From 1e9ddd06c831d841042cd8f51d2abe2925dc67ad Mon Sep 17 00:00:00 2001
From: taca <taca@pkgsrc.org>
Date: Sun, 28 Jan 2007 16:08:55 +0000
Subject: Add a patch to fix security problem of RubyGems 0.9.0 and prior.
 (http://www.frsirt.com/english/advisories/2007/0295)

Bump PKGREVISION.
---
 misc/rubygems/Makefile         |  4 ++--
 misc/rubygems/distinfo         |  3 ++-
 misc/rubygems/patches/patch-ab | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 3 deletions(-)
 create mode 100644 misc/rubygems/patches/patch-ab

(limited to 'misc')

diff --git a/misc/rubygems/Makefile b/misc/rubygems/Makefile
index 73e9170d61e..5f052ee7eee 100644
--- a/misc/rubygems/Makefile
+++ b/misc/rubygems/Makefile
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.5 2006/10/05 09:30:27 cube Exp $
+# $NetBSD: Makefile,v 1.6 2007/01/28 16:08:55 taca Exp $
 
 DISTNAME=	rubygems-0.9.0
-PKGREVISION=	1
+PKGREVISION=	2
 CATEGORIES=	misc ruby
 MASTER_SITES=	http://rubyforge.org/frs/download.php/11289/
 EXTRACT_SUFX=	.tgz
diff --git a/misc/rubygems/distinfo b/misc/rubygems/distinfo
index e7b3f8436f2..08d4afa1dce 100644
--- a/misc/rubygems/distinfo
+++ b/misc/rubygems/distinfo
@@ -1,6 +1,7 @@
-$NetBSD: distinfo,v 1.5 2006/10/05 09:30:27 cube Exp $
+$NetBSD: distinfo,v 1.6 2007/01/28 16:08:55 taca Exp $
 
 SHA1 (rubygems-0.9.0.tgz) = 90d2193e9bb91dbbfbb81ce749abcd827e3b6b53
 RMD160 (rubygems-0.9.0.tgz) = 7d2a4ec1a615f608e75c68ee346d957efbb34ed1
 Size (rubygems-0.9.0.tgz) = 174321 bytes
 SHA1 (patch-aa) = 3fc54ebc8b4ea141bea54fb5a96f1408c6ca5b95
+SHA1 (patch-ab) = 10447e75388e5c76f83fe58eef4a11e885d3b4e9
diff --git a/misc/rubygems/patches/patch-ab b/misc/rubygems/patches/patch-ab
new file mode 100644
index 00000000000..695407f274b
--- /dev/null
+++ b/misc/rubygems/patches/patch-ab
@@ -0,0 +1,33 @@
+Index: lib/rubygems/installer.rb
+===================================================================
+--- lib/rubygems/installer.rb	(revision 1195)
++++ lib/rubygems/installer.rb	(working copy)
+@@ -335,14 +335,20 @@ TEXT
+     #
+     def extract_files(directory, format)
+       require 'fileutils'
+-      wd = Dir.getwd
+-      Dir.chdir directory do
+-        format.file_entries.each do |entry, file_data|
+-          path = entry['path'].untaint
+-          FileUtils.mkdir_p File.dirname(path)
+-          File.open(path, "wb") do |out|
+-            out.write file_data
+-          end
++      format.file_entries.each do |entry, file_data|
++        path = entry['path'].untaint
++        if path =~ /\A\// then # for extra sanity
++          raise Gem::InstallError,
++                "attempt to install file into #{entry['path'].inspect}"
++        end
++        path = File.expand_path File.join(directory, path)
++        if path !~ /\A#{Regexp.escape directory}/ then
++          raise Gem::InstallError,
++                "attempt to install file into #{entry['path'].inspect}"
++        end
++        FileUtils.mkdir_p File.dirname(path)
++        File.open(path, "wb") do |out|
++          out.write file_data
+         end
+       end
+     end
-- 
cgit v1.2.3