summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Sturmlechner <asturm@gentoo.org>2018-09-10 22:33:04 +0200
committerAndreas Sturmlechner <asturm@gentoo.org>2018-09-10 22:38:03 +0200
commit75a72fe24a730420ec692367e4e108d4a0a6d617 (patch)
tree0b1c610e84086837b95cc7c508fce91eb6e1167a
parentsys-cluster/neutron: 13.0.1 bump (diff)
downloadgentoo-75a72fe24a730420ec692367e4e108d4a0a6d617.tar.gz
gentoo-75a72fe24a730420ec692367e4e108d4a0a6d617.tar.bz2
gentoo-75a72fe24a730420ec692367e4e108d4a0a6d617.zip
kde-apps/okular: Fix path traversal issue when extracting .okular file
With a specially crafted .okular files it was possible to trick okular to create temporary files outside the temporary folder. Bug: https://bugs.gentoo.org/665662 KDE-Bug: https://bugs.kde.org/show_bug.cgi?id=398096 See also: https://phabricator.kde.org/D15192 Package-Manager: Portage-2.3.49, Repoman-2.3.10
-rw-r--r--kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch46
-rw-r--r--kde-apps/okular/okular-18.04.3-r1.ebuild106
2 files changed, 152 insertions, 0 deletions
diff --git a/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch b/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch
new file mode 100644
index 00000000000..216f235d864
--- /dev/null
+++ b/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch
@@ -0,0 +1,46 @@
+From 8ff7abc14d41906ad978b6bc67e69693863b9d47 Mon Sep 17 00:00:00 2001
+From: Albert Astals Cid <aacid@kde.org>
+Date: Mon, 3 Sep 2018 21:14:30 +0200
+Subject: Fix path traversal issue when extracting an .okular file
+
+Summary:
+With specially crafted .okular files you can trick okular to create temporary files outside the temporary folder
+
+We fix that by making sure the file doesn't have folders since the ones we create don't
+
+BUGS: 398096
+
+Subscribers: okular-devel
+
+Tags: #okular
+
+Differential Revision: https://phabricator.kde.org/D15192
+---
+ core/document.cpp | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/core/document.cpp b/core/document.cpp
+index 5e3c169..7d46173 100644
+--- a/core/document.cpp
++++ b/core/document.cpp
+@@ -4819,6 +4819,18 @@ ArchiveData *DocumentPrivate::unpackDocumentArchive( const QString &archivePath
+ return nullptr;
+
+ const KArchiveDirectory * mainDir = okularArchive.directory();
++
++ // Check the archive doesn't have folders, we don't create them when saving the archive
++ // and folders mean paths and paths mean path traversal issues
++ for ( const QString &entry : mainDir->entries() )
++ {
++ if ( mainDir->entry( entry )->isDirectory() )
++ {
++ qWarning() << "Warning: Found a directory inside" << archivePath << " - Okular does not create files like that so it is most probably forged.";
++ return nullptr;
++ }
++ }
++
+ const KArchiveEntry * mainEntry = mainDir->entry( QStringLiteral("content.xml") );
+ if ( !mainEntry || !mainEntry->isFile() )
+ return nullptr;
+--
+cgit v0.11.2
diff --git a/kde-apps/okular/okular-18.04.3-r1.ebuild b/kde-apps/okular/okular-18.04.3-r1.ebuild
new file mode 100644
index 00000000000..f802a174ab1
--- /dev/null
+++ b/kde-apps/okular/okular-18.04.3-r1.ebuild
@@ -0,0 +1,106 @@
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+KDE_HANDBOOK="forceoptional"
+KDE_TEST="forceoptional"
+VIRTUALX_REQUIRED="test"
+inherit kde5
+
+DESCRIPTION="Universal document viewer based on KDE Frameworks"
+HOMEPAGE="https://okular.kde.org https://www.kde.org/applications/graphics/okular"
+KEYWORDS="~amd64 ~x86"
+IUSE="chm crypt djvu epub +image-backend markdown mobi mobile +pdf plucker +postscript share speech +tiff"
+
+DEPEND="
+ $(add_frameworks_dep kactivities)
+ $(add_frameworks_dep karchive)
+ $(add_frameworks_dep kbookmarks)
+ $(add_frameworks_dep kcompletion)
+ $(add_frameworks_dep kconfig)
+ $(add_frameworks_dep kconfigwidgets)
+ $(add_frameworks_dep kcoreaddons)
+ $(add_frameworks_dep kcrash)
+ $(add_frameworks_dep kio)
+ $(add_frameworks_dep kjs)
+ $(add_frameworks_dep kparts)
+ $(add_frameworks_dep kpty)
+ $(add_frameworks_dep kwallet)
+ $(add_frameworks_dep threadweaver)
+ $(add_qt_dep qtdbus)
+ $(add_qt_dep qtgui)
+ $(add_qt_dep qtprintsupport)
+ $(add_qt_dep qtsvg)
+ $(add_qt_dep qtwidgets)
+ media-libs/freetype
+ media-libs/phonon[qt5(+)]
+ sys-libs/zlib
+ chm? (
+ $(add_frameworks_dep khtml)
+ dev-libs/chmlib
+ )
+ crypt? ( app-crypt/qca:2[qt5(+)] )
+ djvu? ( app-text/djvu )
+ epub? ( app-text/ebook-tools )
+ image-backend? (
+ $(add_kdeapps_dep libkexiv2)
+ $(add_qt_dep qtgui 'gif,jpeg,png')
+ )
+ markdown? ( app-text/discount )
+ mobi? ( $(add_kdeapps_dep kdegraphics-mobipocket) )
+ pdf? ( app-text/poppler[qt5] )
+ plucker? ( virtual/jpeg:0 )
+ postscript? ( app-text/libspectre )
+ share? ( $(add_frameworks_dep purpose) )
+ speech? ( $(add_qt_dep qtspeech) )
+ tiff? ( media-libs/tiff:0 )
+"
+RDEPEND="${DEPEND}
+ image-backend? ( $(add_frameworks_dep kimageformats) )
+ mobile? (
+ $(add_frameworks_dep kirigami)
+ $(add_qt_dep qtquickcontrols)
+ )
+"
+
+PATCHES=(
+ "${FILESDIR}/${PN}-tests.patch"
+ "${FILESDIR}/${P}-path-traversal-issue.patch"
+)
+
+src_prepare() {
+ kde5_src_prepare
+ use mobile || cmake_comment_add_subdirectory mobile
+ use test || cmake_comment_add_subdirectory conf/autotests
+}
+
+src_configure() {
+ local mycmakeargs=(
+ $(cmake-utils_use_find_package chm CHM)
+ $(cmake-utils_use_find_package crypt Qca-qt5)
+ $(cmake-utils_use_find_package djvu DjVuLibre)
+ $(cmake-utils_use_find_package epub EPub)
+ $(cmake-utils_use_find_package image-backend KF5KExiv2)
+ $(cmake-utils_use_find_package markdown Discount)
+ $(cmake-utils_use_find_package mobi QMobipocket)
+ $(cmake-utils_use_find_package pdf Poppler)
+ $(cmake-utils_use_find_package plucker JPEG)
+ $(cmake-utils_use_find_package postscript LibSpectre)
+ $(cmake-utils_use_find_package share KDEExperimentalPurpose)
+ $(cmake-utils_use_find_package speech Qt5TextToSpeech)
+ $(cmake-utils_use_find_package tiff TIFF)
+ )
+
+ kde5_src_configure
+}
+
+src_test() {
+ # mainshelltest hangs, chmgeneratortest fails, bug #603116
+ # parttest hangs, bug #641728
+ local myctestargs=(
+ -E "(mainshelltest|chmgeneratortest|parttest)"
+ )
+
+ kde5_src_test
+}