keywords(cups_array_t *data, // O - Array with values of Foomat
+   char key[128],			      // PPD keyword
+        line[256],			      // PPD line length is max 255 (excl. \0)
+        name[64],			      // PPD option name
+-       text[64];			      // PPD option human-readable text
++       text[64],			      // PPD option human-readable text
++       style[16];			      // FoomaticRIPOption style field
++  cups_array_t *cmdline_opts = NULL;	      // Option names declared as CmdLine
+ 
+   //
+   // Allocate struct for saving value data dynamically,
+@@ -154,6 +157,19 @@ find_foomaticrip_keywords(cups_array_t *data, // O - Array with values of Foomat
+ 
+   dstrassure(value, 256);
+ 
++  //
++  // Track option names declared as CmdLine via FoomaticRIPOption...
++  //
++
++  if ((cmdline_opts = cupsArrayNew3((cups_array_func_t)strcmp, NULL, NULL, 0,
++				    (cups_acopy_func_t)strdup,
++				    (cups_afree_func_t)free)) == NULL)
++  {
++    fprintf(stderr, "Cannot allocate memory for CmdLine option tracking.\n");
++    free_dstr(value);
++    return (1);
++  }
++
+   //
+   // Going through the PPD file...
+   //
+@@ -243,11 +259,30 @@ find_foomaticrip_keywords(cups_array_t *data, // O - Array with values of Foomat
+       }
+     }
+ 
++    //
++    // If this is a FoomaticRIPOption declaration, check whether it defines
++    // a CmdLine-type option and remember the option name for later...
++    //
++
++    if (!strcmp(key, "FoomaticRIPOption"))
++    {
++      style[0] = '\0';
++      sscanf(value->data, "%*s %15s", style);
++
++      if (!strcmp(style, "CmdLine") && name[0])
++	cupsArrayAdd(cmdline_opts, name);
++
++      continue;
++    }
++
+     //
+     // Skip if the key is not what we look for...
+     //
+ 
+-    if (strcmp(key, "FoomaticRIPCommandLine") && strcmp(key, "FoomaticRIPCommandLinePDF") && strcmp(key, "FoomaticRIPOptionSetting"))
++    if (strcmp(key, "FoomaticRIPCommandLine") &&
++	strcmp(key, "FoomaticRIPCommandLinePDF") &&
++	strcmp(key, "FoomaticRIPOptionSetting") &&
++	!cupsArrayFind(cmdline_opts, key))
+       continue;
+ 
+     //
+@@ -289,7 +324,10 @@ find_foomaticrip_keywords(cups_array_t *data, // O - Array with values of Foomat
+       cupsArrayAdd(data, value->data);
+   }
+ 
++  cupsArrayDelete(cmdline_opts);
+   free_dstr(value);
++
++  return (0);
+ }
+ 
+ 
+@@ -314,7 +352,7 @@ get_values_from_ppd(cups_array_t *data,     // O - Array of found FoomaticRIP* v
+     return (1);
+   }
+ 
+-  find_foomaticrip_keywords(data, file);
++  ret = find_foomaticrip_keywords(data, file);
+ 
+   cupsFileClose(file);
+ 
+@@ -445,7 +483,11 @@ get_values_from_ppdpaths(cups_array_t *data,     // O - Array of found values
+     if ((ppdfile = ppdCollectionGetPPD(ppd->record.name, ppd_collections, NULL, NULL)) == NULL)
+       continue;
+ 
+-    find_foomaticrip_keywords(data, ppdfile);
++    if ((ret = find_foomaticrip_keywords(data, ppdfile)))
++    {
++      cupsFileClose(ppdfile);
++      goto end;
++    }
+ 
+     cupsFileClose(ppdfile);
+   }
+@@ -475,9 +517,10 @@ help()
+ 	 "foomatic-hash --ppd <ppdfile> <scanoutput> <hashes_file>\n"
+ 	 "foomatic-hash --ppd-paths <path1,path2...pathN> <scanoutput> <hashes_file>\n"
+ 	 "\n"
+-	 "Finds values of FoomaticRIPCommandLine, FoomaticRIPPDFCommandLine\n"
+-	 "and FoomaticRIPOptionSetting from the specified PPDs, appends them\n"
+-	 "into the specified scan output for review, and hashes the found values.\n"
++	 "Finds values of FoomaticRIPCommandLine, FoomaticRIPPDFCommandLine,\n"
++	 "FoomaticRIPOptionSetting and standard PPD option values for CmdLine-type\n"
++	 "options (declared via FoomaticRIPOption) from the specified PPDs, appends\n"
++	 "them into the specified scan output for review, and hashes the found values.\n"
+ 	 "\n"
+ 	 "--ppd <ppdfile>                   - PPD file to read\n"
+ 	 "--ppd-paths <path1,path2...pathN> - Paths to look for PPDs, available only with libppd\n"
+@@ -530,8 +573,8 @@ main(int argc,
+   }
+ 
+   //
+-  // Write found values of FoomaticRIPCommandLine, FoomaticRIPPDFCommandLine and FoomaticRIPOptionSetting
+-  // PPD keywords...
++  // Write found values of FoomaticRIPCommandLine, FoomaticRIPPDFCommandLine,
++  // FoomaticRIPOptionSetting and CmdLine option values...
+   //
+ 
+   write_array(data, argv[3]);
+diff --git a/filter/foomatic-rip/foomatic-rip.1.in b/filter/foomatic-rip/foomatic-rip.1.in
+index 3dff5215f..272d06a31 100644
+--- a/filter/foomatic-rip/foomatic-rip.1.in
++++ b/filter/foomatic-rip/foomatic-rip.1.in
+@@ -195,10 +195,11 @@ modern shell like \fBbash\fR, \fBzsh\fR, or \fBksh\fR.
+ 
+ .SH PPD OPTION VALUE RESTRICTIONS AND EXCEPTIONS
+ 
+-The values of PPD options \fBFoomaticRIPCommandLine\fR, \fBFoomaticRIPCommandLinePDF\fR and \fBFoomaticRIPOptionSetting\fR
++The values of PPD options \fBFoomaticRIPCommandLine\fR, \fBFoomaticRIPCommandLinePDF\fR, \fBFoomaticRIPOptionSetting\fR
++and standard PPD option values for CmdLine-type options declared via \fBFoomaticRIPOption\fR
+ are rejected in the default configuration because of security implications. Users can use the tool \fBfoomatic-hash(1)\fR, which provides
+ values of affected PPD options from found drivers and hashes of those values in hexadecimal format. User is expected to review the found values,
+-and if there is nothing suspicious in the output, copy the file with hashes into into the directory \fB@sysconfdir@/foomatic/hashes.d\fR
++and if there is nothing suspicious in the output, copy the file with hashes into the directory \fB@sysconfdir@/foomatic/hashes.d\fR
+ to allow the exceptions for found values.
+ 
+ 
+diff --git a/filter/foomatic-rip/options.c b/filter/foomatic-rip/options.c
+index ca80e94bc..fd02a8bc6 100644
+--- a/filter/foomatic-rip/options.c
++++ b/filter/foomatic-rip/options.c
+@@ -2156,6 +2156,18 @@ read_ppd_file(const char *filename)
+     else if (current_opt && !strcmp(key, current_opt->name))
+     {
+       // *<option> <choice>[/translation]: <code>
++      if (current_opt->style == 'C' &&
++	  !is_allowed_value(known_hashes, value->data, strlen(value->data)))
++      {
++	cupsArrayDelete(known_hashes);
++	fclose(fh);
++
++	rip_die(EXIT_PRNERR_NOTALLOWED,
++		"ERROR: The value of option %s choice %s is not among "
++		"the allowed values - see foomatic-rip man page for "
++		"more instructions.\n", key, name);
++      }
++
+       option_set_choice(current_opt, name, text, value->data);
+     }
+     else if (!strcmp(key, "FoomaticRIPOptionSetting"))
+-- 
+2.55.0
+

diff --git a/cups-filters.spec b/cups-filters.spec
index bd3534a..accc27a 100644
--- a/cups-filters.spec
+++ b/cups-filters.spec
@@ -44,13 +44,10 @@ Patch003: foomatic-ripdie-error.patch
 Patch004: foomaticrip-reject-unknown-values.patch
 # CVE-2025-64524 fix
 Patch005: 0001-rastertopclx.c-Fix-infinite-loop-caused-by-crafted-f.patch
+# additional reject rule in foomatic-rip
+Patch006: 0001-foomatic-rip-Reject-options-defined-by-FoomaticRIPOp.patch
 
 
-# driverless backend/driver was moved into a separate package to
-# remove avahi dependency for filters
-# remove once C10S is released and F40 is EOL
-Conflicts: cups-filters-driverless < 1:2.0.0-3
-
 # autogen.sh
 BuildRequires: autoconf
 # autogen.sh
@@ -98,11 +95,6 @@ workflow introduced by OpenPrinting.
 Summary: OpenPrinting driverless backends and drivers for CUPS 2.X
 License: Apache-2.0 WITH LLVM-exception
 
-# backends and drivers has been moved from the main package to subpackage
-# to remove the avahi/mdns dependency needed for driverless
-# remove after F40 is EOL and C10S is released
-Conflicts: cups-filters < 1:2.0.0-3
-
 # finding device via driverless depends on running avahi-daemon
 Requires: avahi
 # ippfind is used in driverless backend, not needed classic PPD based print queue
@@ -130,7 +122,7 @@ queues.
 %prep
 %autosetup -S git -N
 
-%if 0%{?fedora} >= 43 || 0%{?rhel} >=9
+%if 0%{?fedora} >= 43 || 0%{?rhel} >= 9
 %autopatch
 %else
 %autopatch -M 3
@@ -159,29 +151,31 @@ queues.
 install -p -m 0755 %{SOURCE2} %{buildroot}%{_cups_serverbin}/filter/lftocrlf
 install -p -m 0644 %{SOURCE1} %{buildroot}%{_datadir}/ppd/cupsfilters/lftocrlf.ppd
 
-# remove this once F43 is EOL
-%if 0%{?fedora} >= 43 || 0%{?rhel} >=9
+# remove this once F44 is EOL and Centos 11 is forked
+# was to be removed in F43, but new corner case - FoomaticRipOption - was found.
+# So remove the code later
+%if 0%{?fedora} >= 43 || 0%{?rhel} >= 9
 
 mkdir -p %{buildroot}%{_libexecdir}/%{name}
 
 cat > %{buildroot}%{_libexecdir}/%{name}/posttrans.sh << EOF
 #!/usr/bin/bash
 
-if grep -q -R 'FoomaticRIPCommandLine\|FoomaticRipOptionSetting' %{_sysconfdir}/cups/ppd
+if grep -q -R 'FoomaticRIPCommandLine\|FoomaticRIPOptionSetting\|FoomaticRIPOption' %{_sysconfdir}/cups/ppd
 then
   tmpfile=\$(mktemp -p /var/tmp foomatic-scan.XXXXXXXX)
 
   for ppd in %{_sysconfdir}/cups/ppd/*.ppd
   do
-    foomatic-hash --ppd \$ppd \$tmpfile %{_sysconfdir}/foomatic/hashes.d/hashes.upgrade || :
+    foomatic-hash --ppd \$ppd \$tmpfile %{_sysconfdir}/foomatic/hashes.d/hashes.foomatic-opt-update || :
   done
 
-  if test -f %{_sysconfdir}/foomatic/hashes.d/hashes.upgrade
+  if test -f %{_sysconfdir}/foomatic/hashes.d/hashes.foomatic-opt-update
   then
     echo "Foomatic-rip values which can inject code found - review findings in \$tmpfile. Read release notes for instructions." || :
   fi
 else
-  touch %{_sysconfdir}/foomatic/hashes.d/hashes.new
+  touch %{_sysconfdir}/foomatic/hashes.d/hashes.foomatic-opt-update
 fi
 
 exit 0
@@ -193,7 +187,7 @@ cat > %{buildroot}%{_unitdir}/foomaticrip-upgrade.service << EOF
 [Unit]
 Description=Allowing already installed printers for foomatic-rip
 ConditionPathIsDirectory=%{_sysconfdir}/foomatic/hashes.d
-ConditionDirectoryNotEmpty=!%{_sysconfdir}/foomatic/hashes.d
+ConditionPathExists=!%{_sysconfdir}/foomatic/hashes.d/hashes.foomatic-opt-update
 
 [Service]
 Type=oneshot
@@ -248,25 +242,25 @@ then
   rm -f /var/cache/cups/ppds.dat || :
 fi
 
-%if 0%{?fedora} >= 43 || 0%{?rhel} >=9
+%if 0%{?fedora} >= 43 || 0%{?rhel} >= 9
   %systemd_post foomaticrip-upgrade.service
 %endif
 
 
 %preun
-%if 0%{?fedora} >= 43 || 0%{?rhel} >=9
+%if 0%{?fedora} >= 43 || 0%{?rhel} >= 9
   %systemd_preun foomaticrip-upgrade.service
 %endif
 
 
 %postun
-%if 0%{?fedora} >= 43 || 0%{?rhel} >=9
+%if 0%{?fedora} >= 43 || 0%{?rhel} >= 9
   %systemd_postun foomaticrip-upgrade.service
 %endif
 
 
 %posttrans
-%if 0%{?fedora} >= 43 || 0%{?rhel} >=9
+%if 0%{?fedora} >= 43 || 0%{?rhel} >= 9
   %systemd_posttrans_with_reload foomaticrip-upgrade.service
 %endif
 
@@ -280,7 +274,7 @@ then
     systemctl restart cups || :
   fi
 
-  %if 0%{?fedora} >= 43 || 0%{?rhel} >=9
+  %if 0%{?fedora} >= 43 || 0%{?rhel} >= 9
     systemctl start foomaticrip-upgrade.service || :
   %endif
 fi