File 0001-Fix-path-traversal-issue-when-extracting-a... of Package okular

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-Fix-path-traversal-issue-when-extracting-an-.okular-.patch of Package okular

From 31908e57fc54eb17a83971e6e72b881bb2566093 Mon Sep 17 00:00:00 2001
From: Albert Astals Cid <aacid@kde.org>
Date: Mon, 3 Sep 2018 21:14:30 +0200
Subject: [PATCH] Fix path traversal issue when extracting an .okular file

Summary:
With specially crafted .okular files you can trick okular to create temporary files outside the temporary folder

We fix that by making sure the file doesn't have folders since the ones we create don't

BUGS: 398096

Subscribers: okular-devel

Tags: #okular

Differential Revision: https://phabricator.kde.org/D15192
---
 core/document.cpp | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/core/document.cpp b/core/document.cpp
index b725ecfc7..82fc843a4 100644
--- a/core/document.cpp
+++ b/core/document.cpp
@@ -4428,6 +4428,18 @@ Document::OpenResult Document::openDocumentArchive( const QString & docFile, con
         return OpenError;

const KArchiveDirectory * mainDir = okularArchive.directory();
+
+    // Check the archive doesn't have folders, we don't create them when saving the archive
+    // and folders mean paths and paths mean path traversal issues
+    for ( const QString &entry : mainDir->entries() )
+    {
+        if ( mainDir->entry( entry )->isDirectory() )
+        {
+            qWarning() << "Warning: Found a directory inside" << docFile << " - Okular does not create files like that so it is most probably forged.";
+            return OpenError;
+        }
+    }
+
     const KArchiveEntry * mainEntry = mainDir->entry( QStringLiteral("content.xml") );
     if ( !mainEntry || !mainEntry->isFile() )
         return OpenError;
--
2.18.0

Places

File 0001-Fix-path-traversal-issue-when-extracting-an-.okular-.patch of Package okular

Places