Fix to directory traversal attacks (CVE-2017-17042).

rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch

@@ -0,0 +1,48 @@
+From b0217b3e30dc53d057b1682506333335975e62b4 Mon Sep 17 00:00:00 2001
+From: Loren Segal <lsegal@soen.ca>
+Date: Thu, 23 Nov 2017 13:34:33 -0800
+Subject: [PATCH] Disallow relative paths that start with ../
+
+Fixes a potential arbitrary file read vulnerability in yard server.
+Thanks to ztz <ztz@ztz.me> for discovery of this security issue.
+---
+ lib/yard/core_ext/file.rb  | 2 ++
+ spec/core_ext/file_spec.rb | 6 +++---
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb
+index 3902f2bd..a0b983e9 100644
+--- a/lib/yard/core_ext/file.rb
++++ b/lib/yard/core_ext/file.rb
+@@ -39,6 +39,8 @@ class File
+       if comp == RELATIVE_PARENTDIR && acc.size > 0 && acc.last != RELATIVE_PARENTDIR
+         acc.pop
+         next acc
++      elsif comp == RELATIVE_PARENTDIR && acc.empty?
++        next acc
+       end
+       acc << comp
+     end
+diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb
+index f61081f6..15806360 100644
+--- a/spec/core_ext/file_spec.rb
++++ b/spec/core_ext/file_spec.rb
+@@ -41,12 +41,12 @@ RSpec.describe File do
+       File.cleanpath('A/B/C/D/..').should == "A/B/C"
+     end
+ 
+-    it "should pass the initial directory" do
+-      File.cleanpath('C/../../D').should == "../D"
++    it "does not allow relative path above root" do
++      File.cleanpath('A/../../../../../D').should == "D"
+     end
+ 
+     it "should not remove multiple '../' at the beginning" do
+-      File.cleanpath('../../A/B').should == '../../A/B'
++      File.cleanpath('../../A/B').should == 'A/B'
+     end
+   end
+ 
+-- 
+2.15.1
+

rubygem-yard-0.9.11-Fix-broken-tests.patch

@@ -0,0 +1,65 @@
+From 3bcccf678040e827f706b8305456424aa83f6471 Mon Sep 17 00:00:00 2001
+From: Loren Segal <lsegal@soen.ca>
+Date: Thu, 23 Nov 2017 13:47:35 -0800
+Subject: [PATCH] Fix broken tests
+
+---
+ lib/yard/cli/yardoc.rb     | 2 +-
+ lib/yard/core_ext/file.rb  | 5 +++--
+ spec/core_ext/file_spec.rb | 4 ++++
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/yard/cli/yardoc.rb b/lib/yard/cli/yardoc.rb
+index a2918a36..f40e4dd1 100644
+--- a/lib/yard/cli/yardoc.rb
++++ b/lib/yard/cli/yardoc.rb
+@@ -640,7 +640,7 @@ module YARD
+         opts.on('--asset FROM[:TO]', 'A file or directory to copy over to output ',
+                                      '  directory after generating') do |asset|
+           re = /^(?:\.\.\/|\/)/
+-          from, to = *asset.split(':').map {|f| File.cleanpath(f) }
++          from, to = *asset.split(':').map {|f| File.cleanpath(f, true) }
+           to ||= from
+           if from =~ re || to =~ re
+             log.warn "Invalid file '#{asset}'"
+diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb
+index a0b983e9..c918b5af 100644
+--- a/lib/yard/core_ext/file.rb
++++ b/lib/yard/core_ext/file.rb
+@@ -31,15 +31,16 @@ class File
+   # @example Clean a path
+   #   File.cleanpath('a/b//./c/../e') # => "a/b/e"
+   # @param [String] path the path to clean
++  # @param [Boolean] rel_root allows relative path above root value
+   # @return [String] the sanitized path
+-  def self.cleanpath(path)
++  def self.cleanpath(path, rel_root = false)
+     path = path.split(SEPARATOR)
+     path = path.inject([]) do |acc, comp|
+       next acc if comp == RELATIVE_SAMEDIR
+       if comp == RELATIVE_PARENTDIR && acc.size > 0 && acc.last != RELATIVE_PARENTDIR
+         acc.pop
+         next acc
+-      elsif comp == RELATIVE_PARENTDIR && acc.empty?
++      elsif !rel_root && comp == RELATIVE_PARENTDIR && acc.empty?
+         next acc
+       end
+       acc << comp
+diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb
+index 15806360..e3d3930c 100644
+--- a/spec/core_ext/file_spec.rb
++++ b/spec/core_ext/file_spec.rb
+@@ -41,6 +41,10 @@ RSpec.describe File do
+       File.cleanpath('A/B/C/D/..').should == "A/B/C"
+     end
+ 
++    it "allows '../' at the beginning if rel_root=true" do
++      expect(File.cleanpath('A/../../B', true)).to eq '../B'
++    end
++
+     it "does not allow relative path above root" do
+       File.cleanpath('A/../../../../../D').should == "D"
+     end
+-- 
+2.15.1
+

rubygem-yard.spec

@@ -2,12 +2,17 @@
 
 Name: rubygem-%{gem_name}
 Version: 0.8.7.6
-Release: 3%{?dist}
+Release: 4%{?dist}
 Summary: Documentation tool for consistent and usable documentation in Ruby
 Group: Development/Languages
 License: MIT and (BSD or Ruby)
 URL: http://yardoc.org
 Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem
+# Fix to directory traversal attacks (CVE-2017-17042)
+# https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4
+Patch1: rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch
+# https://github.com/lsegal/yard/commit/3bcccf678040e827f706b8305456424aa83f6471
+Patch2: rubygem-yard-0.9.11-Fix-broken-tests.patch
 BuildRequires: ruby(release)
 BuildRequires: rubygems-devel
 BuildRequires: ruby
@@ -41,6 +46,11 @@ Documentation for %{name}.
 %setup -q -T -c
 %gem_install -n %{SOURCE0}
 
+pushd .%{gem_instdir}
+%patch1 -p1
+%patch2 -p1
+popd
+
 %build
 
 %install
@@ -93,6 +103,9 @@ popd
 
 
 %changelog
+* Fri Dec 01 2017 Vít Ondruch <vondruch@redhat.com> - 0.8.7.6-4
+- Fix to directory traversal attacks (CVE-2017-17042).
+
 * Wed May 25 2016 Jun Aruga <jaruga@redhat.com> - 0.8.7.6-3
 - Fix test suite for Ruby 2.3 compatibility. (rhbz#1308100)