Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Leap:15.2:Update
ruby2.5.17209
CVE-2021-31799.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File CVE-2021-31799.patch of Package ruby2.5.17209
From 43f82d8bc5d20774b8412b356ad189f834ba6d56 Mon Sep 17 00:00:00 2001 From: Ali Abdallah <ali.abdallah@suse.com> Date: Wed, 6 Oct 2021 17:37:26 +0200 Subject: [PATCH 3/3] Backport upstream fix for CVE-2021-31799 Backport upstream commit b1c73f239fe9af97de837331849f55d67c27561e [ruby/rdoc] Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799 https://github.com/ruby/rdoc/commit/a7f5d6ab88 --- lib/rdoc/rdoc.rb | 2 +- test/rdoc/test_rdoc_rdoc.rb | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb index 68775c8be1..073f621362 100644 --- a/lib/rdoc/rdoc.rb +++ b/lib/rdoc/rdoc.rb @@ -433,7 +433,7 @@ def remove_unparseable files files.reject do |file| file =~ /\.(?:class|eps|erb|scpt\.txt|svg|ttf|yml)$/i or (file =~ /tags$/i and - open(file, 'rb') { |io| + File.open(file, 'rb') { |io| io.read(100) =~ /\A(\f\n[^,]+,\d+$|!_TAG_)/ }) end diff --git a/test/rdoc/test_rdoc_rdoc.rb b/test/rdoc/test_rdoc_rdoc.rb index bd4794342c..4cbcbd0d53 100644 --- a/test/rdoc/test_rdoc_rdoc.rb +++ b/test/rdoc/test_rdoc_rdoc.rb @@ -366,6 +366,19 @@ def test_remove_unparseable_tags_vim end end + def test_remove_unparseable_CVE_2021_31799 + omit 'for Un*x platforms' if Gem.win_platform? + temp_dir do + file_list = ['| touch evil.txt && echo tags'] + file_list.each do |f| + FileUtils.touch f + end + + assert_equal file_list, @rdoc.remove_unparseable(file_list) + assert_equal file_list, Dir.children('.') + end + end + def test_setup_output_dir Dir.mktmpdir {|d| path = File.join d, 'testdir' -- 2.32.0
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor