From 8de23604a8f79a108a4707d52b0efddcf08bceb4 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Wed, 22 Apr 2026 11:52:52 +0900 Subject: [PATCH 1/4] 0.9.43 --- rubygem-yard.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/rubygem-yard.spec b/rubygem-yard.spec index 065160c..f38db63 100644 --- a/rubygem-yard.spec +++ b/rubygem-yard.spec @@ -1,7 +1,7 @@ %global gem_name yard Name: rubygem-%{gem_name} -Version: 0.9.40 +Version: 0.9.43 Release: 1%{?dist} Summary: Documentation tool for consistent and usable documentation in Ruby @@ -112,6 +112,9 @@ rspec -r spec_helper spec %doc %{gem_instdir}/docs/ %changelog +* Wed Apr 22 2026 Mamoru TASAKA - 0.9.43-1 +- 0.9.43 + * Mon Apr 13 2026 Mamoru TASAKA - 0.9.40-1 - 0.9.40 diff --git a/sources b/sources index afb25b5..b1a3468 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (yard-0.9.40.gem) = 5a14ff8b47724162086643829f5e96607415fe76d8b0a23419234bedbc0b9e866b7b2ca03d42f9bd12679f32381ac550653dd173f6e643c18a302439dd473629 -SHA512 (yard-0.9.40-test-missing-files.tar.gz) = b3724d3062b53d36e1c081a2c2bfaa3c422f0f5459a4770165bd09821202a164a27480d4cc96dec17116ba3c3b68b1ed9b9b956a81f0b9eb3cdbfbbaa285668c +SHA512 (yard-0.9.43.gem) = 2d880d924e6dc79e04fe1035dc2ebbbcda447002db92a3e605f3df327514b9d1aa1bbbbea66b826da2841858bd33e04ca9bdc088fd68215b60a02d67ef7a33da +SHA512 (yard-0.9.43-test-missing-files.tar.gz) = 4d3ef93e1b1ac63748bca9360817ded3c44aafa4fcf52da2d0779245fb6a8122b2d01ead636656f08de502463ea33e3e8a89795c220afb8afb4d32cd0f5b5e63 From 033648ba159ad4b05bf1078ed8ec0943e042c8f3 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 28 May 2026 16:38:23 +0900 Subject: [PATCH 2/4] Backport 0.9.41 / 0.9.44 fixes for possible path traversal issues --- rubygem-yard.spec | 15 +- yard-0.9.41-fix-possible-path-traversal.patch | 53 ++++++ yard-0.9.44-fix-possible-path-traversal.patch | 153 ++++++++++++++++++ 3 files changed, 220 insertions(+), 1 deletion(-) create mode 100644 yard-0.9.41-fix-possible-path-traversal.patch create mode 100644 yard-0.9.44-fix-possible-path-traversal.patch diff --git a/rubygem-yard.spec b/rubygem-yard.spec index 065160c..99c32f2 100644 --- a/rubygem-yard.spec +++ b/rubygem-yard.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 0.9.40 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Documentation tool for consistent and usable documentation in Ruby @@ -20,6 +20,12 @@ Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem Source1: %{gem_name}-%{version}-test-missing-files.tar.gz # Source1 is created by $ bash %%SOURCE2 %%version Source2: yard-create-missing-test-files.sh +# https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8 +# https://github.com/lsegal/yard/commit/f78c19f0dd33a407085b4ed181bb60c0aa0078b4 +Patch1: yard-0.9.44-fix-possible-path-traversal.patch +# https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj +# https://github.com/sysfce2/ruby-yard/commit/bdbff11302a035ce948d8ddad804c362c31c5be1 +Patch2: yard-0.9.41-fix-possible-path-traversal.patch # The 'irb/notifier' might be required for parsing of some old Ruby code. # https://github.com/lsegal/yard/blob/v0.9.24/lib/yard/parser/ruby/legacy/irb/slex.rb#L13 @@ -58,6 +64,8 @@ Documentation for %{name}. %prep %setup -q -n %{gem_name}-%{version} -b1 +%patch -P1 -p1 +%patch -P2 -p1 mv ../%{gem_name}-%{version}.gemspec . %build @@ -112,6 +120,11 @@ rspec -r spec_helper spec %doc %{gem_instdir}/docs/ %changelog +* Thu May 28 2026 Mamoru TASAKA - 0.9.40-2 +- Backport 0.9.41 / 0.9.44 fixes for possible path traversal issues +- https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj +- https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8 + * Mon Apr 13 2026 Mamoru TASAKA - 0.9.40-1 - 0.9.40 diff --git a/yard-0.9.41-fix-possible-path-traversal.patch b/yard-0.9.41-fix-possible-path-traversal.patch new file mode 100644 index 0000000..cc8d812 --- /dev/null +++ b/yard-0.9.41-fix-possible-path-traversal.patch @@ -0,0 +1,53 @@ +From bdbff11302a035ce948d8ddad804c362c31c5be1 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Thu, 16 Apr 2026 10:44:19 -0700 +Subject: [PATCH] Fix possible path traversal with document_root set in yard + server + +See [GHSA-xfhh-rx56-rxcr](https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr) + +Closes #1448 +--- + CHANGELOG.md | 2 ++ + lib/yard/server/commands/base.rb | 2 +- + spec/server/commands/base_spec.rb | 6 ++++++ + 3 files changed, 9 insertions(+), 1 deletion(-) + +@@ -11,6 +12,7 @@ + - Add support for `rdoc-image:...` syntax in HybridMarkup (#1676) + - Add support for colon suffix code blocks in HybridMarkup (rdoc compatibility) + - Fix responsiveness and state issues with nav frame links in `yard server` ++ + # [0.9.40] - April 12th, 2026 + + [0.9.40]: https://github.com/lsegal/yard/compare/v0.9.39...v0.9.40 +diff --git a/lib/yard/server/commands/base.rb b/lib/yard/server/commands/base.rb +index ef9d83f3a..c7d207cb3 100644 +--- a/lib/yard/server/commands/base.rb ++++ b/lib/yard/server/commands/base.rb +@@ -88,7 +88,7 @@ def initialize(opts = {}) + # of status, headers, and body wrapped in an array. + def call(request) + self.request = request +- self.path ||= request.path_info[1..-1] ++ self.path ||= File.cleanpath(request.path_info[1..-1]) + self.headers = {'Content-Type' => 'text/html'} + self.body = '' + self.status = 200 +diff --git a/spec/server/commands/base_spec.rb b/spec/server/commands/base_spec.rb +index 82c9e3096..c1726845c 100644 +--- a/spec/server/commands/base_spec.rb ++++ b/spec/server/commands/base_spec.rb +@@ -48,6 +48,12 @@ def run; cache 'foo' end + end + + describe "#call" do ++ it "sanitizes path_info" do ++ cmd = MyProcCommand.new { self.body = path } ++ _, _, b = *cmd.call(mock_request('/../../a/b/c')) ++ expect(b).to eq ['a/b/c'] ++ end ++ + it "handles a NotFoundError and use message as body" do + cmd = MyProcCommand.new { raise NotFoundError, "hello world" } + s, _, b = *cmd.call(mock_request('/foo')) diff --git a/yard-0.9.44-fix-possible-path-traversal.patch b/yard-0.9.44-fix-possible-path-traversal.patch new file mode 100644 index 0000000..0b6bef7 --- /dev/null +++ b/yard-0.9.44-fix-possible-path-traversal.patch @@ -0,0 +1,153 @@ +From f78c19f0dd33a407085b4ed181bb60c0aa0078b4 Mon Sep 17 00:00:00 2001 +From: Loren Segal +Date: Mon, 25 May 2026 12:49:29 -0700 +Subject: [PATCH] Fix possible path traversal in StaticCaching + +Fixes [GHSA-pxcc-8665-phx8](https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8) +--- + lib/yard/server/commands/base.rb | 12 +++------ + lib/yard/server/static_caching.rb | 41 ++++++++++++++++++++++++++---- + spec/server/commands/base_spec.rb | 7 +++++ + spec/server/static_caching_spec.rb | 6 +++++ + 4 files changed, 52 insertions(+), 14 deletions(-) + +diff --git a/lib/yard/server/commands/base.rb b/lib/yard/server/commands/base.rb +index c7d207cb3..9739b4c9c 100644 +--- a/lib/yard/server/commands/base.rb ++++ b/lib/yard/server/commands/base.rb +@@ -1,6 +1,4 @@ + # frozen_string_literal: true +-require 'fileutils' +- + module YARD + module Server + module Commands +@@ -32,6 +30,8 @@ module Commands + # @abstract + # @see #run + class Base ++ include StaticCaching ++ + # @group Basic Command and Adapter Options + + # @return [Hash] the options passed to the command's constructor +@@ -163,13 +163,7 @@ def render(object = nil) + # @return [String] the same cached data (for chaining) + # @see StaticCaching + def cache(data) +- if caching && adapter.document_root +- path = File.join(adapter.document_root, request.path_info.sub(/\.html$/, '') + '.html') +- path = path.sub(%r{/\.html$}, '.html') +- FileUtils.mkdir_p(File.dirname(path)) +- log.debug "Caching data to #{path}" +- File.open(path, 'wb') {|f| f.write(data) } +- end ++ super if caching + self.body = data + end + +diff --git a/lib/yard/server/static_caching.rb b/lib/yard/server/static_caching.rb +index ca43b15ac..f91fcd825 100644 +--- a/lib/yard/server/static_caching.rb ++++ b/lib/yard/server/static_caching.rb +@@ -1,4 +1,6 @@ + # frozen_string_literal: true ++require 'fileutils' ++ + module YARD + module Server + # Implements static caching for requests. +@@ -10,9 +12,8 @@ module StaticCaching + # implement your own +#check_static_cache+ method and mix the module into + # the Router class. + # +- # Note that caching does not occur here. This method simply checks for +- # the existence of cached data. To actually cache a response, see +- # {Commands::Base#cache}. ++ # This method checks for the existence of cached data. To actually cache ++ # a response, see {#cache}. + # + # @example Implementing In-Memory Cache Checking + # module MemoryCaching +@@ -33,14 +34,44 @@ module StaticCaching + # @see Commands::Base#cache + def check_static_cache + return nil unless adapter.document_root +- cache_path = File.join(adapter.document_root, request.path.sub(/\.html$/, '') + '.html') +- cache_path = cache_path.sub(%r{/\.html$}, '.html') ++ cache_path = cache_path(request.path) ++ return nil unless cache_path ++ + if File.file?(cache_path) + log.debug "Loading cache from disk: #{cache_path}" + return [200, {'Content-Type' => 'text/html'}, [File.read_binary(cache_path)]] + end + nil + end ++ ++ # Caches rendered HTML response data to disk. ++ # ++ # @param [String] data the data to cache ++ # @return [void] ++ # @since 0.9.44 ++ def cache(data) ++ return unless adapter.document_root ++ ++ path = cache_path(request.path_info) ++ return unless path ++ ++ FileUtils.mkdir_p(File.dirname(path)) ++ log.debug "Caching data to #{path}" ++ File.open(path, 'wb') {|f| f.write(data) } ++ end ++ ++ private ++ ++ def cache_path(request_path) ++ return nil if request_path.split(/[\/\\]/).include?('..') ++ ++ path = request_path.sub(/\.html$/, '') + '.html' ++ path = path.sub(%r{\A/+}, '') ++ return nil if path =~ /\A[A-Za-z]:/ ++ ++ path = File.cleanpath(path) ++ File.join(adapter.document_root, path) ++ end + end + end + end +diff --git a/spec/server/commands/base_spec.rb b/spec/server/commands/base_spec.rb +index c1726845c..568dda778 100644 +--- a/spec/server/commands/base_spec.rb ++++ b/spec/server/commands/base_spec.rb +@@ -36,6 +36,13 @@ def run; cache 'foo' end + @command.request.path_info = '/path/to/file.html' + @command.run + end ++ ++ it "does not cache paths containing parent directory components" do ++ expect(FileUtils).not_to receive(:mkdir_p) ++ expect(File).not_to receive(:open) ++ @command.request.path_info = '/../path/to/file.html' ++ @command.run ++ end + end + + describe "#redirect" do +diff --git a/spec/server/static_caching_spec.rb b/spec/server/static_caching_spec.rb +index 57960e6dd..724741e43 100644 +--- a/spec/server/static_caching_spec.rb ++++ b/spec/server/static_caching_spec.rb +@@ -37,6 +37,12 @@ def request; @request ||= MockRequest.new end + expect(check_static_cache).to eq nil + end + ++ it "does not read paths containing parent directory components" do ++ request.path_info = '/../secret' ++ expect(File).not_to receive(:file?) ++ expect(check_static_cache).to eq nil ++ end ++ + it "adds mount point to cache location" do + request.path_info = '/hello/world.html' + request.script_name = '/mount/point' From ed95f332ad2a47ff3156c4d202e988672031739b Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 28 May 2026 16:40:36 +0900 Subject: [PATCH 3/4] 0.9.44 --- rubygem-yard.spec | 7 ++++++- sources | 4 ++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/rubygem-yard.spec b/rubygem-yard.spec index f38db63..aa951cf 100644 --- a/rubygem-yard.spec +++ b/rubygem-yard.spec @@ -1,7 +1,7 @@ %global gem_name yard Name: rubygem-%{gem_name} -Version: 0.9.43 +Version: 0.9.44 Release: 1%{?dist} Summary: Documentation tool for consistent and usable documentation in Ruby @@ -112,8 +112,13 @@ rspec -r spec_helper spec %doc %{gem_instdir}/docs/ %changelog +* Thu May 28 2026 Mamoru TASAKA - 0.9.44-1 +- 0.9.44 +- https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8 + * Wed Apr 22 2026 Mamoru TASAKA - 0.9.43-1 - 0.9.43 +- https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj * Mon Apr 13 2026 Mamoru TASAKA - 0.9.40-1 - 0.9.40 diff --git a/sources b/sources index b1a3468..176b03a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (yard-0.9.43.gem) = 2d880d924e6dc79e04fe1035dc2ebbbcda447002db92a3e605f3df327514b9d1aa1bbbbea66b826da2841858bd33e04ca9bdc088fd68215b60a02d67ef7a33da -SHA512 (yard-0.9.43-test-missing-files.tar.gz) = 4d3ef93e1b1ac63748bca9360817ded3c44aafa4fcf52da2d0779245fb6a8122b2d01ead636656f08de502463ea33e3e8a89795c220afb8afb4d32cd0f5b5e63 +SHA512 (yard-0.9.44.gem) = 609a4df31699b76f08c242b9fd70a32920f9149943fac90e805ffe30707e678bca131d56261006404b451def080340ae1ea4656e259f31324ac097e3113df98d +SHA512 (yard-0.9.44-test-missing-files.tar.gz) = 31e6d779dbe9c227e2dc65c485db949fa87f733e53540ede2ba939a7611bed4f192acc58d087919879e1240956f4d5e1e0a3dd5f54997ea2b5fc2ebd2339785a From a02a8f5e4aeb65ca9677c205fe8f2aaa0262fbd6 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 16 Jul 2026 11:36:57 +0900 Subject: [PATCH 4/4] 0.9.45 --- rubygem-yard.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/rubygem-yard.spec b/rubygem-yard.spec index aa951cf..256b012 100644 --- a/rubygem-yard.spec +++ b/rubygem-yard.spec @@ -1,7 +1,7 @@ %global gem_name yard Name: rubygem-%{gem_name} -Version: 0.9.44 +Version: 0.9.45 Release: 1%{?dist} Summary: Documentation tool for consistent and usable documentation in Ruby @@ -112,6 +112,9 @@ rspec -r spec_helper spec %doc %{gem_instdir}/docs/ %changelog +* Thu Jul 16 2026 Mamoru TASAKA - 0.9.45-1 +- 0.9.45 + * Thu May 28 2026 Mamoru TASAKA - 0.9.44-1 - 0.9.44 - https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8 diff --git a/sources b/sources index 176b03a..48beb7d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (yard-0.9.44.gem) = 609a4df31699b76f08c242b9fd70a32920f9149943fac90e805ffe30707e678bca131d56261006404b451def080340ae1ea4656e259f31324ac097e3113df98d -SHA512 (yard-0.9.44-test-missing-files.tar.gz) = 31e6d779dbe9c227e2dc65c485db949fa87f733e53540ede2ba939a7611bed4f192acc58d087919879e1240956f4d5e1e0a3dd5f54997ea2b5fc2ebd2339785a +SHA512 (yard-0.9.45.gem) = a4400a5eedbf53ece9b12d62d8f2329d1447af45078c81e989fd320c5e86431f96382802c1c201f4994517bad5faeab5e9bae80b2acdf81982c64693ef80fe02 +SHA512 (yard-0.9.45-test-missing-files.tar.gz) = f7768905645ab76e6dc5f1ab5025232191fd39777bec09d388638ac399348190bc1242d9cd1843f2d86ba695527c2c08a7cc6eca4ddf063960a9563310219c37