File eds-CVE-2026-2604.patch of Package evolution-data-server
From afa12b6ba502e5acaa431415aa3b939ddb377382 Mon Sep 17 00:00:00 2001
From: Milan Crha <mcrha@redhat.com>
Date: Mon, 16 Feb 2026 18:20:34 +0100
Subject: [PATCH] I#627 - Canonicalize path before local cache file removal
Closes https://gitlab.gnome.org/GNOME/evolution-data-server/-/issues/627
---
.../backends/file/e-book-backend-file.c | 2 +-
.../libedata-book/e-book-meta-backend.c | 2 +-
src/calendar/libedata-cal/e-cal-cache.c | 2 +-
src/libedataserver/e-data-server-util.c | 42 ++++++++++++++++++
src/libedataserver/e-data-server-util.h | 2 +
tests/libedataserver/libedataserver-test.c | 43 +++++++++++++++++++
6 files changed, 90 insertions(+), 3 deletions(-)
diff -urp evolution-data-server-3.42.5.orig/src/addressbook/backends/file/e-book-backend-file.c evolution-data-server-3.42.5/src/addressbook/backends/file/e-book-backend-file.c
--- evolution-data-server-3.42.5.orig/src/addressbook/backends/file/e-book-backend-file.c 2022-05-04 08:40:30.000000000 -0500
+++ evolution-data-server-3.42.5/src/addressbook/backends/file/e-book-backend-file.c 2026-02-23 14:51:18.178395510 -0600
@@ -193,7 +193,7 @@ maybe_delete_uri (EBookBackendFile *bf,
/* If the file is in our path it belongs to us and we need to delete it.
*/
if (bf->priv->photo_dirname &&
- !strncmp (bf->priv->photo_dirname, filename, strlen (bf->priv->photo_dirname))) {
+ e_util_filename_is_in_path (filename, bf->priv->photo_dirname)) {
d (g_print ("Deleting uri file: %s\n", filename));
diff -urp evolution-data-server-3.42.5.orig/src/addressbook/libedata-book/e-book-meta-backend.c evolution-data-server-3.42.5/src/addressbook/libedata-book/e-book-meta-backend.c
--- evolution-data-server-3.42.5.orig/src/addressbook/libedata-book/e-book-meta-backend.c 2022-05-04 08:40:30.000000000 -0500
+++ evolution-data-server-3.42.5/src/addressbook/libedata-book/e-book-meta-backend.c 2026-02-23 14:51:18.178892932 -0600
@@ -528,7 +528,7 @@ ebmb_gather_photos_local_filenames (EBoo
gchar *filename;
filename = g_filename_from_uri (url, NULL, NULL);
- if (filename && g_str_has_prefix (filename, cache_path))
+ if (filename && e_util_filename_is_in_path (filename, cache_path))
filenames = g_slist_prepend (filenames, filename);
else
g_free (filename);
diff -urp evolution-data-server-3.42.5.orig/src/calendar/libedata-cal/e-cal-cache.c evolution-data-server-3.42.5/src/calendar/libedata-cal/e-cal-cache.c
--- evolution-data-server-3.42.5.orig/src/calendar/libedata-cal/e-cal-cache.c 2022-05-04 08:40:30.000000000 -0500
+++ evolution-data-server-3.42.5/src/calendar/libedata-cal/e-cal-cache.c 2026-02-23 14:51:18.179544777 -0600
@@ -3718,7 +3718,7 @@ e_cal_cache_delete_attachments (ECalCach
if (!cache_dirname)
cache_dirname = g_path_get_dirname (e_cache_get_filename (E_CACHE (cal_cache)));
- if (g_str_has_prefix (filename, cache_dirname) &&
+ if (e_util_filename_is_in_path (filename, cache_dirname) &&
g_unlink (filename) == -1) {
/* Ignore these errors */
}
diff -urp evolution-data-server-3.42.5.orig/src/libedataserver/e-data-server-util.c evolution-data-server-3.42.5/src/libedataserver/e-data-server-util.c
--- evolution-data-server-3.42.5.orig/src/libedataserver/e-data-server-util.c 2022-05-04 08:40:30.000000000 -0500
+++ evolution-data-server-3.42.5/src/libedataserver/e-data-server-util.c 2026-02-23 14:51:18.180055364 -0600
@@ -3443,3 +3443,45 @@ e_util_get_directory_variants (const gch
return camel_util_get_directory_variants (main_path, replace_prefix, with_modules_dir);
}
+
+/**
+ * e_util_filename_is_in_path:
+ * @filename: a filename
+ * @path: an expected path
+ *
+ * Checks whether the @filename is stored under @path.
+ * It use canonicalized form of the paths before comparing them.
+ * Both the @filename and @path are expected to be absolute paths,
+ * is not, %FALSE is returned.
+ *
+ * Returns: whether the @filename is stored under @path
+ *
+ * Since: 3.60
+ **/
+gboolean
+e_util_filename_is_in_path (const gchar *filename,
+ const gchar *path)
+{
+ gchar *canon_filename, *canon_path;
+ gsize path_len;
+ gboolean res;
+
+ g_return_val_if_fail (filename != NULL, FALSE);
+ g_return_val_if_fail (path != NULL, FALSE);
+
+ if (!g_path_is_absolute (filename) ||
+ !g_path_is_absolute (path))
+ return FALSE;
+
+ canon_filename = g_canonicalize_filename (filename, NULL);
+ canon_path = g_canonicalize_filename (path, NULL);
+ path_len = strlen (canon_path);
+
+ res = path_len > 0 && g_str_has_prefix (canon_filename, canon_path) &&
+ canon_filename[path_len] == G_DIR_SEPARATOR;
+
+ g_free (canon_filename);
+ g_free (canon_path);
+
+ return res;
+}
diff -urp evolution-data-server-3.42.5.orig/src/libedataserver/e-data-server-util.h evolution-data-server-3.42.5/src/libedataserver/e-data-server-util.h
--- evolution-data-server-3.42.5.orig/src/libedataserver/e-data-server-util.h 2022-05-04 08:40:30.000000000 -0500
+++ evolution-data-server-3.42.5/src/libedataserver/e-data-server-util.h 2026-02-23 14:53:13.147183374 -0600
@@ -298,6 +298,8 @@ gint e_util_source_compare_for_sort (st
GPtrArray * e_util_get_directory_variants (const gchar *main_path,
const gchar *replace_prefix,
gboolean with_modules_dir);
+gboolean e_util_filename_is_in_path (const gchar *filename,
+ const gchar *path);
G_END_DECLS
diff -urp evolution-data-server-3.42.5.orig/tests/libedataserver/libedataserver-test.c evolution-data-server-3.42.5/tests/libedataserver/libedataserver-test.c
--- evolution-data-server-3.42.5.orig/tests/libedataserver/libedataserver-test.c 2022-05-04 08:40:30.000000000 -0500
+++ evolution-data-server-3.42.5/tests/libedataserver/libedataserver-test.c 2026-02-23 14:51:18.180956812 -0600
@@ -86,6 +86,43 @@ test_webdav_href_compare (ETestServerFix
}
}
+static void
+test_filename_is_in_path (ETestServerFixture *fixture,
+ gconstpointer user_data)
+{
+ struct _tests {
+ const gchar *filename;
+ const gchar *path;
+ gboolean expected;
+ } tests[] = {
+ { "/home/user/.cache/dir/", "/home/user/.cache/dir", FALSE },
+ { "/home/user/.cache/dir", "/home/user/.cache/dir", FALSE },
+ { "/home/user/.cache/dir", "/home/user/.cache/dir/", FALSE },
+ { "/home/user/.cache/dir/", "/home/user/.cache/dir/", FALSE },
+ { "/home/user/.cache/dir/file.txt", "/home/user/.cache/dir/", TRUE },
+ { "/home/user/.cache/dir/file.txt", "/home/user/.cache/dir", TRUE },
+ { "/home/user/.cache/dir/subdir/file.txt", "/home/user/.cache/dir/", TRUE },
+ { "/home/user/.cache/dir/subdir/file.txt", "/home/user/.cache/dir", TRUE },
+ { "/home/user/.cache/dir/./file.txt", "/home/user/.cache/dir/", TRUE },
+ { "/home/user/.cache/dir/./file.txt", "/home/user/.cache/dir", TRUE },
+ { "/home/user/.cache/dir/../file.txt", "/home/user/.cache/dir/", FALSE },
+ { "/home/user/.cache/dir/../file.txt", "/home/user/.cache/dir", FALSE },
+ { "/home/user/.cache/dir/.././dir/../../.cache/./dir/file.txt", "/home/user/.cache/dir/", TRUE },
+ { "/home/user/.cache/dir/.././dir/../../.cache/./dir/file.txt", "/home/user/.cache/dir", TRUE },
+ { "/home/user/.cache/dir/../../../../var/lib/file.txt", "/home/user/.cache/dir/", FALSE },
+ { "/home/user/.cache/dir/../../../../var/lib/file.txt", "/home/user/.cache/dir", FALSE },
+ { "./file.txt", "/home/user/.cache/dir", FALSE },
+ { "../file.txt", "/home/user/.cache/dir", FALSE }
+ };
+ gint ii;
+
+ for (ii = 0; ii < G_N_ELEMENTS (tests); ii++) {
+ gboolean result = e_util_filename_is_in_path (tests[ii].filename, tests[ii].path);
+
+ g_assert_cmpint ((result ? 1 : 0), ==, (tests[ii].expected ? 1 : 0));
+ }
+}
+
gint
main (gint argc,
gchar **argv)
@@ -99,6 +136,12 @@ main (gint argc,
e_test_server_utils_setup,
test_webdav_href_compare,
e_test_server_utils_teardown);
+ g_test_add (
+ "/libedataserver-test/FilenameIsInPath",
+ ETestServerFixture, &test_closure,
+ e_test_server_utils_setup,
+ test_filename_is_in_path,
+ e_test_server_utils_teardown);
return e_test_server_utils_run (argc, argv);
}
