Release Overview for 2.1.0

This page contains a high level description of the most notable changes in this release. For full details of user-visible changes, see the NEWS files in each module:

• xapian-core
• omega
• xapian-bindings

See also the full list of bug reports marked as fixed in this release.

C++ API

• MSet::snippet(): Fix missing escaping when parameters hi_start and hi_end are empty strings and text.size() <= length. This is essentially a missed corner case from ​CVE-2018-0499.

To be exploitable requires that hi_start and hi_end are empty, which is atypical usage in a web context (because highlighting search terms in snippets is very widespread and so expected by users), and searching FOSS code we didn't find any vulnerable usage. An attacker would also need to be able to supply content to the system, or find suitable content already in the system. Reported by Arpit Jain on the xapian-devel list.

• Xapian::Stem: New stemmers for Czech, Persian and Sesotho.

• Xapian::Stem: Minor changes to Danish, Early Modern English, Estonian, Finnish, German, Italian, Lithuanian, Norwegian and Polish stemmers.

• Fix segmentation fault when enquire.get_mset(0,0,x) is called with a collapse key set. Bug was introduced in Xapian 2.0.0. Fixes #852, reported by Antonio Rojas.

• We now prefer to generate a UUID for a new database from cryptographically secure random data on platforms which provide arc4random_buf(), arc4random() or getentropy(). Where supported, this has fewer drawbacks than other approaches: using libuuid requires an additional dependency; using /proc/sys/kernel/random/uuid works on Linux and Android, but requires /proc to be mounted, requires an unused fd to generate a UUID, and access to it is blocked by SELinux policy in Android < 9. Patch from Viktor Filinkov.

NB: If you're maintaining packages of xapian-core and currently building with libuuid, it's likely you can now drop this dependency.

Omega

• Fix date term filter for SPAN without START/END. In this case we're meant to use the current date as the end of the range, but were actually using the start of 1970. Bug introduced in 1.4.27. The value range filter case was unaffected by this bug. Fixes #853, reported by Darrin Smart.

• New worker module which indexes PostScript files using libspectre and libpoppler. Requires libspectre >= 0.2.12 (older versions had a bug which broke saving as a PDF file).

• omindex no longer assumes .ai files are PostScript since modern ones are PDF, so libmagic is used to determine their underlying type.