ruby-changes:66676
From: usa <ko1@a...>
Date: Sun, 4 Jul 2021 02:10:41 +0900 (JST)
Subject: [ruby-changes:66676] fe3c49c9ba (ruby_2_6): merge revision(s) b1c73f23, c9ab8fe2: [Backport #17877]
https://git.ruby-lang.org/ruby.git/commit/?id=fe3c49c9ba From fe3c49c9baeeab58304ede915b7edd18ecf360fc Mon Sep 17 00:00:00 2001 From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> Date: Sat, 3 Jul 2021 17:10:28 +0000 Subject: merge revision(s) b1c73f23,c9ab8fe2: [Backport #17877] [ruby/rdoc] Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799 https://github.com/ruby/rdoc/commit/a7f5d6ab88 The test for command injection on Unix platforms should be omitted on Windows git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67947 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- lib/rdoc/rdoc.rb | 2 +- lib/rdoc/version.rb | 2 +- test/rdoc/test_rdoc_rdoc.rb | 12 ++++++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb index ca2c1ab..46aace7 100644 --- a/lib/rdoc/rdoc.rb +++ b/lib/rdoc/rdoc.rb @@ -430,7 +430,7 @@ The internal error was: https://github.com/ruby/ruby/blob/trunk/lib/rdoc/rdoc.rb#L430 files.reject do |file| file =~ /\.(?:class|eps|erb|scpt\.txt|svg|ttf|yml)$/i or (file =~ /tags$/i and - open(file, 'rb') { |io| + File.open(file, 'rb') { |io| io.read(100) =~ /\A(\f\n[^,]+,\d+$|!_TAG_)/ }) end diff --git a/lib/rdoc/version.rb b/lib/rdoc/version.rb index 3291414..dc1ea6c 100644 --- a/lib/rdoc/version.rb +++ b/lib/rdoc/version.rb @@ -3,6 +3,6 @@ module RDoc https://github.com/ruby/ruby/blob/trunk/lib/rdoc/version.rb#L3 ## # RDoc version you are using - VERSION = '6.1.2' + VERSION = '6.1.2.1' end diff --git a/test/rdoc/test_rdoc_rdoc.rb b/test/rdoc/test_rdoc_rdoc.rb index 3bce54b..123b1a4 100644 --- a/test/rdoc/test_rdoc_rdoc.rb +++ b/test/rdoc/test_rdoc_rdoc.rb @@ -420,6 +420,18 @@ class TestRDocRDoc < RDoc::TestCase https://github.com/ruby/ruby/blob/trunk/test/rdoc/test_rdoc_rdoc.rb#L420 end end + def test_remove_unparseable_CVE_2021_31799 + skip 'for Un*x platforms' if Gem.win_platform? + temp_dir do + file_list = ['| touch evil.txt && echo tags'] + file_list.each do |f| + FileUtils.touch f + end + assert_equal file_list, @rdoc.remove_unparseable(file_list) + assert_equal file_list, Dir.children('.') + end + end + def test_setup_output_dir Dir.mktmpdir {|d| path = File.join d, 'testdir' -- cgit v1.1 -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/