Fix to directory traversal attacks (CVE-2017-17042).

rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch

@@ -0,0 +1,48 @@
+From b0217b3e30dc53d057b1682506333335975e62b4 Mon Sep 17 00:00:00 2001
+From: Loren Segal <lsegal@soen.ca>
+Date: Thu, 23 Nov 2017 13:34:33 -0800
+Subject: [PATCH] Disallow relative paths that start with ../
+
+Fixes a potential arbitrary file read vulnerability in yard server.
+Thanks to ztz <ztz@ztz.me> for discovery of this security issue.
+---
+ lib/yard/core_ext/file.rb  | 2 ++
+ spec/core_ext/file_spec.rb | 6 +++---
+ 2 files changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb
+index 3902f2bd..a0b983e9 100644
+--- a/lib/yard/core_ext/file.rb
++++ b/lib/yard/core_ext/file.rb
+@@ -40,6 +40,8 @@ class File
+       if comp == RELATIVE_PARENTDIR && !acc.empty? && acc.last != RELATIVE_PARENTDIR
+         acc.pop
+         next acc
++      elsif comp == RELATIVE_PARENTDIR && acc.empty?
++        next acc
+       end
+       acc << comp
+     end
+diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb
+index f61081f6..15806360 100644
+--- a/spec/core_ext/file_spec.rb
++++ b/spec/core_ext/file_spec.rb
+@@ -41,12 +41,12 @@ RSpec.describe File do
+       expect(File.cleanpath('A/B/C/D/..')).to eq "A/B/C"
+     end
+ 
+-    it "passes the initial directory" do
+-      expect(File.cleanpath('C/../../D')).to eq "../D"
++    it "does not allow relative path above root" do
++      expect(File.cleanpath('A/../../../../../D')).to eq "D"
+     end
+ 
+     it "does not remove multiple '../' at the beginning" do
+-      expect(File.cleanpath('../../A/B')).to eq '../../A/B'
++      expect(File.cleanpath('../../A/B')).to eq 'A/B'
+     end
+   end
+ 
+-- 
+2.15.1
+

rubygem-yard-0.9.11-Fix-broken-tests.patch

@@ -0,0 +1,65 @@
+From 3bcccf678040e827f706b8305456424aa83f6471 Mon Sep 17 00:00:00 2001
+From: Loren Segal <lsegal@soen.ca>
+Date: Thu, 23 Nov 2017 13:47:35 -0800
+Subject: [PATCH] Fix broken tests
+
+---
+ lib/yard/cli/yardoc.rb     | 2 +-
+ lib/yard/core_ext/file.rb  | 5 +++--
+ spec/core_ext/file_spec.rb | 4 ++++
+ 3 files changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/yard/cli/yardoc.rb b/lib/yard/cli/yardoc.rb
+index a2918a36..f40e4dd1 100644
+--- a/lib/yard/cli/yardoc.rb
++++ b/lib/yard/cli/yardoc.rb
+@@ -649,7 +649,7 @@ module YARD
+         opts.on('--asset FROM[:TO]', 'A file or directory to copy over to output ',
+                                      '  directory after generating') do |asset|
+           re = %r{^(?:\.\./|/)}
+-          from, to = *asset.split(':').map {|f| File.cleanpath(f) }
++          from, to = *asset.split(':').map {|f| File.cleanpath(f, true) }
+           to ||= from
+           if from =~ re || to =~ re
+             log.warn "Invalid file '#{asset}'"
+diff --git a/lib/yard/core_ext/file.rb b/lib/yard/core_ext/file.rb
+index a0b983e9..c918b5af 100644
+--- a/lib/yard/core_ext/file.rb
++++ b/lib/yard/core_ext/file.rb
+@@ -32,15 +32,16 @@ class File
+   # @example Clean a path
+   #   File.cleanpath('a/b//./c/../e') # => "a/b/e"
+   # @param [String] path the path to clean
++  # @param [Boolean] rel_root allows relative path above root value
+   # @return [String] the sanitized path
+-  def self.cleanpath(path)
++  def self.cleanpath(path, rel_root = false)
+     path = path.split(SEPARATOR)
+     path = path.inject([]) do |acc, comp|
+       next acc if comp == RELATIVE_SAMEDIR
+       if comp == RELATIVE_PARENTDIR && !acc.empty? && acc.last != RELATIVE_PARENTDIR
+         acc.pop
+         next acc
+-      elsif comp == RELATIVE_PARENTDIR && acc.empty?
++      elsif !rel_root && comp == RELATIVE_PARENTDIR && acc.empty?
+         next acc
+       end
+       acc << comp
+diff --git a/spec/core_ext/file_spec.rb b/spec/core_ext/file_spec.rb
+index 15806360..e3d3930c 100644
+--- a/spec/core_ext/file_spec.rb
++++ b/spec/core_ext/file_spec.rb
+@@ -41,6 +41,10 @@ RSpec.describe File do
+       expect(File.cleanpath('A/B/C/D/..')).to eq "A/B/C"
+     end
+ 
++    it "allows '../' at the beginning if rel_root=true" do
++      expect(File.cleanpath('A/../../B', true)).to eq '../B'
++    end
++
+     it "does not allow relative path above root" do
+       expect(File.cleanpath('A/../../../../../D')).to eq "D"
+     end
+-- 
+2.15.1
+

rubygem-yard.spec

@@ -2,7 +2,7 @@
 
 Name: rubygem-%{gem_name}
 Version: 0.9.8
-Release: 2%{?dist}
+Release: 4%{?dist}
 Summary: Documentation tool for consistent and usable documentation in Ruby
 Group: Development/Languages
 License: MIT and (BSD or Ruby)
@@ -12,6 +12,11 @@ Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem
 # https://github.com/lsegal/yard/pull/1057
 # https://github.com/lsegal/yard/commit/2d1e9f3b7696a45ed8e48a624a33d662cb99e5cb
 Patch0: pry-0.9.8-Replace-deprecated-TRUE-and-FALSE-constants-with-their-equivalents.patch
+# Fix to directory traversal attacks (CVE-2017-17042)
+# https://github.com/lsegal/yard/commit/b0217b3e30dc53d057b1682506333335975e62b4
+Patch1: rubygem-yard-0.9.11-Disallow-relative-paths-that-start-with.patch
+# https://github.com/lsegal/yard/commit/3bcccf678040e827f706b8305456424aa83f6471
+Patch2: rubygem-yard-0.9.11-Fix-broken-tests.patch
 BuildRequires: ruby(release)
 BuildRequires: rubygems-devel
 BuildRequires: ruby
@@ -43,6 +48,8 @@ Documentation for %{name}.
 
 pushd .%{gem_instdir}
 %patch0 -p1
+%patch1 -p1
+%patch2 -p1
 popd
 
 %build
@@ -97,6 +104,9 @@ popd
 
 
 %changelog
+* Fri Dec 01 2017 Vít Ondruch <vondruch@redhat.com> - 0.9.8-4
+- Fix to directory traversal attacks (CVE-2017-17042).
+
 * Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.9.8-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild