diff options
3 files changed, 156 insertions, 0 deletions
diff --git a/kde-frameworks/karchive/files/karchive-5.21.0-CVE-2016-6232.patch b/kde-frameworks/karchive/files/karchive-5.21.0-CVE-2016-6232.patch new file mode 100644 index 000000000000..b5c0608d91ff --- /dev/null +++ b/kde-frameworks/karchive/files/karchive-5.21.0-CVE-2016-6232.patch @@ -0,0 +1,92 @@ +commit 0cb243f64eef45565741b27364cece7d5c349c37 +Author: Andreas Cord-Landwehr <cordlandwehr@kde.org> +Date: Tue Jun 14 15:52:49 2016 +0200 + + Ensure extraction location to be in subfolder + + Behavior change: Switch to Tar's default behavior to avoid extraction + to arbitrary system locations outside of extraction folder. Instead, + extract such files to root location in extraction folder. + + REVIEW: 128185 + +diff --git a/autotests/karchivetest.cpp b/autotests/karchivetest.cpp +index c8abddf..549ed26 100644 +--- a/autotests/karchivetest.cpp ++++ b/autotests/karchivetest.cpp +@@ -760,6 +760,24 @@ void KArchiveTest::testTarDirectoryTwice() // bug 206994 + + QCOMPARE(listing.count(), 3); + } ++ ++void KArchiveTest::testTarIgnoreRelativePathOutsideArchive() ++{ ++ // This test extracts a Tar archive that contains a relative path "../foo" pointing ++ // outside of the archive directory. For security reasons extractions should only ++ // be allowed within the extracted directory as long as not specifically asked. ++ ++ KTar tar(QFINDTESTDATA(QLatin1String("tar_relative_path_outside_archive.tar.bz2"))); ++ QVERIFY(tar.open(QIODevice::ReadOnly)); ++ ++ const KArchiveDirectory *dir = tar.directory(); ++ QTemporaryDir tmpDir; ++ const QString dirName = tmpDir.path() + '/'; ++ ++ QVERIFY(dir->copyTo(dirName)); ++ QVERIFY(!QFile::exists(dirName + "../foo")); ++ QVERIFY(QFile::exists(dirName + "/foo")); ++} + /// + + static const char s_zipFileName[] = "karchivetest.zip"; +diff --git a/autotests/karchivetest.h b/autotests/karchivetest.h +index 4b7ecff..5a6375c 100644 +--- a/autotests/karchivetest.h ++++ b/autotests/karchivetest.h +@@ -76,6 +76,7 @@ private Q_SLOTS: + void testTarDirectoryForgotten(); + void testTarRootDir(); + void testTarDirectoryTwice(); ++ void testTarIgnoreRelativePathOutsideArchive(); + + void testCreateZip(); + void testCreateZipError(); +diff --git a/autotests/tar_relative_path_outside_archive.tar.bz2 b/autotests/tar_relative_path_outside_archive.tar.bz2 +new file mode 100644 +index 0000000..50a3aca +Binary files /dev/null and b/autotests/tar_relative_path_outside_archive.tar.bz2 differ +diff --git a/src/karchive.cpp b/src/karchive.cpp +index 5a7cfc6..7683c7f 100644 +--- a/src/karchive.cpp ++++ b/src/karchive.cpp +@@ -841,6 +841,7 @@ static bool sortByPosition(const KArchiveFile *file1, const KArchiveFile *file2) + bool KArchiveDirectory::copyTo(const QString &dest, bool recursiveCopy) const + { + QDir root; ++ const QString destDir(QDir(dest).absolutePath()); // get directory path without any "." or ".." + + QList<const KArchiveFile *> fileList; + QMap<qint64, QString> fileToDir; +@@ -850,10 +851,20 @@ bool KArchiveDirectory::copyTo(const QString &dest, bool recursiveCopy) const + QStack<QString> dirNameStack; + + dirStack.push(this); // init stack at current directory +- dirNameStack.push(dest); // ... with given path ++ dirNameStack.push(destDir); // ... with given path + do { + const KArchiveDirectory *curDir = dirStack.pop(); +- const QString curDirName = dirNameStack.pop(); ++ ++ // extract only to specified folder if it is located within archive's extraction folder ++ // otherwise put file under root position in extraction folder ++ QString curDirName = dirNameStack.pop(); ++ if (!QDir(curDirName).absolutePath().startsWith(destDir)) { ++ qWarning() << "Attempted export into folder" << curDirName ++ << "which is outside of the extraction root folder" << destDir << "." ++ << "Changing export of contained files to extraction root folder."; ++ curDirName = destDir; ++ } ++ + if (!root.mkpath(curDirName)) { + return false; + } diff --git a/kde-frameworks/karchive/karchive-5.21.0-r1.ebuild b/kde-frameworks/karchive/karchive-5.21.0-r1.ebuild new file mode 100644 index 000000000000..698a1bd7be42 --- /dev/null +++ b/kde-frameworks/karchive/karchive-5.21.0-r1.ebuild @@ -0,0 +1,32 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 + +inherit kde5 + +DESCRIPTION="Framework for reading, creation, and manipulation of various archive formats" +LICENSE="GPL-2 LGPL-2.1" +KEYWORDS="~amd64 ~arm ~x86" +IUSE="+bzip2 +lzma" + +RDEPEND=" + bzip2? ( app-arch/bzip2 ) + lzma? ( app-arch/xz-utils ) + sys-libs/zlib +" +DEPEND="${RDEPEND}" + +PATCHES=( "${FILESDIR}/${P}-CVE-2016-6232.patch" ) + +RESTRICT="test" + +src_configure() { + local mycmakeargs=( + $(cmake-utils_use_find_package bzip2 BZip2) + $(cmake-utils_use_find_package lzma LibLZMA) + ) + + kde5_src_configure +} diff --git a/kde-frameworks/karchive/karchive-5.23.0-r1.ebuild b/kde-frameworks/karchive/karchive-5.23.0-r1.ebuild new file mode 100644 index 000000000000..55a5937e1b20 --- /dev/null +++ b/kde-frameworks/karchive/karchive-5.23.0-r1.ebuild @@ -0,0 +1,32 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 + +inherit kde5 + +DESCRIPTION="Framework for reading, creation, and manipulation of various archive formats" +LICENSE="GPL-2 LGPL-2.1" +KEYWORDS="~amd64 ~arm ~x86" +IUSE="+bzip2 +lzma" + +RDEPEND=" + bzip2? ( app-arch/bzip2 ) + lzma? ( app-arch/xz-utils ) + sys-libs/zlib +" +DEPEND="${RDEPEND}" + +PATCHES=( "${FILESDIR}/${PN}-5.21.0-CVE-2016-6232.patch" ) + +RESTRICT="test" + +src_configure() { + local mycmakeargs=( + $(cmake-utils_use_find_package bzip2 BZip2) + $(cmake-utils_use_find_package lzma LibLZMA) + ) + + kde5_src_configure +} |