diff --git a/rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch b/rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch new file mode 100644 index 0000000..78633ae --- /dev/null +++ b/rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch @@ -0,0 +1,48 @@ +From b0217b3e30dc53d057b1682506333335975e62b4 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Thu, 23 Nov 2017 13:34:33 -0800 +Subject: [PATCH] Disallow relative paths that start with ../ + +Fixes a potential arbitrary file read vulnerability in yard server. +Thanks to ztz for discovery of this security issue. +--- + lib/yard/core_ext/file.rb | 2 ++ + spec/core_ext/file_spec.rb | 6 +++--- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb +index 3902f2bd..a0b983e9 100644 +--- a/lib/yard/core_ext/file.rb ++++ b/lib/yard/core_ext/file.rb +@@ -39,6 +39,8 @@ class File + if comp == RELATIVE_PARENTDIR && acc.size > 0 && acc.last != RELATIVE_PARENTDIR + acc.pop + next acc ++ elsif comp == RELATIVE_PARENTDIR && acc.empty? ++ next acc + end + acc << comp + end +diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb +index f61081f6..15806360 100644 +--- a/spec/core_ext/file_spec.rb ++++ b/spec/core_ext/file_spec.rb +@@ -41,12 +41,12 @@ RSpec.describe File do + File.cleanpath('A/B/C/D/..').should == "A/B/C" + end + +- it "should pass the initial directory" do +- File.cleanpath('C/../../D').should == "../D" ++ it "does not allow relative path above root" do ++ File.cleanpath('A/../../../../../D').should == "D" + end + + it "should not remove multiple '../' at the beginning" do +- File.cleanpath('../../A/B').should == '../../A/B' ++ File.cleanpath('../../A/B').should == 'A/B' + end + end + +-- +2.15.1 + diff --git a/rubygem-yard-0.9.11-Fix-broken-tests.patch b/rubygem-yard-0.9.11-Fix-broken-tests.patch new file mode 100644 index 0000000..ef9db13 --- /dev/null +++ b/rubygem-yard-0.9.11-Fix-broken-tests.patch @@ -0,0 +1,65 @@ +From 3bcccf678040e827f706b8305456424aa83f6471 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Thu, 23 Nov 2017 13:47:35 -0800 +Subject: [PATCH] Fix broken tests + +--- + lib/yard/cli/yardoc.rb | 2 +- + lib/yard/core_ext/file.rb | 5 +++-- + spec/core_ext/file_spec.rb | 4 ++++ + 3 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/lib/yard/cli/yardoc.rb b/lib/yard/cli/yardoc.rb +index a2918a36..f40e4dd1 100644 +--- a/lib/yard/cli/yardoc.rb ++++ b/lib/yard/cli/yardoc.rb +@@ -640,7 +640,7 @@ module YARD + opts.on('--asset FROM[:TO]', 'A file or directory to copy over to output ', + ' directory after generating') do |asset| + re = /^(?:\.\.\/|\/)/ +- from, to = *asset.split(':').map {|f| File.cleanpath(f) } ++ from, to = *asset.split(':').map {|f| File.cleanpath(f, true) } + to ||= from + if from =~ re || to =~ re + log.warn "Invalid file '#{asset}'" +diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb +index a0b983e9..c918b5af 100644 +--- a/lib/yard/core_ext/file.rb ++++ b/lib/yard/core_ext/file.rb +@@ -31,15 +31,16 @@ class File + # @example Clean a path + # File.cleanpath('a/b//./c/../e') # => "a/b/e" + # @param [String] path the path to clean ++ # @param [Boolean] rel_root allows relative path above root value + # @return [String] the sanitized path +- def self.cleanpath(path) ++ def self.cleanpath(path, rel_root = false) + path = path.split(SEPARATOR) + path = path.inject([]) do |acc, comp| + next acc if comp == RELATIVE_SAMEDIR + if comp == RELATIVE_PARENTDIR && acc.size > 0 && acc.last != RELATIVE_PARENTDIR + acc.pop + next acc +- elsif comp == RELATIVE_PARENTDIR && acc.empty? ++ elsif !rel_root && comp == RELATIVE_PARENTDIR && acc.empty? + next acc + end + acc << comp +diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb +index 15806360..e3d3930c 100644 +--- a/spec/core_ext/file_spec.rb ++++ b/spec/core_ext/file_spec.rb +@@ -41,6 +41,10 @@ RSpec.describe File do + File.cleanpath('A/B/C/D/..').should == "A/B/C" + end + ++ it "allows '../' at the beginning if rel_root=true" do ++ expect(File.cleanpath('A/../../B', true)).to eq '../B' ++ end ++ + it "does not allow relative path above root" do + File.cleanpath('A/../../../../../D').should == "D" + end +-- +2.15.1 + diff --git a/rubygem-yard.spec b/rubygem-yard.spec index 4e1ea7f..49da744 100644 --- a/rubygem-yard.spec +++ b/rubygem-yard.spec @@ -2,12 +2,17 @@ Name: rubygem-%{gem_name} Version: 0.8.7.6 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Documentation tool for consistent and usable documentation in Ruby Group: Development/Languages License: MIT and (BSD or Ruby) URL: http://yardoc.org Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem +# Fix to directory traversal attacks (CVE-2017-17042) +# https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4 +Patch1: rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch +# https://github.com/lsegal/yard/commit/3bcccf678040e827f706b8305456424aa83f6471 +Patch2: rubygem-yard-0.9.11-Fix-broken-tests.patch BuildRequires: ruby(release) BuildRequires: rubygems-devel BuildRequires: ruby @@ -41,6 +46,11 @@ Documentation for %{name}. %setup -q -T -c %gem_install -n %{SOURCE0} +pushd .%{gem_instdir} +%patch1 -p1 +%patch2 -p1 +popd + %build %install @@ -93,6 +103,9 @@ popd %changelog +* Fri Dec 01 2017 Vít Ondruch - 0.8.7.6-4 +- Fix to directory traversal attacks (CVE-2017-17042). + * Wed May 25 2016 Jun Aruga - 0.8.7.6-3 - Fix test suite for Ruby 2.3 compatibility. (rhbz#1308100)