From 033648ba159ad4b05bf1078ed8ec0943e042c8f3 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 28 May 2026 16:38:23 +0900 Subject: [PATCH] Backport 0.9.41 / 0.9.44 fixes for possible path traversal issues --- rubygem-yard.spec | 15 +- yard-0.9.41-fix-possible-path-traversal.patch | 53 ++++++ yard-0.9.44-fix-possible-path-traversal.patch | 153 ++++++++++++++++++ 3 files changed, 220 insertions(+), 1 deletion(-) create mode 100644 yard-0.9.41-fix-possible-path-traversal.patch create mode 100644 yard-0.9.44-fix-possible-path-traversal.patch diff --git a/rubygem-yard.spec b/rubygem-yard.spec index 065160c..99c32f2 100644 --- a/rubygem-yard.spec +++ b/rubygem-yard.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 0.9.40 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Documentation tool for consistent and usable documentation in Ruby @@ -20,6 +20,12 @@ Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem Source1: %{gem_name}-%{version}-test-missing-files.tar.gz # Source1 is created by $ bash %%SOURCE2 %%version Source2: yard-create-missing-test-files.sh +# https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8 +# https://github.com/lsegal/yard/commit/f78c19f0dd33a407085b4ed181bb60c0aa0078b4 +Patch1: yard-0.9.44-fix-possible-path-traversal.patch +# https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj +# https://github.com/sysfce2/ruby-yard/commit/bdbff11302a035ce948d8ddad804c362c31c5be1 +Patch2: yard-0.9.41-fix-possible-path-traversal.patch # The 'irb/notifier' might be required for parsing of some old Ruby code. # https://github.com/lsegal/yard/blob/v0.9.24/lib/yard/parser/ruby/legacy/irb/slex.rb#L13 @@ -58,6 +64,8 @@ Documentation for %{name}. %prep %setup -q -n %{gem_name}-%{version} -b1 +%patch -P1 -p1 +%patch -P2 -p1 mv ../%{gem_name}-%{version}.gemspec . %build @@ -112,6 +120,11 @@ rspec -r spec_helper spec %doc %{gem_instdir}/docs/ %changelog +* Thu May 28 2026 Mamoru TASAKA - 0.9.40-2 +- Backport 0.9.41 / 0.9.44 fixes for possible path traversal issues +- https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj +- https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8 + * Mon Apr 13 2026 Mamoru TASAKA - 0.9.40-1 - 0.9.40 diff --git a/yard-0.9.41-fix-possible-path-traversal.patch b/yard-0.9.41-fix-possible-path-traversal.patch new file mode 100644 index 0000000..cc8d812 --- /dev/null +++ b/yard-0.9.41-fix-possible-path-traversal.patch @@ -0,0 +1,53 @@ +From bdbff11302a035ce948d8ddad804c362c31c5be1 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Thu, 16 Apr 2026 10:44:19 -0700 +Subject: [PATCH] Fix possible path traversal with document_root set in yard + server + +See [GHSA-xfhh-rx56-rxcr](https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr) + +Closes #1448 +--- + CHANGELOG.md | 2 ++ + lib/yard/server/commands/base.rb | 2 +- + spec/server/commands/base_spec.rb | 6 ++++++ + 3 files changed, 9 insertions(+), 1 deletion(-) + +@@ -11,6 +12,7 @@ + - Add support for `rdoc-image:...` syntax in HybridMarkup (#1676) + - Add support for colon suffix code blocks in HybridMarkup (rdoc compatibility) + - Fix responsiveness and state issues with nav frame links in `yard server` ++ + # [0.9.40] - April 12th, 2026 + + [0.9.40]: https://github.com/lsegal/yard/compare/v0.9.39...v0.9.40 +diff --git a/lib/yard/server/commands/base.rb b/lib/yard/server/commands/base.rb +index ef9d83f3a..c7d207cb3 100644 +--- a/lib/yard/server/commands/base.rb ++++ b/lib/yard/server/commands/base.rb +@@ -88,7 +88,7 @@ def initialize(opts = {}) + # of status, headers, and body wrapped in an array. + def call(request) + self.request = request +- self.path ||= request.path_info[1..-1] ++ self.path ||= File.cleanpath(request.path_info[1..-1]) + self.headers = {'Content-Type' => 'text/html'} + self.body = '' + self.status = 200 +diff --git a/spec/server/commands/base_spec.rb b/spec/server/commands/base_spec.rb +index 82c9e3096..c1726845c 100644 +--- a/spec/server/commands/base_spec.rb ++++ b/spec/server/commands/base_spec.rb +@@ -48,6 +48,12 @@ def run; cache 'foo' end + end + + describe "#call" do ++ it "sanitizes path_info" do ++ cmd = MyProcCommand.new { self.body = path } ++ _, _, b = *cmd.call(mock_request('/../../a/b/c')) ++ expect(b).to eq ['a/b/c'] ++ end ++ + it "handles a NotFoundError and use message as body" do + cmd = MyProcCommand.new { raise NotFoundError, "hello world" } + s, _, b = *cmd.call(mock_request('/foo')) diff --git a/yard-0.9.44-fix-possible-path-traversal.patch b/yard-0.9.44-fix-possible-path-traversal.patch new file mode 100644 index 0000000..0b6bef7 --- /dev/null +++ b/yard-0.9.44-fix-possible-path-traversal.patch @@ -0,0 +1,153 @@ +From f78c19f0dd33a407085b4ed181bb60c0aa0078b4 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Mon, 25 May 2026 12:49:29 -0700 +Subject: [PATCH] Fix possible path traversal in StaticCaching + +Fixes [GHSA-pxcc-8665-phx8](https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8) +--- + lib/yard/server/commands/base.rb | 12 +++------ + lib/yard/server/static_caching.rb | 41 ++++++++++++++++++++++++++---- + spec/server/commands/base_spec.rb | 7 +++++ + spec/server/static_caching_spec.rb | 6 +++++ + 4 files changed, 52 insertions(+), 14 deletions(-) + +diff --git a/lib/yard/server/commands/base.rb b/lib/yard/server/commands/base.rb +index c7d207cb3..9739b4c9c 100644 +--- a/lib/yard/server/commands/base.rb ++++ b/lib/yard/server/commands/base.rb +@@ -1,6 +1,4 @@ + # frozen_string_literal: true +-require 'fileutils' +- + module YARD + module Server + module Commands +@@ -32,6 +30,8 @@ module Commands + # @abstract + # @see #run + class Base ++ include StaticCaching ++ + # @group Basic Command and Adapter Options + + # @return [Hash] the options passed to the command's constructor +@@ -163,13 +163,7 @@ def render(object = nil) + # @return [String] the same cached data (for chaining) + # @see StaticCaching + def cache(data) +- if caching && adapter.document_root +- path = File.join(adapter.document_root, request.path_info.sub(/\.html$/, '') + '.html') +- path = path.sub(%r{/\.html$}, '.html') +- FileUtils.mkdir_p(File.dirname(path)) +- log.debug "Caching data to #{path}" +- File.open(path, 'wb') {|f| f.write(data) } +- end ++ super if caching + self.body = data + end + +diff --git a/lib/yard/server/static_caching.rb b/lib/yard/server/static_caching.rb +index ca43b15ac..f91fcd825 100644 +--- a/lib/yard/server/static_caching.rb ++++ b/lib/yard/server/static_caching.rb +@@ -1,4 +1,6 @@ + # frozen_string_literal: true ++require 'fileutils' ++ + module YARD + module Server + # Implements static caching for requests. +@@ -10,9 +12,8 @@ module StaticCaching + # implement your own +#check_static_cache+ method and mix the module into + # the Router class. + # +- # Note that caching does not occur here. This method simply checks for +- # the existence of cached data. To actually cache a response, see +- # {Commands::Base#cache}. ++ # This method checks for the existence of cached data. To actually cache ++ # a response, see {#cache}. + # + # @example Implementing In-Memory Cache Checking + # module MemoryCaching +@@ -33,14 +34,44 @@ module StaticCaching + # @see Commands::Base#cache + def check_static_cache + return nil unless adapter.document_root +- cache_path = File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') +- cache_path = cache_path.sub(%r{/\.html$}, '.html') ++ cache_path = cache_path(request.path) ++ return nil unless cache_path ++ + if File.file?(cache_path) + log.debug "Loading cache from disk: #{cache_path}" + return [200, {'Content-Type' => 'text/html'}, [File.read_binary(cache_path)]] + end + nil + end ++ ++ # Caches rendered HTML response data to disk. ++ # ++ # @param [String] data the data to cache ++ # @return [void] ++ # @since 0.9.44 ++ def cache(data) ++ return unless adapter.document_root ++ ++ path = cache_path(request.path_info) ++ return unless path ++ ++ FileUtils.mkdir_p(File.dirname(path)) ++ log.debug "Caching data to #{path}" ++ File.open(path, 'wb') {|f| f.write(data) } ++ end ++ ++ private ++ ++ def cache_path(request_path) ++ return nil if request_path.split(/[\/\\]/).include?('..') ++ ++ path = request_path.sub(/\.html$/, '') + '.html' ++ path = path.sub(%r{\A/+}, '') ++ return nil if path =~ /\A[A-Za-z]:/ ++ ++ path = File.cleanpath(path) ++ File.join(adapter.document_root, path) ++ end + end + end + end +diff --git a/spec/server/commands/base_spec.rb b/spec/server/commands/base_spec.rb +index c1726845c..568dda778 100644 +--- a/spec/server/commands/base_spec.rb ++++ b/spec/server/commands/base_spec.rb +@@ -36,6 +36,13 @@ def run; cache 'foo' end + @command.request.path_info = '/path/to/file.html' + @command.run + end ++ ++ it "does not cache paths containing parent directory components" do ++ expect(FileUtils).not_to receive(:mkdir_p) ++ expect(File).not_to receive(:open) ++ @command.request.path_info = '/../path/to/file.html' ++ @command.run ++ end + end + + describe "#redirect" do +diff --git a/spec/server/static_caching_spec.rb b/spec/server/static_caching_spec.rb +index 57960e6dd..724741e43 100644 +--- a/spec/server/static_caching_spec.rb ++++ b/spec/server/static_caching_spec.rb +@@ -37,6 +37,12 @@ def request; @request ||= MockRequest.new end + expect(check_static_cache).to eq nil + end + ++ it "does not read paths containing parent directory components" do ++ request.path_info = '/../secret' ++ expect(File).not_to receive(:file?) ++ expect(check_static_cache).to eq nil ++ end ++ + it "adds mount point to cache location" do + request.path_info = '/hello/world.html' + request.script_name = '/mount/point'