Hello community,
here is the log from the commit of package rubygem-loofah for openSUSE:Factory
checked in at 2018-03-22 12:02:56
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rubygem-loofah (Old)
and /work/SRC/openSUSE:Factory/.rubygem-loofah.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-loofah"
Thu Mar 22 12:02:56 2018 rev:6 rq:589031 version:2.2.1
Changes:
--------
--- /work/SRC/openSUSE:Factory/rubygem-loofah/rubygem-loofah.changes
2018-02-20 17:56:07.676190228 +0100
+++ /work/SRC/openSUSE:Factory/.rubygem-loofah.new/rubygem-loofah.changes
2018-03-22 12:08:51.621623304 +0100
@@ -1,0 +2,7 @@
+Tue Mar 20 09:19:17 UTC 2018 - dk...@suse.com
+
+- Update to version 2.2.1
+
+ Fix XSS Vulnerability [CVE-2018-8048]
+
+-------------------------------------------------------------------
Old:
----
loofah-2.2.0.gem
New:
----
loofah-2.2.1.gem
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rubygem-loofah.spec ++++++
--- /var/tmp/diff_new_pack.XQDKMB/_old 2018-03-22 12:08:52.469592909 +0100
+++ /var/tmp/diff_new_pack.XQDKMB/_new 2018-03-22 12:08:52.473592765 +0100
@@ -24,15 +24,16 @@
#
Name: rubygem-loofah
-Version: 2.2.0
+Version: 2.2.1
Release: 0
%define mod_name loofah
%define mod_full_name %{mod_name}-%{version}
BuildRoot: %{_tmppath}/%{name}-%{version}-build
-BuildRequires: ruby-macros >= 5
-BuildRequires: %{ruby}
BuildRequires: %{rubygem gem2rpm}
BuildRequires: %{rubygem rdoc > 3.10}
+BuildRequires: %{ruby}
+BuildRequires: ruby-macros >= 5
+Url: https://github.com/flavorjones/loofah
Source: https://rubygems.org/gems/%{mod_full_name}.gem
Source1: gem2rpm.yml
Summary: HTML/XML manipulation and sanitization based on Nokogiri
++++++ loofah-2.2.0.gem -> loofah-2.2.1.gem ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/CHANGELOG.md new/CHANGELOG.md
--- old/CHANGELOG.md 2018-02-11 23:23:01.000000000 +0100
+++ new/CHANGELOG.md 2018-03-19 21:22:58.000000000 +0100
@@ -1,5 +1,12 @@
# Changelog
+## 2.2.1 / 2018-03-19
+
+Addresses CVE-2018-8048. Loofah allowed non-whitelisted attributes to be
present in sanitized output when input with specially-crafted HTML fragments.
+
+This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
+
+
## 2.2.0 / 2018-02-11
Features:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Manifest.txt new/Manifest.txt
--- old/Manifest.txt 2018-02-11 23:23:01.000000000 +0100
+++ new/Manifest.txt 2018-03-19 21:22:58.000000000 +0100
@@ -5,6 +5,7 @@
Manifest.txt
README.md
Rakefile
+SECURITY.md
benchmark/benchmark.rb
benchmark/fragment.html
benchmark/helper.rb
@@ -14,6 +15,7 @@
lib/loofah/helpers.rb
lib/loofah/html/document.rb
lib/loofah/html/document_fragment.rb
+lib/loofah/html5/libxml2_workarounds.rb
lib/loofah/html5/scrub.rb
lib/loofah/html5/whitelist.rb
lib/loofah/instance_methods.rb
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/README.md new/README.md
--- old/README.md 2018-02-11 23:23:01.000000000 +0100
+++ new/README.md 2018-03-19 21:22:58.000000000 +0100
@@ -310,14 +310,22 @@
## Security
-Some tools may incorrectly report loofah is a potential security
-vulnerability. Loofah depends on Nokogiri, and it's possible to use
-Nokogiri in a dangerous way (by enabling its DTDLOAD option and
-disabling its NONET option). This dangerous Nokogiri configuration,
-which is sometimes used by other components, can create an XML
-External Entity (XXE) vulnerability if the XML data is not trusted.
-However, loofah never enables this dangerous Nokogiri configuration;
-loofah never enables DTDLOAD, and it never disables NONET.
+See [`SECURITY.md`](SECURITY.md) for vulnerability reporting details.
+
+
+### "Secure by Default"
+
+Some tools may incorrectly report Loofah as a potential security
+vulnerability.
+
+Loofah depends on Nokogiri, and it's _possible_ to use Nokogiri in a
+dangerous way (by enabling its DTDLOAD option and disabling its NONET
+option). This specifically allows the opportunity for an XML External
+Entity (XXE) vulnerability if the XML data is untrusted.
+
+However, Loofah __never enables this Nokogiri configuration__; Loofah
+never enables DTDLOAD, and it never disables NONET, thereby protecting
+you by default from this XXE vulnerability.
## Related Links
@@ -345,7 +353,7 @@
## Thank You
-The following people have generously donated via the
Pledgie[http://pledgie.com] badge on the {Loofah github
page}[https://github.com/flavorjones/loofah]:
+The following people have generously donated via the
[Pledgie](http://pledgie.com) badge on the [Loofah github
page](https://github.com/flavorjones/loofah):
* Bill Harding
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Rakefile new/Rakefile
--- old/Rakefile 2018-02-11 23:23:01.000000000 +0100
+++ new/Rakefile 2018-03-19 21:22:58.000000000 +0100
@@ -12,9 +12,9 @@
developer "Mike Dalessio", "mike.dales...@gmail.com"
developer "Bryan Helmkamp", "br...@brynary.com"
- self.extra_rdoc_files = FileList["*.rdoc"]
+ self.extra_rdoc_files = FileList["*.md"]
self.history_file = "CHANGELOG.md"
- self.readme_file = "README.rdoc"
+ self.readme_file = "README.md"
self.license "MIT"
extra_deps << ["nokogiri", ">=1.5.9"]
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/SECURITY.md new/SECURITY.md
--- old/SECURITY.md 1970-01-01 01:00:00.000000000 +0100
+++ new/SECURITY.md 2018-03-19 21:22:58.000000000 +0100
@@ -0,0 +1,18 @@
+# Security and Vulnerability Reporting
+
+The Loofah core contributors take security very seriously and investigate all
reported vulnerabilities.
+
+If you would like to report a vulnerablity or have a security concern
regarding Loofah, please [report it via
HackerOne](https://hackerone.com/loofah/reports/new).
+
+Your report will be acknowledged within 24 hours, and you'll receive a more
detailed response within 72 hours indicating next steps in handling your report.
+
+If you have not received a reply to your submission within 48 hours, there are
a few steps you can take:
+
+* Contact the current security coordinator (Mike Dalessio
<mike.dales...@gmail.com>)
+* Email the Loofah user group at loo...@librelist.com (archive at
http://librelist.com)
+
+Please note, the user group list is a public area. When escalating in that
venue, please do not discuss your issue. Simply say that you're trying to get a
hold of someone from the core team.
+
+The information you share with the Loofah core contributors as part of this
process will be kept confidential within the team, unless or until we need to
share information upstream with our dependent libraries' core teams, at which
point we will notify you.
+
+If a vulnerability is first reported by you, we will credit you with the
discovery in the public disclosure.
Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/loofah/html5/libxml2_workarounds.rb
new/lib/loofah/html5/libxml2_workarounds.rb
--- old/lib/loofah/html5/libxml2_workarounds.rb 1970-01-01 01:00:00.000000000
+0100
+++ new/lib/loofah/html5/libxml2_workarounds.rb 2018-03-19 21:22:58.000000000
+0100
@@ -0,0 +1,26 @@
+# coding: utf-8
+require 'set'
+
+module Loofah
+ #
+ # constants related to working around unhelpful libxml2 behavior
+ #
+ # ಠ_ಠ
+ #
+ module LibxmlWorkarounds
+ #
+ # these attributes and qualifying parent tags are determined by the code
at:
+ #
+ # https://git.gnome.org/browse/libxml2/tree/HTMLtree.c?h=v2.9.2#n714
+ #
+ # see comments about CVE-2018-8048 within the tests for more information
+ #
+ BROKEN_ESCAPING_ATTRIBUTES = Set.new %w[
+ href
+ action
+ src
+ name
+ ]
+ BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG = {"name" => "a"}
+ end
+end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/loofah/html5/scrub.rb
new/lib/loofah/html5/scrub.rb
--- old/lib/loofah/html5/scrub.rb 2018-02-11 23:23:01.000000000 +0100
+++ new/lib/loofah/html5/scrub.rb 2018-03-19 21:22:58.000000000 +0100
@@ -1,5 +1,3 @@
-#encoding: US-ASCII
-
require 'cgi'
require 'crass'
@@ -65,6 +63,8 @@
node.attribute_nodes.each do |attr_node|
node.remove_attribute(attr_node.name) if attr_node.value !~
/[^[:space:]]/
end
+
+ force_correct_attribute_escaping! node
end
def scrub_css_attribute node
@@ -100,6 +100,35 @@
Crass::Parser.stringify sanitized_tree
end
+
+ private
+
+ #
+ # libxml2 >= 2.9.2 fails to escape comments within some attributes.
+ #
+ # see comments about CVE-2018-8048 within the tests for more
information
+ #
+ def force_correct_attribute_escaping! node
+ return unless Nokogiri::VersionInfo.instance.libxml2?
+
+ node.attribute_nodes.each do |attr_node|
+ next unless
LibxmlWorkarounds::BROKEN_ESCAPING_ATTRIBUTES.include?(attr_node.name)
+
+ tag_name =
LibxmlWorkarounds::BROKEN_ESCAPING_ATTRIBUTES_QUALIFYING_TAG[attr_node.name]
+ next unless tag_name.nil? || tag_name == node.name
+
+ #
+ # this block is just like CGI.escape in Ruby 2.4, but
+ # only encodes space and double-quote, to mimic
+ # pre-2.9.2 behavior
+ #
+ encoding = attr_node.value.encoding
+ attr_node.value = attr_node.value.gsub(/[ "]/) do |m|
+ '%' + m.unpack('H2' * m.bytesize).join('%').upcase
+ end.force_encoding(encoding)
+ end
+ end
+
end
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/loofah.rb new/lib/loofah.rb
--- old/lib/loofah.rb 2018-02-11 23:23:01.000000000 +0100
+++ new/lib/loofah.rb 2018-03-19 21:22:58.000000000 +0100
@@ -6,6 +6,7 @@
require 'loofah/elements'
require 'loofah/html5/whitelist'
+require 'loofah/html5/libxml2_workarounds'
require 'loofah/html5/scrub'
require 'loofah/scrubber'
@@ -27,7 +28,7 @@
#
module Loofah
# The version of Loofah you are using
- VERSION = '2.2.0'
+ VERSION = '2.2.1'
class << self
# Shortcut for Loofah::HTML::Document.parse
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/metadata new/metadata
--- old/metadata 2018-02-11 23:23:01.000000000 +0100
+++ new/metadata 2018-03-19 21:22:58.000000000 +0100
@@ -1,7 +1,7 @@
--- !ruby/object:Gem::Specification
name: loofah
version: !ruby/object:Gem::Version
- version: 2.2.0
+ version: 2.2.1
platform: ruby
authors:
- Mike Dalessio
@@ -9,7 +9,7 @@
autorequire:
bindir: bin
cert_chain: []
-date: 2018-02-11 00:00:00.000000000 Z
+date: 2018-03-19 00:00:00.000000000 Z
dependencies:
- !ruby/object:Gem::Dependency
name: nokogiri
@@ -193,7 +193,18 @@
- - "~>"
- !ruby/object:Gem::Version
version: '3.16'
-description: ''
+description: |-
+ Loofah is a general library for manipulating and transforming HTML/XML
+ documents and fragments. It's built on top of Nokogiri and libxml2, so
+ it's fast and has a nice API.
+
+ Loofah excels at HTML sanitization (XSS prevention). It includes some
+ nice HTML sanitizers, which are based on HTML5lib's whitelist, so it
+ most likely won't make your codes less secure. (These statements have
+ not been evaluated by Netexperts.)
+
+ ActiveRecord extensions for sanitization are available in the
+ [`loofah-activerecord`
gem](https://github.com/flavorjones/loofah-activerecord).
email:
- mike.dales...@gmail.com
- br...@brynary.com
@@ -204,6 +215,7 @@
- MIT-LICENSE.txt
- Manifest.txt
- README.md
+- SECURITY.md
files:
- ".gemtest"
- CHANGELOG.md
@@ -212,6 +224,7 @@
- Manifest.txt
- README.md
- Rakefile
+- SECURITY.md
- benchmark/benchmark.rb
- benchmark/fragment.html
- benchmark/helper.rb
@@ -221,6 +234,7 @@
- lib/loofah/helpers.rb
- lib/loofah/html/document.rb
- lib/loofah/html/document_fragment.rb
+- lib/loofah/html5/libxml2_workarounds.rb
- lib/loofah/html5/scrub.rb
- lib/loofah/html5/whitelist.rb
- lib/loofah/instance_methods.rb
@@ -242,14 +256,14 @@
- test/unit/test_helpers.rb
- test/unit/test_scrubber.rb
- test/unit/test_scrubbers.rb
-homepage:
+homepage: https://github.com/flavorjones/loofah
licenses:
- MIT
metadata: {}
post_install_message:
rdoc_options:
- "--main"
-- README.rdoc
+- README.md
require_paths:
- lib
required_ruby_version: !ruby/object:Gem::Requirement
@@ -267,5 +281,6 @@
rubygems_version: 2.6.12
signing_key:
specification_version: 4
-summary: ''
+summary: Loofah is a general library for manipulating and transforming
HTML/XML documents
+ and fragments
test_files: []
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/test/integration/test_ad_hoc.rb
new/test/integration/test_ad_hoc.rb
--- old/test/integration/test_ad_hoc.rb 2018-02-11 23:23:01.000000000 +0100
+++ new/test/integration/test_ad_hoc.rb 2018-03-19 21:22:58.000000000 +0100
@@ -188,6 +188,71 @@
html = "<p>Foo</p>\n<p>Bar</p>"
assert_equal "Foo\nBar", Loofah.scrub_document(html, :prune).text
end
+
+ #
+ # tests for CVE-2018-8048 (see
https://github.com/flavorjones/loofah/issues/144)
+ #
+ # libxml2 >= 2.9.2 fails to escape comments within some attributes. It
+ # wants to ensure these comments can be treated as "server-side includes",
+ # but as a result fails to ensure that serialization is well-formed,
+ # resulting in an opportunity for XSS injection of code into a final
+ # re-parsed document (presumably in a browser).
+ #
+ # we'll test this by parsing the HTML, serializing it, then
+ # re-parsing it to ensure there isn't any ambiguity in the output
+ # that might allow code injection into a browser consuming
+ # "sanitized" output.
+ #
+ [
+ #
+ # these tags and attributes are determined by the code at:
+ #
+ # https://git.gnome.org/browse/libxml2/tree/HTMLtree.c?h=v2.9.2#n714
+ #
+ {tag: "a", attr: "href"},
+ {tag: "div", attr: "href"},
+ {tag: "a", attr: "action"},
+ {tag: "div", attr: "action"},
+ {tag: "a", attr: "src"},
+ {tag: "div", attr: "src"},
+ {tag: "a", attr: "name"},
+ #
+ # note that div+name is _not_ affected by the libxml2 issue.
+ # but we test it anyway to ensure our logic isn't modifying
+ # attributes that don't need modifying.
+ #
+ {tag: "div", attr: "name", unescaped: true},
+ ].each do |config|
+
+ define_method
"test_uri_escaping_of_#{config[:attr]}_attr_in_#{config[:tag]}_tag" do
+ html = %{<#{config[:tag]} #{config[:attr]}='examp<!--"
unsafeattr=foo()>-->le.com'>test</#{config[:tag]}>}
+
+ reparsed =
Loofah.fragment(Loofah.fragment(html).scrub!(:prune).to_html)
+ attributes = reparsed.at_css(config[:tag]).attribute_nodes
+
+ assert_equal [config[:attr]], attributes.collect(&:name)
+ if Nokogiri::VersionInfo.new.libxml2?
+ if config[:unescaped]
+ #
+ # this attribute was emitted wrapped in single-quotes, so a
double quote is A-OK.
+ # assert that this attribute's serialization is unaffected.
+ #
+ assert_equal %{examp<!--" unsafeattr=foo()>-->le.com},
attributes.first.value
+ else
+ #
+ # let's match the behavior in libxml < 2.9.2.
+ # test that this attribute's serialization is well-formed and
sanitized.
+ #
+ assert_equal %{examp<!--%22%20unsafeattr=foo()>-->le.com},
attributes.first.value
+ end
+ else
+ #
+ # yay for consistency in javaland. move along, nothing to see here.
+ #
+ assert_equal %{examp<!--%22 unsafeattr=foo()>-->le.com},
attributes.first.value
+ end
+ end
+
+ end
end
end
-
