From 9ca95b3363ba37b126bee7c927b03fd9f5a7bae7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Fri, 1 Dec 2017 19:52:01 +0100 Subject: [PATCH 1/2] Fix to directory traversal attacks (CVE-2017-17042). --- ...allow-relative-paths-that-start-with.patch | 48 ++++++++++++++ rubygem-yard-0.9.11-Fix-broken-tests.patch | 65 +++++++++++++++++++ rubygem-yard.spec | 12 +++- 3 files changed, 124 insertions(+), 1 deletion(-) create mode 100644 rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch create mode 100644 rubygem-yard-0.9.11-Fix-broken-tests.patch diff --git a/rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch b/rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch new file mode 100644 index 0000000..8da75c0 --- /dev/null +++ b/rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch @@ -0,0 +1,48 @@ +From b0217b3e30dc53d057b1682506333335975e62b4 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Thu, 23 Nov 2017 13:34:33 -0800 +Subject: [PATCH] Disallow relative paths that start with ../ + +Fixes a potential arbitrary file read vulnerability in yard server. +Thanks to ztz for discovery of this security issue. +--- + lib/yard/core_ext/file.rb | 2 ++ + spec/core_ext/file_spec.rb | 6 +++--- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb +index 3902f2bd..a0b983e9 100644 +--- a/lib/yard/core_ext/file.rb ++++ b/lib/yard/core_ext/file.rb +@@ -40,6 +40,8 @@ class File + if comp == RELATIVE_PARENTDIR && !acc.empty? && acc.last != RELATIVE_PARENTDIR + acc.pop + next acc ++ elsif comp == RELATIVE_PARENTDIR && acc.empty? ++ next acc + end + acc << comp + end +diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb +index f61081f6..15806360 100644 +--- a/spec/core_ext/file_spec.rb ++++ b/spec/core_ext/file_spec.rb +@@ -41,12 +41,12 @@ RSpec.describe File do + expect(File.cleanpath('A/B/C/D/..')).to eq "A/B/C" + end + +- it "passes the initial directory" do +- expect(File.cleanpath('C/../../D')).to eq "../D" ++ it "does not allow relative path above root" do ++ expect(File.cleanpath('A/../../../../../D')).to eq "D" + end + + it "does not remove multiple '../' at the beginning" do +- expect(File.cleanpath('../../A/B')).to eq '../../A/B' ++ expect(File.cleanpath('../../A/B')).to eq 'A/B' + end + end + +-- +2.15.1 + diff --git a/rubygem-yard-0.9.11-Fix-broken-tests.patch b/rubygem-yard-0.9.11-Fix-broken-tests.patch new file mode 100644 index 0000000..9da9052 --- /dev/null +++ b/rubygem-yard-0.9.11-Fix-broken-tests.patch @@ -0,0 +1,65 @@ +From 3bcccf678040e827f706b8305456424aa83f6471 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Thu, 23 Nov 2017 13:47:35 -0800 +Subject: [PATCH] Fix broken tests + +--- + lib/yard/cli/yardoc.rb | 2 +- + lib/yard/core_ext/file.rb | 5 +++-- + spec/core_ext/file_spec.rb | 4 ++++ + 3 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/lib/yard/cli/yardoc.rb b/lib/yard/cli/yardoc.rb +index a2918a36..f40e4dd1 100644 +--- a/lib/yard/cli/yardoc.rb ++++ b/lib/yard/cli/yardoc.rb +@@ -659,7 +659,7 @@ module YARD + opts.on('--asset FROM[:TO]', 'A file or directory to copy over to output ', + ' directory after generating') do |asset| + re = %r{^(?:\.\./|/)} +- from, to = *asset.split(':').map {|f| File.cleanpath(f) } ++ from, to = *asset.split(':').map {|f| File.cleanpath(f, true) } + to ||= from + if from =~ re || to =~ re + log.warn "Invalid file '#{asset}'" +diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb +index a0b983e9..c918b5af 100644 +--- a/lib/yard/core_ext/file.rb ++++ b/lib/yard/core_ext/file.rb +@@ -32,15 +32,16 @@ class File + # @example Clean a path + # File.cleanpath('a/b//./c/../e') # => "a/b/e" + # @param [String] path the path to clean ++ # @param [Boolean] rel_root allows relative path above root value + # @return [String] the sanitized path +- def self.cleanpath(path) ++ def self.cleanpath(path, rel_root = false) + path = path.split(SEPARATOR) + path = path.inject([]) do |acc, comp| + next acc if comp == RELATIVE_SAMEDIR + if comp == RELATIVE_PARENTDIR && !acc.empty? && acc.last != RELATIVE_PARENTDIR + acc.pop + next acc +- elsif comp == RELATIVE_PARENTDIR && acc.empty? ++ elsif !rel_root && comp == RELATIVE_PARENTDIR && acc.empty? + next acc + end + acc << comp +diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb +index 15806360..e3d3930c 100644 +--- a/spec/core_ext/file_spec.rb ++++ b/spec/core_ext/file_spec.rb +@@ -41,6 +41,10 @@ RSpec.describe File do + expect(File.cleanpath('A/B/C/D/..')).to eq "A/B/C" + end + ++ it "allows '../' at the beginning if rel_root=true" do ++ expect(File.cleanpath('A/../../B', true)).to eq '../B' ++ end ++ + it "does not allow relative path above root" do + expect(File.cleanpath('A/../../../../../D')).to eq "D" + end +-- +2.15.1 + diff --git a/rubygem-yard.spec b/rubygem-yard.spec index 96868ce..5f182f0 100644 --- a/rubygem-yard.spec +++ b/rubygem-yard.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 0.9.8 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Documentation tool for consistent and usable documentation in Ruby Group: Development/Languages License: MIT and (BSD or Ruby) @@ -12,6 +12,11 @@ Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem # https://github.com/lsegal/yard/pull/1057 # https://github.com/lsegal/yard/commit/2d1e9f3b7696a45ed8e48a624a33d662cb99e5cb Patch0: pry-0.9.8-Replace-deprecated-TRUE-and-FALSE-constants-with-their-equivalents.patch +# Fix to directory traversal attacks (CVE-2017-17042) +# https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4 +Patch1: rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch +# https://github.com/lsegal/yard/commit/3bcccf678040e827f706b8305456424aa83f6471 +Patch2: rubygem-yard-0.9.11-Fix-broken-tests.patch BuildRequires: ruby(release) BuildRequires: rubygems-devel BuildRequires: ruby @@ -43,6 +48,8 @@ Documentation for %{name}. pushd .%{gem_instdir} %patch0 -p1 +%patch1 -p1 +%patch2 -p1 popd %build @@ -97,6 +104,9 @@ popd %changelog +* Fri Dec 01 2017 Vít Ondruch - 0.9.8-4 +- Fix to directory traversal attacks (CVE-2017-17042). + * Thu Jul 27 2017 Fedora Release Engineering - 0.9.8-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild From 94d0a7c009782d425445993569f2534feb888d60 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Fri, 1 Dec 2017 20:07:46 +0100 Subject: [PATCH 2/2] Apply the patch cleanly. --- rubygem-yard-0.9.11-Fix-broken-tests.patch | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rubygem-yard-0.9.11-Fix-broken-tests.patch b/rubygem-yard-0.9.11-Fix-broken-tests.patch index 9da9052..3506265 100644 --- a/rubygem-yard-0.9.11-Fix-broken-tests.patch +++ b/rubygem-yard-0.9.11-Fix-broken-tests.patch @@ -13,7 +13,7 @@ diff --git a/lib/yard/cli/yardoc.rb b/lib/yard/cli/yardoc.rb index a2918a36..f40e4dd1 100644 --- a/lib/yard/cli/yardoc.rb +++ b/lib/yard/cli/yardoc.rb -@@ -659,7 +659,7 @@ module YARD +@@ -649,7 +649,7 @@ module YARD opts.on('--asset FROM[:TO]', 'A file or directory to copy over to output ', ' directory after generating') do |asset| re = %r{^(?:\.\./|/)}