async-caldav 1.2.1 → 1.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0517bf6a8c74d0d76b09a3ea8115e6dd65114f3991e25d3c97578ec69cb64a9c
-  data.tar.gz: 5f83b3cb2b118fe7ef22eef7140df410eea5f167f41e86b317dd260dbc6e0fc7
+  metadata.gz: a322d3a753a3dbee66ebd1afa1e1d8d7c195b96a243c45e0593cbf4a1c64d93c
+  data.tar.gz: 377c6989fdc81a44d0e6999dbb012b633f1899e08b7cd33330d318f58c5e9aa0
 SHA512:
-  metadata.gz: 46c8c7806937d6945f1a1766a8ab6999d272b0e3d599a34bdc33fab780f10a106ae0e36ae380a45f17bf9a7af5a5bb302b9c8f9ec9cd1a8c84584e7b30baebe9
-  data.tar.gz: ec019c2ee4e1d7e53ab85dabcb74098c6f03cbf97e3808df67f2e7ebd270a994a67ddd2cd2de970e8080b7f2588955534c9587469f67228bffac8ddef333b683
+  metadata.gz: da4e219d79c691636fa2c6f13ca1f9f7a77bdee9e68005671494288c523115c14db068d585071bac19cd1f6c79b6723e186cbf81a185718225f4447c8b41a67d
+  data.tar.gz: b189f9332228946eb7da0ca7a5d23f28bbea5634ca1463661683c4b16328264ca15489a7f43f0c4bcd37737f6192c6c8dff9129d100dcec2c1a69ac99302fece

data/lib/async/caldav/storage/filesystem.rb

@@ -14,6 +14,8 @@ module Async
           @root = root
           @sync_snapshots = {}
           FileUtils.mkdir_p(@root)
+          @root_normalized = ::File.expand_path(@root)
+          @root_with_separator = @root_normalized.end_with?(::File::SEPARATOR) ? @root_normalized : "#{@root_normalized}#{::File::SEPARATOR}"
         end
 
         # --- Collections ---
@@ -39,9 +41,9 @@ module Async
         end
 
         def delete_collection(path)
-          dir = full_path(path)
-          if File.directory?(dir)
-            FileUtils.rm_rf(dir)
+          s = stat(path)
+          if s && s.directory?
+            FileUtils.rm_rf(full_path(path))
             true
           else
             false
@@ -89,13 +91,15 @@ module Async
         # --- Items ---
 
         def get_item(path)
-          file = full_path(path)
-          return nil unless File.file?(file)
-
-          body = File.read(file)
-          content_type = guess_content_type(path)
-          etag = Protocol::Caldav::ETag.compute(body)
-          { body: body, content_type: content_type, etag: etag }
+          s = stat(path)
+          if s && s.file?
+            body = File.read(full_path(path))
+            content_type = guess_content_type(path)
+            etag = Protocol::Caldav::ETag.compute(body)
+            { body: body, content_type: content_type, etag: etag }
+          else
+            nil
+          end
         end
 
         def put_item(path, body, content_type)
@@ -109,9 +113,9 @@ module Async
         end
 
         def delete_item(path)
-          file = full_path(path)
-          if File.file?(file)
-            File.delete(file)
+          s = stat(path)
+          if s && s.file?
+            File.delete(full_path(path))
             true
           else
             false
@@ -136,13 +140,15 @@ module Async
         end
 
         def move_item(from_path, to_path)
-          src = full_path(from_path)
-          dst = full_path(to_path)
-          return nil unless File.file?(src)
-
-          FileUtils.mkdir_p(File.dirname(dst))
-          FileUtils.mv(src, dst)
-          get_item(to_path)
+          s = stat(from_path)
+          if s && s.file?
+            dst = full_path(to_path)
+            FileUtils.mkdir_p(File.dirname(dst))
+            FileUtils.mv(full_path(from_path), dst)
+            get_item(to_path)
+          else
+            nil
+          end
         end
 
         def get_multi(paths)
@@ -152,8 +158,11 @@ module Async
         # --- General ---
 
         def exists?(path)
-          fp = full_path(path)
-          File.exist?(fp) || collection_exists?(path)
+          if stat(path)
+            true
+          else
+            collection_exists?(path)
+          end
         end
 
         def etag(path)
@@ -208,7 +217,26 @@ module Async
         private
 
         def full_path(path)
-          File.join(@root, path)
+          if valid_path?(path)
+            expanded = ::File.expand_path(::File.join(@root, path))
+            if expanded == @root_normalized || expanded.start_with?(@root_with_separator)
+              expanded
+            else
+              raise ArgumentError, "path escapes root: #{path.inspect}"
+            end
+          else
+            raise ArgumentError, "invalid path: #{path.inspect}"
+          end
+        end
+
+        def valid_path?(path)
+          path.is_a?(String) && path.valid_encoding? && !path.include?("\0")
+        end
+
+        def stat(path)
+          ::File.stat(full_path(path))
+        rescue Errno::ENOENT, Errno::ELOOP
+          nil
         end
 
         def guess_content_type(path)
@@ -361,6 +389,21 @@ test do
       end
     end
 
+    it "rejects path traversal attempts" do
+      Dir.mktmpdir do |dir|
+        s = Async::Caldav::Storage::Filesystem.new(dir)
+        lambda { s.get_item("/../../etc/passwd") }.should.raise ArgumentError
+        lambda { s.put_item("/cal/../../escape.ics", "x", "text/calendar") }.should.raise ArgumentError
+      end
+    end
+
+    it "rejects NUL byte in path" do
+      Dir.mktmpdir do |dir|
+        s = Async::Caldav::Storage::Filesystem.new(dir)
+        lambda { s.get_item("/cal\0/x.ics") }.should.raise ArgumentError
+      end
+    end
+
     it "same body produces same etag across backends" do
       body = "BEGIN:VCALENDAR\r\nEND:VCALENDAR"
       mock = Async::Caldav::Storage::Mock.new

data/lib/async/caldav/version.rb

@@ -2,6 +2,6 @@
 
 module Async
   module Caldav
-    VERSION = "1.2.1"
+    VERSION = "1.2.2"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: async-caldav
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.2.2
 platform: ruby
 authors:
 - Nathan K