diff options
| author | taca <taca> | 2007-01-28 16:08:55 +0000 |
|---|---|---|
| committer | taca <taca> | 2007-01-28 16:08:55 +0000 |
| commit | 49544f0d5269cec9c10ea151518aaac7b1feb336 (patch) | |
| tree | d820c9ab356f77ec6c650e2698061ed06cc7826f /misc | |
| parent | 4c91fe25495904d456fd89bd639bf6f19006e608 (diff) | |
| download | pkgsrc-49544f0d5269cec9c10ea151518aaac7b1feb336.tar.gz | |
Add a patch to fix security problem of RubyGems 0.9.0 and prior.
(http://www.frsirt.com/english/advisories/2007/0295)
Bump PKGREVISION.
Diffstat (limited to 'misc')
| -rw-r--r-- | misc/rubygems/Makefile | 4 | ||||
| -rw-r--r-- | misc/rubygems/distinfo | 3 | ||||
| -rw-r--r-- | misc/rubygems/patches/patch-ab | 33 |
3 files changed, 37 insertions, 3 deletions
diff --git a/misc/rubygems/Makefile b/misc/rubygems/Makefile index 73e9170d61e..5f052ee7eee 100644 --- a/misc/rubygems/Makefile +++ b/misc/rubygems/Makefile @@ -1,7 +1,7 @@ -# $NetBSD: Makefile,v 1.5 2006/10/05 09:30:27 cube Exp $ +# $NetBSD: Makefile,v 1.6 2007/01/28 16:08:55 taca Exp $ DISTNAME= rubygems-0.9.0 -PKGREVISION= 1 +PKGREVISION= 2 CATEGORIES= misc ruby MASTER_SITES= http://rubyforge.org/frs/download.php/11289/ EXTRACT_SUFX= .tgz diff --git a/misc/rubygems/distinfo b/misc/rubygems/distinfo index e7b3f8436f2..08d4afa1dce 100644 --- a/misc/rubygems/distinfo +++ b/misc/rubygems/distinfo @@ -1,6 +1,7 @@ -$NetBSD: distinfo,v 1.5 2006/10/05 09:30:27 cube Exp $ +$NetBSD: distinfo,v 1.6 2007/01/28 16:08:55 taca Exp $ SHA1 (rubygems-0.9.0.tgz) = 90d2193e9bb91dbbfbb81ce749abcd827e3b6b53 RMD160 (rubygems-0.9.0.tgz) = 7d2a4ec1a615f608e75c68ee346d957efbb34ed1 Size (rubygems-0.9.0.tgz) = 174321 bytes SHA1 (patch-aa) = 3fc54ebc8b4ea141bea54fb5a96f1408c6ca5b95 +SHA1 (patch-ab) = 10447e75388e5c76f83fe58eef4a11e885d3b4e9 diff --git a/misc/rubygems/patches/patch-ab b/misc/rubygems/patches/patch-ab new file mode 100644 index 00000000000..695407f274b --- /dev/null +++ b/misc/rubygems/patches/patch-ab @@ -0,0 +1,33 @@ +Index: lib/rubygems/installer.rb +=================================================================== +--- lib/rubygems/installer.rb (revision 1195) ++++ lib/rubygems/installer.rb (working copy) +@@ -335,14 +335,20 @@ TEXT + # + def extract_files(directory, format) + require 'fileutils' +- wd = Dir.getwd +- Dir.chdir directory do +- format.file_entries.each do |entry, file_data| +- path = entry['path'].untaint +- FileUtils.mkdir_p File.dirname(path) +- File.open(path, "wb") do |out| +- out.write file_data +- end ++ format.file_entries.each do |entry, file_data| ++ path = entry['path'].untaint ++ if path =~ /\A\// then # for extra sanity ++ raise Gem::InstallError, ++ "attempt to install file into #{entry['path'].inspect}" ++ end ++ path = File.expand_path File.join(directory, path) ++ if path !~ /\A#{Regexp.escape directory}/ then ++ raise Gem::InstallError, ++ "attempt to install file into #{entry['path'].inspect}" ++ end ++ FileUtils.mkdir_p File.dirname(path) ++ File.open(path, "wb") do |out| ++ out.write file_data + end + end + end |