diff options
| -rw-r--r-- | system/ruby/APKBUILD | 25 | ||||
| -rw-r--r-- | system/ruby/ruby-2.5.3-rubygems-v2.patch | 408 |
2 files changed, 422 insertions, 11 deletions
diff --git a/system/ruby/APKBUILD b/system/ruby/APKBUILD index 18d9bf8d8..7f949cc04 100644 --- a/system/ruby/APKBUILD +++ b/system/ruby/APKBUILD @@ -24,11 +24,18 @@ # 2.5.3-r0: # - CVE-2018-16395 # - CVE-2018-16396 +# 2.5.3-r2: +# - CVE-2019-8320 +# - CVE-2019-8321 +# - CVE-2019-8322 +# - CVE-2019-8323 +# - CVE-2019-8324 +# - CVE-2019-8325 # pkgname=ruby pkgver=2.5.3 _abiver="${pkgver%.*}.0" -pkgrel=1 +pkgrel=2 pkgdesc="An object-oriented language for quick and easy programming" url="https://www.ruby-lang.org/" arch="all" @@ -61,7 +68,9 @@ subpackages="$pkgname-doc $pkgname-dev source="https://cache.ruby-lang.org/pub/ruby/${pkgver%.*}/$pkgname-$pkgver.tar.xz rubygems-avoid-platform-specific-gems.patch test_insns-lower-recursion-depth.patch - fix-get_main_stack.patch" + fix-get_main_stack.patch + ruby-2.5.3-rubygems-v2.patch + " replaces="ruby-gems" _gemdir="/usr/lib/ruby/gems/$_abiver" @@ -83,14 +92,10 @@ done prepare() { default_prepare - - cd "$builddir" autoconf } build() { - cd "$builddir" - # -fomit-frame-pointer makes ruby segfault, see gentoo bug #150413 # In many places aliasing rules are broken; play it safe # as it's risky with newer compilers to leave it as it is. @@ -111,7 +116,7 @@ build() { --sysconfdir=/etc \ --mandir=/usr/share/man \ --infodir=/usr/share/info \ - --with-sitedir='/usr/local/lib/site_ruby' \ + --with-sitedir="/usr/local/lib/site_ruby" \ --with-search-path="/usr/lib/site_ruby/\$(ruby_ver)/$_arch-linux" \ --enable-pthread \ --disable-rpath \ @@ -121,13 +126,10 @@ build() { } check() { - cd "$builddir" make test } package() { - cd "$builddir" - make DESTDIR="$pkgdir" install install -m 644 -D COPYING \ @@ -317,4 +319,5 @@ _mvgem() { sha512sums="6dcae0e8d0bacdb2cbde636e2030596308b5af53f2eb85d3adccb67b02e6f8f9751e8117d12f8484829fdd9d995f6e327f701d9b433bcf94f1f59d13a1fd7518 ruby-2.5.3.tar.xz cfdc5ea3b2e2ea69c51f38e8e2180cb1dc27008ca55cc6301f142ebafdbab31c3379b3b6bba9ff543153876dd98ed2ad194df3255b7ea77a62e931c935f80538 rubygems-avoid-platform-specific-gems.patch 814fe6359505b70d8ff680adf22f20a74b4dbd3fecc9a63a6c2456ee9824257815929917b6df5394ed069a6869511b8c6dce5b95b4acbbb7867c1f3a975a0150 test_insns-lower-recursion-depth.patch -8d730f02f76e53799f1c220eb23e3d2305940bb31216a7ab1e42d3256149c0721c7d173cdbfe505023b1af2f5cb3faa233dcc1b5d560fa8f980c17c2d29a9d81 fix-get_main_stack.patch" +8d730f02f76e53799f1c220eb23e3d2305940bb31216a7ab1e42d3256149c0721c7d173cdbfe505023b1af2f5cb3faa233dcc1b5d560fa8f980c17c2d29a9d81 fix-get_main_stack.patch +4f374a8bce1f5137e155d79aa06086d25c3be45f90d8dbebc9f4ee2fb71dd5fe4a3bc1f7b922e784cbb9054f575155c1ad921062b762eb372306dabe9ff7951e ruby-2.5.3-rubygems-v2.patch" diff --git a/system/ruby/ruby-2.5.3-rubygems-v2.patch b/system/ruby/ruby-2.5.3-rubygems-v2.patch new file mode 100644 index 000000000..cf2b2c7f1 --- /dev/null +++ b/system/ruby/ruby-2.5.3-rubygems-v2.patch @@ -0,0 +1,408 @@ +diff --git lib/rubygems.rb lib/rubygems.rb +index 2762bfcb88..cd7434ca87 100644 +--- a/lib/rubygems.rb ++++ b/lib/rubygems.rb +@@ -10,7 +10,7 @@ + require 'thread' + + module Gem +- VERSION = "2.7.6" ++ VERSION = "2.7.6.1" + end + + # Must be first since it unloads the prelude from 1.9.2 +diff --git lib/rubygems/command_manager.rb lib/rubygems/command_manager.rb +index 887272378e..3bee1c30a4 100644 +--- a/lib/rubygems/command_manager.rb ++++ b/lib/rubygems/command_manager.rb +@@ -7,6 +7,7 @@ + + require 'rubygems/command' + require 'rubygems/user_interaction' ++require 'rubygems/text' + + ## + # The command manager registers and installs all the individual sub-commands +@@ -32,6 +33,7 @@ + + class Gem::CommandManager + ++ include Gem::Text + include Gem::UserInteraction + + BUILTIN_COMMANDS = [ # :nodoc: +@@ -140,12 +142,12 @@ def command_names + def run(args, build_args=nil) + process_args(args, build_args) + rescue StandardError, Timeout::Error => ex +- alert_error "While executing gem ... (#{ex.class})\n #{ex}" ++ alert_error clean_text("While executing gem ... (#{ex.class})\n #{ex}") + ui.backtrace ex + + terminate_interaction(1) + rescue Interrupt +- alert_error "Interrupted" ++ alert_error clean_text("Interrupted") + terminate_interaction(1) + end + +@@ -163,7 +165,7 @@ def process_args(args, build_args=nil) + say Gem::VERSION + terminate_interaction 0 + when /^-/ then +- alert_error "Invalid option: #{args.first}. See 'gem --help'." ++ alert_error clean_text("Invalid option: #{args.first}. See 'gem --help'.") + terminate_interaction 1 + else + cmd_name = args.shift.downcase +@@ -212,7 +214,7 @@ def load_and_instantiate(command_name) + rescue Exception => e + e = load_error if load_error + +- alert_error "Loading command: #{command_name} (#{e.class})\n\t#{e}" ++ alert_error clean_text("Loading command: #{command_name} (#{e.class})\n\t#{e}") + ui.backtrace e + end + end +diff --git lib/rubygems/commands/owner_command.rb lib/rubygems/commands/owner_command.rb +index 637b5bdc4d..cac6c5a17d 100644 +--- a/lib/rubygems/commands/owner_command.rb ++++ b/lib/rubygems/commands/owner_command.rb +@@ -2,8 +2,11 @@ + require 'rubygems/command' + require 'rubygems/local_remote_options' + require 'rubygems/gemcutter_utilities' ++require 'rubygems/text' + + class Gem::Commands::OwnerCommand < Gem::Command ++ ++ include Gem::Text + include Gem::LocalRemoteOptions + include Gem::GemcutterUtilities + +@@ -64,7 +67,7 @@ def show_owners name + end + + with_response response do |resp| +- owners = Gem::SafeYAML.load resp.body ++ owners = Gem::SafeYAML.load clean_text(resp.body) + + say "Owners for gem: #{name}" + owners.each do |owner| +diff --git lib/rubygems/gemcutter_utilities.rb lib/rubygems/gemcutter_utilities.rb +index 7c6d6bb364..623d9301b5 100644 +--- a/lib/rubygems/gemcutter_utilities.rb ++++ b/lib/rubygems/gemcutter_utilities.rb +@@ -1,11 +1,14 @@ + # frozen_string_literal: true + require 'rubygems/remote_fetcher' ++require 'rubygems/text' + + ## + # Utility methods for using the RubyGems API. + + module Gem::GemcutterUtilities + ++ include Gem::Text ++ + # TODO: move to Gem::Command + OptionParser.accept Symbol do |value| + value.to_sym +@@ -145,13 +148,13 @@ def with_response response, error_prefix = nil + if block_given? then + yield response + else +- say response.body ++ say clean_text(response.body) + end + else + message = response.body + message = "#{error_prefix}: #{message}" if error_prefix + +- say message ++ say clean_text(message) + terminate_interaction 1 # TODO: question this + end + end +diff --git lib/rubygems/installer.rb lib/rubygems/installer.rb +index ee5fedeb64..904d5a0c7c 100644 +--- a/lib/rubygems/installer.rb ++++ b/lib/rubygems/installer.rb +@@ -707,9 +707,26 @@ def verify_gem_home(unpack = false) # :nodoc: + unpack or File.writable?(gem_home) + end + +- def verify_spec_name +- return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN +- raise Gem::InstallError, "#{spec} has an invalid name" ++ def verify_spec ++ unless spec.name =~ Gem::Specification::VALID_NAME_PATTERN ++ raise Gem::InstallError, "#{spec} has an invalid name" ++ end ++ ++ if spec.raw_require_paths.any?{|path| path =~ /\r\n|\r|\n/ } ++ raise Gem::InstallError, "#{spec} has an invalid require_paths" ++ end ++ ++ if spec.extensions.any?{|ext| ext =~ /\r\n|\r|\n/ } ++ raise Gem::InstallError, "#{spec} has an invalid extensions" ++ end ++ ++ unless spec.specification_version.to_s =~ /\A\d+\z/ ++ raise Gem::InstallError, "#{spec} has an invalid specification_version" ++ end ++ ++ if spec.dependencies.any? {|dep| dep.type =~ /\r\n|\r|\n/ || dep.name =~ /\r\n|\r|\n/ } ++ raise Gem::InstallError, "#{spec} has an invalid dependencies" ++ end + end + + ## +@@ -836,10 +853,12 @@ def dir + def pre_install_checks + verify_gem_home options[:unpack] + ++ # The name and require_paths must be verified first, since it could contain ++ # ruby code that would be eval'ed in #ensure_loadable_spec ++ verify_spec ++ + ensure_loadable_spec + +- verify_spec_name +- + if options[:install_as_default] + Gem.ensure_default_gem_subdirectories gem_home + else +diff --git lib/rubygems/package.rb lib/rubygems/package.rb +index b924122827..b472b97a07 100644 +--- a/lib/rubygems/package.rb ++++ b/lib/rubygems/package.rb +@@ -425,6 +425,16 @@ def install_location filename, destination_dir # :nodoc: + raise Gem::Package::PathError.new(destination, destination_dir) unless + destination.start_with? destination_dir + '/' + ++ begin ++ real_destination = File.expand_path(File.realpath(destination)) ++ rescue ++ # it's fine if the destination doesn't exist, because rm -rf'ing it can't cause any damage ++ nil ++ else ++ raise Gem::Package::PathError.new(real_destination, destination_dir) unless ++ real_destination.start_with? destination_dir + '/' ++ end ++ + destination.untaint + destination + end +diff --git lib/rubygems/user_interaction.rb lib/rubygems/user_interaction.rb +index cacd782e08..eff8f9533c 100644 +--- a/lib/rubygems/user_interaction.rb ++++ b/lib/rubygems/user_interaction.rb +@@ -6,6 +6,7 @@ + #++ + + require 'rubygems/util' ++require 'rubygems/text' + + ## + # Module that defines the default UserInteraction. Any class including this +@@ -13,6 +14,8 @@ + + module Gem::DefaultUserInteraction + ++ include Gem::Text ++ + ## + # The default UI is a class variable of the singleton class for this + # module. +@@ -160,8 +163,8 @@ def terminate_interaction exit_code = 0 + # Calls +say+ with +msg+ or the results of the block if really_verbose + # is true. + +- def verbose msg = nil +- say(msg || yield) if Gem.configuration.really_verbose ++ def verbose(msg = nil) ++ say(clean_text(msg || yield)) if Gem.configuration.really_verbose + end + end + +diff --git test/rubygems/test_gem_installer.rb test/rubygems/test_gem_installer.rb +index 93b0482407..a47a307049 100644 +--- a/test/rubygems/test_gem_installer.rb ++++ b/test/rubygems/test_gem_installer.rb +@@ -1474,6 +1474,114 @@ def spec.validate; end + end + end + ++ def test_pre_install_checks_malicious_name_before_eval ++ spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1' ++ def spec.full_name # so the spec is buildable ++ "malicious-1" ++ end ++ def spec.validate(*args); end ++ ++ util_build_gem spec ++ ++ gem = File.join(@gemhome, 'cache', spec.file_name) ++ ++ use_ui @ui do ++ @installer = Gem::Installer.at gem ++ e = assert_raises Gem::InstallError do ++ @installer.pre_install_checks ++ end ++ assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message ++ end ++ refute defined?(::Object::FROM_EVAL) ++ end ++ ++ def test_pre_install_checks_malicious_require_paths_before_eval ++ spec = util_spec "malicious", '1' ++ def spec.full_name # so the spec is buildable ++ "malicious-1" ++ end ++ def spec.validate(*args); end ++ spec.require_paths = ["malicious\n``"] ++ ++ util_build_gem spec ++ ++ gem = File.join(@gemhome, 'cache', spec.file_name) ++ ++ use_ui @ui do ++ @installer = Gem::Installer.at gem ++ e = assert_raises Gem::InstallError do ++ @installer.pre_install_checks ++ end ++ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message ++ end ++ end ++ ++ def test_pre_install_checks_malicious_extensions_before_eval ++ skip "mswin environment disallow to create file contained the carriage return code." if Gem.win_platform? ++ ++ spec = util_spec "malicious", '1' ++ def spec.full_name # so the spec is buildable ++ "malicious-1" ++ end ++ def spec.validate(*args); end ++ spec.extensions = ["malicious\n``"] ++ ++ util_build_gem spec ++ ++ gem = File.join(@gemhome, 'cache', spec.file_name) ++ ++ use_ui @ui do ++ @installer = Gem::Installer.at gem ++ e = assert_raises Gem::InstallError do ++ @installer.pre_install_checks ++ end ++ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message ++ end ++ end ++ ++ def test_pre_install_checks_malicious_specification_version_before_eval ++ spec = util_spec "malicious", '1' ++ def spec.full_name # so the spec is buildable ++ "malicious-1" ++ end ++ def spec.validate(*args); end ++ spec.specification_version = "malicious\n``" ++ ++ util_build_gem spec ++ ++ gem = File.join(@gemhome, 'cache', spec.file_name) ++ ++ use_ui @ui do ++ @installer = Gem::Installer.at gem ++ e = assert_raises Gem::InstallError do ++ @installer.pre_install_checks ++ end ++ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message ++ end ++ end ++ ++ def test_pre_install_checks_malicious_dependencies_before_eval ++ spec = util_spec "malicious", '1' ++ def spec.full_name # so the spec is buildable ++ "malicious-1" ++ end ++ def spec.validate(*args); end ++ spec.add_dependency "b\nfoo", '> 5' ++ ++ util_build_gem spec ++ ++ gem = File.join(@gemhome, 'cache', spec.file_name) ++ ++ use_ui @ui do ++ @installer = Gem::Installer.at gem ++ @installer.ignore_dependencies = true ++ e = assert_raises Gem::InstallError do ++ @installer.pre_install_checks ++ end ++ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message ++ end ++ end ++ + def test_shebang + util_make_exec @spec, "#!/usr/bin/ruby" + +diff --git test/rubygems/test_gem_package.rb test/rubygems/test_gem_package.rb +index d1664cf285..0b03ee2e0c 100644 +--- a/test/rubygems/test_gem_package.rb ++++ b/test/rubygems/test_gem_package.rb +@@ -480,6 +480,42 @@ def test_extract_symlink_parent + "#{destination_subdir} is not allowed", e.message) + end + ++ def test_extract_symlink_parent_doesnt_delete_user_dir ++ skip if RUBY_VERSION <= "1.8.7" ++ ++ package = Gem::Package.new @gem ++ ++ # Extract into a subdirectory of @destination; if this test fails it writes ++ # a file outside destination_subdir, but we want the file to remain inside ++ # @destination so it will be cleaned up. ++ destination_subdir = File.join @destination, 'subdir' ++ FileUtils.mkdir_p destination_subdir ++ ++ destination_user_dir = File.join @destination, 'user' ++ destination_user_subdir = File.join destination_user_dir, 'dir' ++ FileUtils.mkdir_p destination_user_subdir ++ ++ tgz_io = util_tar_gz do |tar| ++ tar.add_symlink 'link', destination_user_dir, 16877 ++ tar.add_symlink 'link/dir', '.', 16877 ++ end ++ ++ e = assert_raises(Gem::Package::PathError, Errno::EACCES) do ++ package.extract_tar_gz tgz_io, destination_subdir ++ end ++ ++ assert_path_exists destination_user_subdir ++ ++ if Gem::Package::PathError === e ++ assert_equal("installing into parent path #{destination_user_subdir} of " + ++ "#{destination_subdir} is not allowed", e.message) ++ elsif win_platform? ++ skip "symlink - must be admin with no UAC on Windows" ++ else ++ raise e ++ end ++ end ++ + def test_extract_tar_gz_directory + package = Gem::Package.new @gem + +diff --git test/rubygems/test_gem_text.rb test/rubygems/test_gem_text.rb +index 04f3f605e8..8ce6df94bb 100644 +--- a/test/rubygems/test_gem_text.rb ++++ b/test/rubygems/test_gem_text.rb +@@ -85,4 +85,9 @@ def test_truncate_text + s = "ab" * 500_001 + assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000) + end ++ ++ def test_clean_text ++ assert_equal ".]2;nyan.", clean_text("\e]2;nyan\a") ++ end ++ + end |