arr-pm 0.0.11 → 0.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ceb08ab00b24c659ee4f0fd42d8f5c8ad77416ffff3f89e8ee18ec46ddc58383
-  data.tar.gz: b53d4d64c24362fb2cf27606842d8352e9f7d184f9ba3b76eb1e33b3e13b2775
+  metadata.gz: 1b18d6ce9e276f133f3456d3f680c9727936e0be921d1f2492f9541aeefcbca9
+  data.tar.gz: d5bca7b579c4ff1f28b411a0d5195a83d34c023a749d563cbc95b9cb0bb5716b
 SHA512:
-  metadata.gz: 441b7c7a0d0851c3c4cadaf7e2e0f20d32388ba4df722ee3f76bfb3a34bb072739daf63739cf19e9d8f221a40a80f999ca47b2825043ded493d1f3363dec3e54
-  data.tar.gz: 815d8fff66bc8672b7e212f6c138795a9029b5e78032d26051ac114e306084f97d01519060427aeb50e9bca29dd49af5d5567370904d8881fc99179184811cd3
+  metadata.gz: 58e476d730ac09d22ea1ee60cf463f3cc26b4cb3cc99f1f8b44d7cd323084d3ca1208a550b069f56afb2414759b9f3e5475716dfee0f2363ae5a10dc0235ae38
+  data.tar.gz: 361d8dfca458258a617e71153ff8e757c4f8963abe5d07d9020a120407f52059a2f3b8bd0a3e2495f9764a2cc02f18d4755d2ba532f670d16c1adfc3eb85a3cb

data/CHANGELOG.md

@@ -0,0 +1,18 @@
+
+
+# v0.0.12
+
+* Security: Fixed a safety problem which would allow for arbitrary shell execution when invoking `RPM::File#extract` or `RPM::File#files`. (Jordan Sissel, @joernchen; #14, #15)
+* This library now has no external dependencies. (Jordan Sissel, #18)
+* `RPM::File#extract` now correctly works when the target directory contains spaces or other special characters. (@joernchen, #19)
+* Listing files (`RPM::File#files`) no longer requires external tools like `cpio` (Jordan Sissel, #17)
+
+
+# v0.0.11
+
+* Support Ruby 3.0 (Alexey Morozov, #12)
+* Fix bug caused when listing config_files on an rpm with no config files. (Daniel Jay Haskin, #7)
+
+# Older versions
+
+Changelog not tracked for older versions.

data/arr-pm.gemspec

@@ -2,14 +2,13 @@ Gem::Specification.new do |spec|
   files = %x{git ls-files}.split("\n")
 
   spec.name = "arr-pm"
-  spec.version = "0.0.11"
+  spec.version = "0.0.12"
   spec.summary = "RPM reader and writer library"
   spec.description = "This library allows to you to read and write rpm " \
     "packages. Written in pure ruby because librpm is not available " \
     "on all systems"
   spec.license = "Apache 2"
 
-  spec.add_dependency "cabin", ">0" # for logging. apache 2 license
   spec.files = files
   spec.require_paths << "lib"
   spec.bindir = "bin"
@@ -18,6 +17,9 @@ Gem::Specification.new do |spec|
   spec.email = ["jls@semicomplete.com"]
 
   spec.add_development_dependency "flores", ">0"
+  spec.add_development_dependency "rspec", ">3.0.0"
+  spec.add_development_dependency "stud", ">=0.0.23"
+  spec.add_development_dependency "insist", ">=1.0.0"
   #spec.homepage = "..."
 end
 

data/lib/arr-pm/file/header.rb

@@ -1,9 +1,7 @@
 require File.expand_path(File.join(File.dirname(__FILE__), "..", "namespace"))
 require File.join(File.dirname(__FILE__), "tag")
-require "cabin"
 
 class RPM::File::Header
-  include Cabin::Inspectable
   attr_reader :tags
   attr_reader :length
 

data/lib/arr-pm/file/lead.rb

@@ -1,8 +1,6 @@
 require File.expand_path(File.join(File.dirname(__FILE__), "..", "namespace"))
-require "cabin"
 
 class RPM::File::Lead
-  include Cabin::Inspectable
 
   #struct rpmlead {
   attr_accessor :magic #unsigned char magic[4];

data/lib/arr-pm/file/tag.rb

@@ -1,8 +1,6 @@
 require File.expand_path(File.join(File.dirname(__FILE__), "..", "namespace"))
-require "cabin"
 
 class RPM::File::Tag
-  include Cabin::Inspectable
 
   attr_accessor :tag
   attr_accessor :type

data/lib/arr-pm/file.rb

@@ -3,6 +3,7 @@ require File.join(File.dirname(__FILE__), "file", "header")
 require File.join(File.dirname(__FILE__), "file", "lead")
 require File.join(File.dirname(__FILE__), "file", "tag")
 require "fcntl"
+require "shellwords"
 
 # Much of the code here is derived from knowledge gained by reading the rpm
 # source code, but mostly it started making more sense after reading this site:
@@ -88,6 +89,14 @@ class RPM::File
     return @payload
   end # def payload
 
+  def valid_compressor?(name)
+    # I scanned rpm's rpmio.c for payload implementation names and found the following.
+    #    sed -rne '/struct FDIO_s \w+ *= *\{/{ n; s/^.*"(\w+)",$/\1/p }' rpmio/rpmio.c
+    # It's possible this misses some supported rpm payload compressors.
+
+    [ "gzip", "bzip2", "xz", "lzma", "zstd" ].include?(name)
+  end
+
   # Extract this RPM to a target directory.
   #
   # This should have roughly the same effect as:
@@ -97,8 +106,13 @@ class RPM::File
     if !File.directory?(target)
       raise Errno::ENOENT.new(target)
     end
+
+    compressor = tags[:payloadcompressor]
+    if !valid_compressor?(compressor)
+      raise "Cannot decompress. This RPM uses an invalid compressor '#{compressor}'"
+    end
     
-    extractor = IO.popen("#{tags[:payloadcompressor]} -d | (cd #{target}; cpio -i --quiet --make-directories)", "w")
+    extractor = IO.popen("#{compressor} -d | (cd #{Shellwords.escape(target)}; cpio -i --quiet --make-directories)", "w")
     buffer = ""
     begin
         buffer.force_encoding("BINARY")
@@ -195,49 +209,13 @@ class RPM::File
   # 
   #   % rpm2cpio blah.rpm | cpio -it
   def files
-    return @files unless @files.nil?
-
-    lister = IO.popen("#{tags[:payloadcompressor]} -d | cpio -it --quiet", "r+")
-    buffer = ""
-    begin
-        buffer.force_encoding("BINARY")
-    rescue NoMethodError
-        # Do Nothing
-    end
-    payload_fd = payload.clone
-    output = ""
-    loop do
-      data = payload_fd.read(16384, buffer)
-      break if data.nil? # listerextractor.write(data)
-      lister.write(data)
-
-      # Read output from the pipe.
-      begin
-        output << lister.read_nonblock(16384)
-      rescue Errno::EAGAIN
-        # Nothing to read, move on!
-      end
-    end
-    lister.close_write
-
-    # Read remaining output
-    begin
-      output << lister.read
-    rescue Errno::EAGAIN
-      # Because read_nonblock enables NONBLOCK the 'lister' fd,
-      # and we may have invoked a read *before* cpio has started
-      # writing, let's keep retrying this read until we get an EOF
-      retry
-    rescue EOFError
-      # At EOF, hurray! We're done reading.
-    end
-
-    # Split output by newline and strip leading "."
-    @files = output.split("\n").collect { |s| s.gsub(/^\./, "") }
-    return @files
-  ensure
-    lister.close unless lister.nil?
-    payload_fd.close unless payload_fd.nil?
+    # RPM stores the file metadata split across multiple tags.
+    # A single path's filename (with no directories) is stored in the "basename" tag.
+    # The directory a file lives in is stored in the "dirnames" tag
+    # We can find out what directory a file is in using the "dirindexes" tag.
+    #
+    # We can join each entry of dirnames and basenames to make the full filename.
+    return tags[:basenames].zip(tags[:dirindexes]).map { |name, i| File.join(tags[:dirnames][i], name) }
   end # def files
 
   def mask?(value, mask)

data/spec/rpm/file_spec.rb

@@ -0,0 +1,57 @@
+# encoding: utf-8
+
+require "arr-pm/file"
+require "stud/temporary"
+require "insist"
+
+describe ::RPM::File do
+  subject { described_class.new(path) }
+
+  context "with a known good rpm" do
+    let(:path) { File.join(File.dirname(__FILE__), "../fixtures/pagure-mirror-5.13.2-5.fc35.noarch.rpm") }
+
+    context "#files" do
+      let(:files) { [
+        "/usr/lib/systemd/system/pagure_mirror.service",
+        "/usr/share/licenses/pagure-mirror",
+        "/usr/share/licenses/pagure-mirror/LICENSE"
+      ]}
+
+      it "should have the correct list of files" do
+        expect(subject.files).to eq(files)
+      end
+    end
+  end
+
+  context "#extract" do
+    # This RPM should be correctly built, but we will modify the tags at runtime to force an error.
+    let(:path) { File.join(File.dirname(__FILE__), "../fixtures/example-1.0-1.x86_64.rpm") }
+    let(:dir) { dir = Stud::Temporary.directory }
+
+    after do
+      FileUtils.rm_rf(dir)
+    end
+
+    context "with an invalid payloadcompressor" do
+      before do
+        subject.tags[:payloadcompressor] = "some invalid | string"
+      end
+
+      it "should raise an error" do
+        insist { subject.extract(dir) }.raises(RuntimeError)
+      end
+    end
+
+    [ "gzip", "bzip2", "xz", "lzma", "zstd" ].each do |name|
+      context "with a '#{name}' payloadcompressor" do
+        before do
+          subject.tags[:payloadcompressor] = name
+        end
+
+        it "should succeed" do
+          reject { subject.extract(dir) }.raises(RuntimeError)
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,23 +1,23 @@
 --- !ruby/object:Gem::Specification
 name: arr-pm
 version: !ruby/object:Gem::Version
-  version: 0.0.11
+  version: 0.0.12
 platform: ruby
 authors:
 - Jordan Sissel
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-06-15 00:00:00.000000000 Z
+date: 2022-09-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: cabin
+  name: flores
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">"
       - !ruby/object:Gem::Version
         version: '0'
-  type: :runtime
+  type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
@@ -25,19 +25,47 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: flores
+  name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.0.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.0.0
+- !ruby/object:Gem::Dependency
+  name: stud
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.0.23
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.0.23
+- !ruby/object:Gem::Dependency
+  name: insist
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 1.0.0
 description: This library allows to you to read and write rpm packages. Written in
   pure ruby because librpm is not available on all systems
 email:
@@ -46,11 +74,10 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".batcave/manifest"
 - ".gitignore"
 - ".rubocop.yml"
+- CHANGELOG.md
 - Gemfile
-- Guardfile
 - LICENSE
 - Makefile
 - README.md
@@ -77,6 +104,8 @@ files:
 - spec/arr-pm/v2/lead_spec.rb
 - spec/fixtures/example-1.0-1.x86_64.rpm
 - spec/fixtures/example.json
+- spec/fixtures/pagure-mirror-5.13.2-5.fc35.noarch.rpm
+- spec/rpm/file_spec.rb
 homepage:
 licenses:
 - Apache 2
@@ -97,7 +126,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.15
+rubygems_version: 3.3.3
 signing_key:
 specification_version: 4
 summary: RPM reader and writer library

data/.batcave/manifest

@@ -1,5 +0,0 @@
----
-things:
-  ruby:
-    args:
-    - arr-pm

data/Guardfile

@@ -1,77 +0,0 @@
-# A sample Guardfile
-# More info at https://github.com/guard/guard#readme
-
-## Uncomment and set this to only include directories you want to watch
-# directories %w(app lib config test spec features)
-
-## Uncomment to clear the screen before every task
-# clearing :on
-
-## Guard internally checks for changes in the Guardfile and exits.
-## If you want Guard to automatically start up again, run guard in a
-## shell loop, e.g.:
-##
-##  $ while bundle exec guard; do echo "Restarting Guard..."; done
-##
-## Note: if you are using the `directories` clause above and you are not
-## watching the project directory ('.'), then you will want to move
-## the Guardfile to a watched dir and symlink it back, e.g.
-#
-#  $ mkdir config
-#  $ mv Guardfile config/
-#  $ ln -s config/Guardfile .
-#
-# and, you'll have to watch "config/Guardfile" instead of "Guardfile"
-
-# Note: The cmd option is now required due to the increasing number of ways
-#       rspec may be run, below are examples of the most common uses.
-#  * bundler: 'bundle exec rspec'
-#  * bundler binstubs: 'bin/rspec'
-#  * spring: 'bin/rspec' (This will use spring if running and you have
-#                          installed the spring binstubs per the docs)
-#  * zeus: 'zeus rspec' (requires the server to be started separately)
-#  * 'just' rspec: 'rspec'
-
-guard :rspec, cmd: "bundle exec rspec" do
-  require "guard/rspec/dsl"
-  dsl = Guard::RSpec::Dsl.new(self)
-
-  # Feel free to open issues for suggestions and improvements
-
-  # RSpec files
-  rspec = dsl.rspec
-  watch(rspec.spec_helper) { rspec.spec_dir }
-  watch(rspec.spec_support) { rspec.spec_dir }
-  watch(rspec.spec_files)
-
-  # Ruby files
-  ruby = dsl.ruby
-  dsl.watch_spec_files_for(ruby.lib_files)
-
-  # Rails files
-  rails = dsl.rails(view_extensions: %w(erb haml slim))
-  dsl.watch_spec_files_for(rails.app_files)
-  dsl.watch_spec_files_for(rails.views)
-
-  watch(rails.controllers) do |m|
-    [
-      rspec.spec.("routing/#{m[1]}_routing"),
-      rspec.spec.("controllers/#{m[1]}_controller"),
-      rspec.spec.("acceptance/#{m[1]}")
-    ]
-  end
-
-  # Rails config changes
-  watch(rails.spec_helper)     { rspec.spec_dir }
-  watch(rails.routes)          { "#{rspec.spec_dir}/routing" }
-  watch(rails.app_controller)  { "#{rspec.spec_dir}/controllers" }
-
-  # Capybara features specs
-  watch(rails.view_dirs)     { |m| rspec.spec.("features/#{m[1]}") }
-
-  # Turnip features and steps
-  watch(%r{^spec/acceptance/(.+)\.feature$})
-  watch(%r{^spec/acceptance/steps/(.+)_steps\.rb$}) do |m|
-    Dir[File.join("**/#{m[1]}.feature")][0] || "spec/acceptance"
-  end
-end