Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=6540e3e48765235601ae6acb3429b5fbe96b1c69
commit 6540e3e48765235601ae6acb3429b5fbe96b1c69 Author: kikadf <[email protected]> Date: Mon Apr 14 09:26:09 2014 +0200 actionpack-3.2.6-2arcturus1-x86_64 * Fix CVE-2012-3424, CVE-2012-3463, CVE-2012-3465, CVE-2013-0155, * CVE-2013-1855, CVE-2013-1857, CVE-2013-4389, CVE-2013-4491, * CVE-2013-6414, CVE-2013-6415, CVE-2013-6417 diff --git a/source/devel-extra/actionpack/CVE-2012-3424.patch b/source/devel-extra/actionpack/CVE-2012-3424.patch new file mode 100644 index 0000000..8fdf1f2 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2012-3424.patch @@ -0,0 +1,22 @@ +Description: Do not convert digest auth strings to symbols. +Author: Aaron Patterson <[email protected]> + +--- + +Origin: upstream, https://github.com/rails/rails/commit/27311fef5efa598f281649074255834546d2b4ec +Forwarded: not-needed + +--- ruby-actionpack-3.2-3.2.6.orig/lib/action_controller/metal/http_authentication.rb ++++ ruby-actionpack-3.2-3.2.6/lib/action_controller/metal/http_authentication.rb +@@ -227,9 +227,9 @@ module ActionController + end + + def decode_credentials(header) +- Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| ++ HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| + key, value = pair.split('=', 2) +- [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')] ++ [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')] + end] + end + diff --git a/source/devel-extra/actionpack/CVE-2012-3463.patch b/source/devel-extra/actionpack/CVE-2012-3463.patch new file mode 100644 index 0000000..356f8d0 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2012-3463.patch @@ -0,0 +1,30 @@ +From ec30fba02d2d3a0c90dfc9a38629d2c0d55bf8c1 Mon Sep 17 00:00:00 2001 +From: Santiago Pastorino <[email protected]> +Date: Wed, 8 Aug 2012 15:10:35 -0700 +Subject: [PATCH] escape select_tag :prompt values + +--- + actionpack/lib/action_view/helpers/form_tag_helper.rb | 4 ++-- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git actionpack/lib/action_view/helpers/form_tag_helper.rb actionpack/lib/action_view/helpers/form_tag_helper.rb +index 066b98d..9e0ec17 100644 +--- actionpack/lib/action_view/helpers/form_tag_helper.rb ++++ actionpack/lib/action_view/helpers/form_tag_helper.rb +@@ -122,11 +122,11 @@ module ActionView + html_name = (options[:multiple] == true && !name.to_s.ends_with?("[]")) ? "#{name}[]" : name + + if options.delete(:include_blank) +- option_tags = "<option value=\"\"></option>".html_safe + option_tags ++ option_tags = content_tag(:option, '', :value => '').safe_concat(option_tags) + end + + if prompt = options.delete(:prompt) +- option_tags = "<option value=\"\">#{prompt}</option>".html_safe + option_tags ++ option_tags = content_tag(:option, prompt, :value => '').safe_concat(option_tags) + end + + content_tag :select, option_tags, { "name" => html_name, "id" => sanitize_to_id(name) }.update(options.stringify_keys) +-- +1.7.11.1 + diff --git a/source/devel-extra/actionpack/CVE-2012-3465.patch b/source/devel-extra/actionpack/CVE-2012-3465.patch new file mode 100644 index 0000000..2d583d9 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2012-3465.patch @@ -0,0 +1,26 @@ +From bb98352d42d654970299450b009223968a53c6f8 Mon Sep 17 00:00:00 2001 +From: Santiago Pastorino <[email protected]> +Date: Wed, 8 Aug 2012 14:33:39 -0700 +Subject: [PATCH] Do not mark strip_tags result as html_safe + +Thanks to Marek Labos & Nethemba +--- + actionpack/lib/action_view/helpers/sanitize_helper.rb | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git actionpack/lib/action_view/helpers/sanitize_helper.rb actionpack/lib/action_view/helpers/sanitize_helper.rb +index 7768c8c..0f6a5ed 100644 +--- actionpack/lib/action_view/helpers/sanitize_helper.rb ++++ actionpack/lib/action_view/helpers/sanitize_helper.rb +@@ -80,7 +80,7 @@ module ActionView + # strip_tags("<div id='top-bar'>Welcome to my website!</div>") + # # => Welcome to my website! + def strip_tags(html) +- self.class.full_sanitizer.sanitize(html).try(:html_safe) ++ self.class.full_sanitizer.sanitize(html) + end + + # Strips all link tags from +text+ leaving just the link text. +-- +1.7.11.1 + diff --git a/source/devel-extra/actionpack/CVE-2013-0155.patch b/source/devel-extra/actionpack/CVE-2013-0155.patch new file mode 100644 index 0000000..94c581b --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-0155.patch @@ -0,0 +1,57 @@ +From b7d666e95aee11e441908278425d16deef87cefb Mon Sep 17 00:00:00 2001 +From: Aaron Patterson <[email protected]> +Date: Fri, 4 Jan 2013 12:02:22 -0800 +Subject: [PATCH 1/2] * Strip nils from collections on JSON and XML posts. + [CVE-2013-0155] * dealing with empty hashes. Thanks + Damien Mathieu + +--- a/lib/action_dispatch/http/request.rb ++++ b/lib/action_dispatch/http/request.rb +@@ -247,18 +247,14 @@ module ActionDispatch + LOCALHOST.any? { |local_ip| local_ip === remote_addr && local_ip === remote_ip } + end + +- protected +- + # Remove nils from the params hash + def deep_munge(hash) +- keys = hash.keys.find_all { |k| hash[k] == [nil] } +- keys.each { |k| hash[k] = nil } +- +- hash.each_value do |v| ++ hash.each do |k, v| + case v + when Array + v.grep(Hash) { |x| deep_munge(x) } + v.compact! ++ hash[k] = nil if v.empty? + when Hash + deep_munge(v) + end +@@ -267,6 +263,8 @@ module ActionDispatch + hash + end + ++ protected ++ + def parse_query(qs) + deep_munge(super) + end +--- a/lib/action_dispatch/middleware/params_parser.rb ++++ b/lib/action_dispatch/middleware/params_parser.rb +@@ -38,13 +38,13 @@ module ActionDispatch + when Proc + strategy.call(request.raw_post) + when :xml_simple, :xml_node +- data = Hash.from_xml(request.body.read) || {} ++ data = request.deep_munge(Hash.from_xml(request.body.read) || {}) + request.body.rewind if request.body.respond_to?(:rewind) + data.with_indifferent_access + when :yaml + YAML.load(request.raw_post) + when :json +- data = ActiveSupport::JSON.decode(request.body) ++ data = request.deep_munge ActiveSupport::JSON.decode(request.body) + request.body.rewind if request.body.respond_to?(:rewind) + data = {:_json => data} unless data.is_a?(Hash) + data.with_indifferent_access diff --git a/source/devel-extra/actionpack/CVE-2013-1855.patch b/source/devel-extra/actionpack/CVE-2013-1855.patch new file mode 100644 index 0000000..7b2c7f9 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-1855.patch @@ -0,0 +1,22 @@ +--- a/lib/action_controller/vendor/html-scanner/html/sanitizer.rb ++++ b/lib/action_controller/vendor/html-scanner/html/sanitizer.rb +@@ -110,8 +110,8 @@ module HTML + style = style.to_s.gsub(/url\s*\(\s*[^\s)]+?\s*\)\s*/, ' ') + + # gauntlet +- if style !~ /^([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*$/ || +- style !~ /^(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*$/ ++ if style !~ /\A([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*\z/ || ++ style !~ /\A(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*\z/ + return '' + end + +@@ -122,7 +122,7 @@ module HTML + elsif shorthand_css_properties.include?(prop.split('-')[0].downcase) + unless val.split().any? do |keyword| + !allowed_css_keywords.include?(keyword) && +- keyword !~ /^(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)$/ ++ keyword !~ /\A(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)\z/ + end + clean << prop + ': ' + val + ';' + end diff --git a/source/devel-extra/actionpack/CVE-2013-1857.patch b/source/devel-extra/actionpack/CVE-2013-1857.patch new file mode 100644 index 0000000..f9fe8ce --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-1857.patch @@ -0,0 +1,20 @@ +--- a/lib/action_controller/vendor/html-scanner/html/sanitizer.rb ++++ b/lib/action_controller/vendor/html-scanner/html/sanitizer.rb +@@ -66,7 +66,7 @@ module HTML + + # A regular expression of the valid characters used to separate protocols like + # the ':' in 'http://foo.com' +- self.protocol_separator = /:|(�*58)|(p)|(%|%)3A/ ++ self.protocol_separator = /:|(�*58)|(p)|(�*3a)|(%|%)3A/i + + # Specifies a Set of HTML attributes that can have URIs. + self.uri_attributes = Set.new(%w(href src cite action longdesc xlink:href lowsrc)) +@@ -171,7 +171,7 @@ module HTML + + def contains_bad_protocols?(attr_name, value) + uri_attributes.include?(attr_name) && +- (value =~ /(^[^\/:]*):|(�*58)|(p)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase)) ++ (value =~ /(^[^\/:]*):|(�*58)|(p)|(�*3a)|(%|%)3A/i && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip)) + end + end + end diff --git a/source/devel-extra/actionpack/CVE-2013-4389.patch b/source/devel-extra/actionpack/CVE-2013-4389.patch new file mode 100644 index 0000000..6d4ccf3 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-4389.patch @@ -0,0 +1,50 @@ +From 5aee516b5edb49d7206cd9815c13a78b6b16c5d9 Mon Sep 17 00:00:00 2001 +From: Michael Koziarski <[email protected]> +Date: Mon, 23 Sep 2013 10:17:58 +1200 +Subject: [PATCH] Remove the use of String#% when formatting durations in log + messages + +This avoids potential format string vulnerabilities where user-provided +data is interpolated into the log message before String#% is called. + +--- ruby-actionpack-3.2.orig/lib/action_controller/log_subscriber.rb ++++ ruby-actionpack-3.2/lib/action_controller/log_subscriber.rb +@@ -22,7 +22,7 @@ module ActionController + if status.nil? && payload[:exception].present? + status = Rack::Utils.status_code(ActionDispatch::ExceptionWrapper.new({}, payload[:exception]).status_code) + end +- message = "Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in %.0fms" % event.duration ++ message = "Completed #{status} #{Rack::Utils::HTTP_STATUS_CODES[status]} in #{format_duration(event.duration)}" + message << " (#{additions.join(" | ")})" unless additions.blank? + + info(message) +@@ -33,9 +33,7 @@ module ActionController + end + + def send_file(event) +- message = "Sent file %s" +- message << " (%.1fms)" +- info(message % [event.payload[:path], event.duration]) ++ info("Sent file #{event.payload[:path]} (#{format_duration(event.duration)})") + end + + def redirect_to(event) +@@ -43,7 +41,7 @@ module ActionController + end + + def send_data(event) +- info("Sent data %s (%.1fms)" % [event.payload[:filename], event.duration]) ++ info("Sent data #{event.payload[:filename]} (#{format_duration(event.duration)})") + end + + %w(write_fragment read_fragment exist_fragment? +@@ -52,7 +50,8 @@ module ActionController + def #{method}(event) + key_or_path = event.payload[:key] || event.payload[:path] + human_name = #{method.to_s.humanize.inspect} +- info("\#{human_name} \#{key_or_path} \#{"(%.1fms)" % event.duration}") ++ duration = format_duration(event.duration) ++ info("\#{human_name} \#{key_or_path} \#{duration}") + end + METHOD + end diff --git a/source/devel-extra/actionpack/CVE-2013-4491.patch b/source/devel-extra/actionpack/CVE-2013-4491.patch new file mode 100644 index 0000000..3e17f44 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-4491.patch @@ -0,0 +1,62 @@ +From 616414876d8d93f5b4be0e41d872d40e0e389ee4 Mon Sep 17 00:00:00 2001 +From: Michael Koziarski <[email protected]> +Date: Fri, 1 Nov 2013 11:50:05 +1300 +Subject: [PATCH] Stop using i18n's built in HTML error handling. + +i18n doesn't depend on active support which means it can't use our html_safe +code to do its escaping when generating the spans. Rather than try to sanitize +the output from i18n, just revert to our old behaviour of rescuing the error +and constructing the tag ourselves. + +Fixes: CVE-2013-4491 + +--- ruby-actionpack-3.2.orig/lib/action_view/helpers/translation_helper.rb ++++ ruby-actionpack-3.2/lib/action_view/helpers/translation_helper.rb +@@ -1,24 +1,14 @@ + require 'action_view/helpers/tag_helper' + require 'i18n/exceptions' + +-module I18n +- class ExceptionHandler +- include Module.new { +- def call(exception, locale, key, options) +- exception.is_a?(MissingTranslation) && options[:rescue_format] == :html ? super.html_safe : super +- end +- } +- end +-end +- + module ActionView + # = Action View Translation Helpers + module Helpers + module TranslationHelper + # Delegates to <tt>I18n#translate</tt> but also performs three additional functions. + # +- # First, it'll pass the <tt>:rescue_format => :html</tt> option to I18n so that any +- # thrown +MissingTranslation+ messages will be turned into inline spans that ++ # First, it will ensure that any thrown +MissingTranslation+ messages will be turned ++ # into inline spans that: + # + # * have a "translation-missing" class set, + # * contain the missing key as a title attribute and +@@ -44,7 +34,9 @@ module ActionView + # naming convention helps to identify translations that include HTML tags so that + # you know what kind of output to expect when you call translate in a template. + def translate(key, options = {}) +- options.merge!(:rescue_format => :html) unless options.key?(:rescue_format) ++ # If the user has specified rescue_format then pass it all through, otherwise use ++ # raise and do the work ourselves ++ options[:raise] = true unless options.key?(:raise) || options.key?(:rescue_format) + if html_safe_translation_key?(key) + html_safe_options = options.dup + options.except(*I18n::RESERVED_KEYS).each do |name, value| +@@ -58,6 +50,9 @@ module ActionView + else + I18n.translate(scope_key_by_partial(key), options) + end ++ rescue I18n::MissingTranslationData => e ++ keys = I18n.normalize_keys(e.locale, e.key, e.options[:scope]) ++ content_tag('span', keys.last.to_s.titleize, :class => 'translation_missing', :title => "translation missing: #{keys.join('.')}") + end + alias :t :translate + diff --git a/source/devel-extra/actionpack/CVE-2013-6414.patch b/source/devel-extra/actionpack/CVE-2013-6414.patch new file mode 100644 index 0000000..f021ae2 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-6414.patch @@ -0,0 +1,23 @@ +From bee3b7f9371d1e2ddcfe6eaff5dcb26c0a248068 Mon Sep 17 00:00:00 2001 +From: Aaron Patterson <[email protected]> +Date: Sat, 30 Nov 2013 17:02:53 -0800 +Subject: [PATCH] Only use valid mime type symbols as cache keys + +CVE-2013-6414 + +--- ruby-actionpack-3.2.orig/lib/action_view/lookup_context.rb ++++ ruby-actionpack-3.2/lib/action_view/lookup_context.rb +@@ -56,6 +56,13 @@ module ActionView + @details_keys = Hash.new + + def self.get(details) ++ if details[:formats] ++ details = details.dup ++ syms = Set.new Mime::SET.symbols ++ details[:formats] = details[:formats].select { |v| ++ syms.include? v ++ } ++ end + @details_keys[details] ||= new + end + diff --git a/source/devel-extra/actionpack/CVE-2013-6415.patch b/source/devel-extra/actionpack/CVE-2013-6415.patch new file mode 100644 index 0000000..0cc33d5 --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-6415.patch @@ -0,0 +1,18 @@ +From 015fab69f597de2ff909ec7a7a07f7fa0007f4d9 Mon Sep 17 00:00:00 2001 +From: Michael Koziarski <[email protected]> +Date: Wed, 13 Nov 2013 16:14:07 +1300 +Subject: [PATCH] Escape the unit value provided to number_to_currency + +Fixes CVE-2013-6415 + +--- ruby-actionpack-3.2.orig/lib/action_view/helpers/number_helper.rb ++++ ruby-actionpack-3.2/lib/action_view/helpers/number_helper.rb +@@ -144,7 +144,7 @@ module ActionView + + begin + value = number_with_precision(number, options.merge(:raise => true)) +- format.gsub(/%n/, value).gsub(/%u/, unit).html_safe ++ format.gsub(/%n/, ERB::Util.html_escape(value)).gsub(/%u/, ERB::Util.html_escape(unit)).html_safe + rescue InvalidNumberError => e + if options[:raise] + raise diff --git a/source/devel-extra/actionpack/CVE-2013-6417.patch b/source/devel-extra/actionpack/CVE-2013-6417.patch new file mode 100644 index 0000000..47edb6f --- /dev/null +++ b/source/devel-extra/actionpack/CVE-2013-6417.patch @@ -0,0 +1,29 @@ +From 75d452c06390118fc16c830439fccccd5a438285 Mon Sep 17 00:00:00 2001 +From: Michael Koziarski <[email protected]> +Date: Sat, 30 Nov 2013 16:45:23 +1300 +Subject: [PATCH] Deep Munge the parameters for GET and POST + +The previous implementation of this functionality could be accidentally +subverted by instantiating a raw Rack::Request before the first Rails::Request +was constructed. + +Fixes CVE-2013-6417 + +--- ruby-actionpack-3.2.orig/lib/action_dispatch/http/request.rb ++++ ruby-actionpack-3.2/lib/action_dispatch/http/request.rb +@@ -222,13 +222,13 @@ module ActionDispatch + + # Override Rack's GET method to support indifferent access + def GET +- @env["action_dispatch.request.query_parameters"] ||= (normalize_parameters(super) || {}) ++ @env["action_dispatch.request.query_parameters"] ||= deep_munge(normalize_parameters(super) || {}) + end + alias :query_parameters :GET + + # Override Rack's POST method to support indifferent access + def POST +- @env["action_dispatch.request.request_parameters"] ||= (normalize_parameters(super) || {}) ++ @env["action_dispatch.request.request_parameters"] ||= deep_munge(normalize_parameters(super) || {}) + end + alias :request_parameters :POST + diff --git a/source/devel-extra/actionpack/FrugalBuild b/source/devel-extra/actionpack/FrugalBuild index a5950ef..4b10159 100644 --- a/source/devel-extra/actionpack/FrugalBuild +++ b/source/devel-extra/actionpack/FrugalBuild @@ -1,9 +1,10 @@ # Compiling Time: 0.45 SBU +# Contributor: kikadf <[email protected]> # Maintainer: jercel <[email protected]> pkgname=actionpack pkgver=3.2.6 -pkgrel=1 +pkgrel=2arcturus1 pkgdesc="Eases web-request routing, handling, and response." url="http://rubyforge.org/projects/actionpack/"; depends=('activesupport>=3.2.6') @@ -11,3 +12,22 @@ groups=('devel-extra') archs=('i686' 'x86_64') Finclude gem sha1sums=('699cfcdd1e279f9e86e4c0a935b51570fd293ad9') + +# FSA fix *** +source=(${source[@]} CVE-2012-3424.patch CVE-2012-3463.patch CVE-2012-3465.patch + CVE-2013-0155.patch CVE-2013-1855.patch CVE-2013-1857.patch + CVE-2013-4389.patch CVE-2013-4491.patch CVE-2013-6414.patch + CVE-2013-6415.patch CVE-2013-6417.patch) +sha1sums=(${sha1sums[@]} 'e1296be7281fb5cd29402e73fd782fbd35b85b18' \ + '3363cb439105c87268c7e9c5800d643ff417f7c5' \ + '595c1696b04f94754fe4bceec06302e7fcb86e6c' \ + '75624eca4b6036fcbb17b6417a7f9047ae0046cb' \ + 'ce27966f0a7326e9f3bbac17415e20f010523a17' \ + '24d981ec4bb394ad395b2e5f421c1e8b37702cd3' \ + '8ea549433393bdc911f92bf31a093d915fbae252' \ + 'e839bc93528cc00bec59913708f4d4db452f93bd' \ + '96222bd83d5f9a5f88b12aa58f68a7b83676578f' \ + '4846c25e2b4e4afe9545fcb8b861f6fbedf7e94a' \ + '59179b172db651fd3b3bee2e1b4a893439780a3a') +# *********** + _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
