summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Sturmlechner <asturm@gentoo.org>2019-08-08 15:22:41 +0200
committerAndreas Sturmlechner <asturm@gentoo.org>2019-08-08 18:51:32 +0200
commit46ef30b8118f412f7a989bd737dd60431fc2f2cd (patch)
treef6965ba22f64d18d66228060290eac692cb23581 /kde-frameworks
parentapp-office/libreoffice: Update USE !java and add USE !firebird notice (diff)
downloadgentoo-46ef30b8118f412f7a989bd737dd60431fc2f2cd.tar.gz
gentoo-46ef30b8118f412f7a989bd737dd60431fc2f2cd.tar.bz2
gentoo-46ef30b8118f412f7a989bd737dd60431fc2f2cd.zip
kde-frameworks/kconfig: Fix CVE-2019-14744
Package-Manager: Portage-2.3.71, Repoman-2.3.17 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org>
Diffstat (limited to 'kde-frameworks')
-rw-r--r--kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch147
-rw-r--r--kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild38
2 files changed, 185 insertions, 0 deletions
diff --git a/kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch b/kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch
new file mode 100644
index 00000000000..e8a799ca5d2
--- /dev/null
+++ b/kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch
@@ -0,0 +1,147 @@
+From 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 Mon Sep 17 00:00:00 2001
+From: David Faure <faure@kde.org>
+Date: Wed, 7 Aug 2019 09:35:36 +0200
+Subject: Security: remove support for $(...) in config keys with [$e] marker.
+
+Summary:
+It is very unclear at this point what a valid use case for this feature
+would possibly be. The old documentation only mentions $(hostname) as
+an example, which can be done with $HOSTNAME instead.
+
+Note that $(...) is still supported in Exec lines of desktop files,
+this does not require [$e] anyway (and actually works better without it,
+otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...).
+
+Test Plan:
+ctest passes; various testcases with $(...) in desktop files,
+directory files, and config files, no longer execute commands.
+
+Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team
+
+Reviewed By: mdawson, davidedmundson
+
+Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel
+
+Tags: #frameworks
+
+Differential Revision: https://phabricator.kde.org/D22979
+---
+ autotests/kconfigtest.cpp | 10 ++--------
+ docs/options.md | 11 ++++-------
+ src/core/kconfig.cpp | 37 +------------------------------------
+ 3 files changed, 7 insertions(+), 51 deletions(-)
+
+diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp
+index 410b5b8..9af3b46 100644
+--- a/autotests/kconfigtest.cpp
++++ b/autotests/kconfigtest.cpp
+@@ -38,7 +38,7 @@
+ #include <utime.h>
+ #endif
+ #ifndef Q_OS_WIN
+-#include <unistd.h> // gethostname
++#include <unistd.h> // getuid
+ #endif
+
+ KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing)
+@@ -546,14 +546,8 @@ void KConfigTest::testPath()
+ QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH));
+ QVERIFY(group.hasKey("URL"));
+ QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH));
+-#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC)
+- // I don't know if this will work on windows
+- // This test hangs on OS X
+ QVERIFY(group.hasKey("hostname"));
+- char hostname[256];
+- QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0);
+- QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname));
+-#endif
++ QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name
+ QVERIFY(group.hasKey("noeol"));
+ QCOMPARE(group.readEntry("noeol", QString()), QString("foo"));
+
+diff --git a/docs/options.md b/docs/options.md
+index c634c00..4a6e9bc 100644
+--- a/docs/options.md
++++ b/docs/options.md
+@@ -67,18 +67,15 @@ environment variables (and `XDG_CONFIG_HOME` in particular).
+ Shell Expansion
+ ---------------
+
+-If an entry is marked with `$e`, environment variables and shell commands will
+-be expanded.
++If an entry is marked with `$e`, environment variables will be expanded.
+
+ Name[$e]=$USER
+- Host[$e]=$(hostname)
+
+ When the "Name" entry is read `$USER` will be replaced with the value of the
+-`$USER` environment variable, and `$(hostname)` will be replaced with the output
+-of the `hostname` command.
++`$USER` environment variable.
+
+-Note that the application will replace `$USER` and `$(hostname)` with their
+-respective expanded values after saving. To prevent this combine the `$e` option
++Note that the application will replace `$USER` with its
++expanded value after saving. To prevent this combine the `$e` option
+ with `$i` (immmutable) option. For example:
+
+ Name[$ei]=$USER
+diff --git a/src/core/kconfig.cpp b/src/core/kconfig.cpp
+index e1b11ed..f6824ce 100644
+--- a/src/core/kconfig.cpp
++++ b/src/core/kconfig.cpp
+@@ -28,19 +28,6 @@
+ #include <cstdlib>
+ #include <fcntl.h>
+
+-#ifdef _MSC_VER
+-static inline FILE *popen(const char *cmd, const char *mode)
+-{
+- return _popen(cmd, mode);
+-}
+-static inline int pclose(FILE *stream)
+-{
+- return _pclose(stream);
+-}
+-#else
+-#include <unistd.h>
+-#endif
+-
+ #include "kconfigbackend_p.h"
+ #include "kconfiggroup.h"
+
+@@ -183,29 +170,7 @@ QString KConfigPrivate::expandString(const QString &value)
+ int nDollarPos = aValue.indexOf(QLatin1Char('$'));
+ while (nDollarPos != -1 && nDollarPos + 1 < aValue.length()) {
+ // there is at least one $
+- if (aValue[nDollarPos + 1] == QLatin1Char('(')) {
+- int nEndPos = nDollarPos + 1;
+- // the next character is not $
+- while ((nEndPos <= aValue.length()) && (aValue[nEndPos] != QLatin1Char(')'))) {
+- nEndPos++;
+- }
+- nEndPos++;
+- QString cmd = aValue.mid(nDollarPos + 2, nEndPos - nDollarPos - 3);
+-
+- QString result;
+-
+-// FIXME: wince does not have pipes
+-#ifndef _WIN32_WCE
+- FILE *fs = popen(QFile::encodeName(cmd).data(), "r");
+- if (fs) {
+- QTextStream ts(fs, QIODevice::ReadOnly);
+- result = ts.readAll().trimmed();
+- pclose(fs);
+- }
+-#endif
+- aValue.replace(nDollarPos, nEndPos - nDollarPos, result);
+- nDollarPos += result.length();
+- } else if (aValue[nDollarPos + 1] != QLatin1Char('$')) {
++ if (aValue[nDollarPos + 1] != QLatin1Char('$')) {
+ int nEndPos = nDollarPos + 1;
+ // the next character is not $
+ QStringRef aVarName;
+--
+cgit v1.1
+
diff --git a/kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild b/kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild
new file mode 100644
index 00000000000..c2c4035e267
--- /dev/null
+++ b/kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild
@@ -0,0 +1,38 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+VIRTUALX_REQUIRED="test"
+inherit kde5
+
+DESCRIPTION="Framework for reading and writing configuration"
+LICENSE="LGPL-2+"
+KEYWORDS="~amd64 ~arm ~arm64 ~x86"
+IUSE="dbus nls"
+
+BDEPEND="
+ nls? ( $(add_qt_dep linguist-tools) )
+"
+RDEPEND="
+ $(add_qt_dep qtgui)
+ $(add_qt_dep qtxml)
+ dbus? ( $(add_qt_dep qtdbus) )
+"
+DEPEND="${RDEPEND}
+ test? ( $(add_qt_dep qtconcurrent) )
+"
+
+# bug 560086
+RESTRICT+=" test"
+
+DOCS=( DESIGN docs/DESIGN.kconfig docs/options.md )
+
+PATCHES=( "${FILESDIR}/${P}-CVE-2019-14744.patch")
+
+src_configure() {
+ local mycmakeargs=(
+ -DKCONFIG_USE_DBUS=$(usex dbus)
+ )
+ kde5_src_configure
+}