chef 18.9.4 → 18.11.11

data/lib/chef/resource/archive_file.rb

@@ -172,9 +172,16 @@ class Chef
 
         if new_resource.owner || new_resource.group
           converge_by("set owner of files extracted in #{new_resource.destination} to #{new_resource.owner}:#{new_resource.group}") do
-            archive = Archive::Reader.open_filename(new_resource.path, nil, strip_components: new_resource.strip_components)
-            archive.each_entry do |e|
-              FileUtils.chown(new_resource.owner, new_resource.group, "#{new_resource.destination}/#{e.pathname}")
+            dest_realpath = ::File.expand_path(new_resource.destination)
+            Archive::Reader.open_filename(new_resource.path, nil, strip_components: new_resource.strip_components) do |archive|
+              archive.each_entry do |e|
+                # Validate path is within destination before chown-ing.
+                # Use expand_path for security check, original string for the chown call.
+                chown_path_expanded = ::File.expand_path("#{new_resource.destination}/#{e.pathname}")
+                next unless chown_path_expanded.start_with?(dest_realpath + ::File::SEPARATOR) || chown_path_expanded == dest_realpath
+
+                FileUtils.chown(new_resource.owner, new_resource.group, "#{new_resource.destination}/#{e.pathname}")
+              end
             end
           end
         end
@@ -211,16 +218,23 @@ class Chef
         # @return [Boolean]
         def archive_differs_from_disk?(src, dest)
           modified = false
-          archive = Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components)
+          dest_realpath = ::File.expand_path(dest)
           Chef::Log.trace("Beginning the comparison of file mtime between contents of #{src} and #{dest}")
-          archive.each_entry do |e|
-            pathname = ::File.expand_path(e.pathname, dest)
-            if ::File.exist?(pathname)
-              Chef::Log.trace("#{pathname} mtime is #{::File.mtime(pathname)} and archive is #{e.mtime}")
-              modified = true unless ::File.mtime(pathname) == e.mtime
-            else
-              Chef::Log.trace("#{pathname} doesn't exist on disk, but exists in the archive")
-              modified = true
+          Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components) do |archive|
+            archive.each_entry do |e|
+              pathname = ::File.expand_path(e.pathname, dest_realpath)
+              # Skip archive entries that resolve outside the destination directory.
+              # A traversal entry (e.g. "../escaped") must not influence the mtime
+              # comparison and must never trigger extraction.
+              next unless pathname.start_with?(dest_realpath + ::File::SEPARATOR) || pathname == dest_realpath
+
+              if ::File.exist?(pathname)
+                Chef::Log.trace("#{pathname} mtime is #{::File.mtime(pathname)} and archive is #{e.mtime}")
+                modified = true unless ::File.mtime(pathname) == e.mtime
+              else
+                Chef::Log.trace("#{pathname} doesn't exist on disk, but exists in the archive")
+                modified = true
+              end
             end
           end
           modified
@@ -235,15 +249,35 @@ class Chef
         # @return [void]
         def extract(src, dest, options = [])
           converge_by("extract #{src} to #{dest}") do
-            flags = [options].flatten.map { |option| extract_option_map[option] }.compact.reduce(:|)
+            user_flags = [options].flatten.map { |option| extract_option_map[option] }.compact.reduce(:|).to_i
+            # Always apply libarchive security flags to prevent path traversal.
+            # These are not user-overridable hence directly added here
+            # instead of options array. NODOTDOT blocks "../" sequences,
+            # NOABSOLUTEPATHS blocks absolute-path entries, SECURE_SYMLINKS prevents
+            # symlink attacks. Combined with the check below in archive.each_entry
+            # they safeguard against Zip Slip / CWE-22 attacks.
+            security_flags = Archive::EXTRACT_SECURE_NODOTDOT |
+              Archive::EXTRACT_SECURE_NOABSOLUTEPATHS |
+              Archive::EXTRACT_SECURE_SYMLINKS
+            all_flags = user_flags | security_flags
+            dest_realpath = ::File.expand_path(dest)
 
             Dir.chdir(dest) do
-              archive = Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components)
-
-              archive.each_entry do |e|
-                archive.extract(e, flags.to_i)
+              Archive::Reader.open_filename(src, nil, strip_components: new_resource.strip_components) do |archive|
+                archive.each_entry do |e|
+                  # reject any entry whose resolved path
+                  # falls outside the destination directory before calling into libarchive.
+                  entry_realpath = ::File.expand_path(e.pathname, dest_realpath)
+                  unless entry_realpath.start_with?(dest_realpath + ::File::SEPARATOR) || entry_realpath == dest_realpath
+                    raise Chef::Exceptions::ValidationFailed,
+                      "Refusing to extract archive entry #{e.pathname.inspect}: resolved path " \
+                      "#{entry_realpath.inspect} is outside destination #{dest_realpath.inspect}. " \
+                      "This archive may contain a path traversal attack."
+                  end
+
+                  archive.extract(e, all_flags)
+                end
               end
-              archive.close
             end
           end
         end

data/lib/chef/resource/bash.rb

@@ -26,135 +26,135 @@ class Chef
 
       description "Use the **bash** resource to execute scripts using the Bash interpreter. This resource may also use any of the actions and properties that are available to the **execute** resource. Commands that are executed with this resource are (by their nature) not idempotent, as they are typically unique to the environment in which they are run. Use `not_if` and `only_if` to guard this resource for idempotence."
       examples <<~'DOC'
-      **Compile an application**
-
-      ```ruby
-      bash 'install_something' do
-        user 'root'
-        cwd '/tmp'
-        code <<-EOH
-          wget http://www.example.com/tarball.tar.gz
-          tar -zxf tarball.tar.gz
-          cd tarball
-          ./configure
-          make
-          make install
-        EOH
-      end
-      ```
-
-      **Using escape characters in a string of code**
-
-      In the following example, the `find` command uses an escape character (`\`). Use a second escape character (`\\`) to preserve the escape character in the code string:
-
-      ```ruby
-      bash 'delete some archives ' do
-        code <<-EOH
-          find ./ -name "*.tar.Z" -mtime +180 -exec rm -f {} \\;
-        EOH
-        ignore_failure true
-      end
-      ```
-
-      **Install a file from a remote location**
-
-      The following is an example of how to install the foo123 module for Nginx. This module adds shell-style functionality to an Nginx configuration file and does the following:
-
-        - Declares three variables
-        - Gets the Nginx file from a remote location
-        - Installs the file using Bash to the path specified by the `src_filepath` variable
-
-      ```ruby
-      src_filename = "foo123-nginx-module-v#{node['nginx']['foo123']['version']}.tar.gz"
-      src_filepath = "#{Chef::Config['file_cache_path']}/#{src_filename}"
-      extract_path = "#{Chef::Config['file_cache_path']}/nginx_foo123_module/#{node['nginx']['foo123']['checksum']}"
-
-      remote_file 'src_filepath' do
-        source node['nginx']['foo123']['url']
-        checksum node['nginx']['foo123']['checksum']
-        owner 'root'
-        group 'root'
-        mode '0755'
-      end
-
-      bash 'extract_module' do
-        cwd ::File.dirname(src_filepath)
-        code <<-EOH
-          mkdir -p #{extract_path}
-          tar xzf #{src_filename} -C #{extract_path}
-          mv #{extract_path}/*/* #{extract_path}/
-        EOH
-        not_if { ::File.exist?(extract_path) }
-      end
-      ```
-
-      **Install an application from git**
-
-      ```ruby
-      git "#{Chef::Config[:file_cache_path]}/ruby-build" do
-        repository 'git://github.com/rbenv/ruby-build.git'
-        revision 'master'
-        action :sync
-      end
-
-      bash 'install_ruby_build' do
-        cwd "#{Chef::Config[:file_cache_path]}/ruby-build"
-        user 'rbenv'
-        group 'rbenv'
-        code <<-EOH
-          ./install.sh
-        EOH
-        environment 'PREFIX' => '/usr/local'
-      end
-      ```
-
-      **Using Attributes in Bash Code**
-
-      The following recipe shows how an attributes file can be used to store certain settings. An attributes file is located in the `attributes/`` directory in the same cookbook as the recipe which calls the attributes file. In this example, the attributes file specifies certain settings for Python that are then used across all nodes against which this recipe will run.
-
-      Python packages have versions, installation directories, URLs, and checksum files. An attributes file that exists to support this type of recipe would include settings like the following:
-
-      ```ruby
-      default['python']['version'] = '2.7.1'
-
-      if python['install_method'] == 'package'
-        default['python']['prefix_dir'] = '/usr'
-      else
-        default['python']['prefix_dir'] = '/usr/local'
-      end
-
-      default['python']['url'] = 'http://www.python.org/ftp/python'
-      default['python']['checksum'] = '80e387...85fd61'
-      ```
-
-      and then the methods in the recipe may refer to these values. A recipe that is used to install Python will need to do the following:
-
-        - Identify each package to be installed (implied in this example, not shown)
-        - Define variables for the package `version` and the `install_path`
-        - Get the package from a remote location, but only if the package does not already exist on the target system
-        - Use the **bash** resource to install the package on the node, but only when the package is not already installed
-
-      ```ruby
-      version = node['python']['version']
-      install_path = "#{node['python']['prefix_dir']}/lib/python#{version.split(/(^\d+\.\d+)/)[1]}"
-
-      remote_file "#{Chef::Config[:file_cache_path]}/Python-#{version}.tar.bz2" do
-        source "#{node['python']['url']}/#{version}/Python-#{version}.tar.bz2"
-        checksum node['python']['checksum']
-        mode '0755'
-        not_if { ::File.exist?(install_path) }
-      end
-
-      bash 'build-and-install-python' do
-        cwd Chef::Config[:file_cache_path]
-        code <<-EOF
-          tar -jxvf Python-#{version}.tar.bz2
-          (cd Python-#{version} && ./configure #{configure_options})
-          (cd Python-#{version} && make && make install)
-        EOF
-        not_if { ::File.exist?(install_path) }
-      end
-      ```
+        **Compile an application**
+
+        ```ruby
+        bash 'install_something' do
+          user 'root'
+          cwd '/tmp'
+          code <<-EOH
+            wget http://www.example.com/tarball.tar.gz
+            tar -zxf tarball.tar.gz
+            cd tarball
+            ./configure
+            make
+            make install
+          EOH
+        end
+        ```
+
+        **Using escape characters in a string of code**
+
+        In the following example, the `find` command uses an escape character (`\`). Use a second escape character (`\\`) to preserve the escape character in the code string:
+
+        ```ruby
+        bash 'delete some archives ' do
+          code <<-EOH
+            find ./ -name "*.tar.Z" -mtime +180 -exec rm -f {} \\;
+          EOH
+          ignore_failure true
+        end
+        ```
+
+        **Install a file from a remote location**
+
+        The following is an example of how to install the foo123 module for Nginx. This module adds shell-style functionality to an Nginx configuration file and does the following:
+
+          - Declares three variables
+          - Gets the Nginx file from a remote location
+          - Installs the file using Bash to the path specified by the `src_filepath` variable
+
+        ```ruby
+        src_filename = "foo123-nginx-module-v#{node['nginx']['foo123']['version']}.tar.gz"
+        src_filepath = "#{Chef::Config['file_cache_path']}/#{src_filename}"
+        extract_path = "#{Chef::Config['file_cache_path']}/nginx_foo123_module/#{node['nginx']['foo123']['checksum']}"
+
+        remote_file 'src_filepath' do
+          source node['nginx']['foo123']['url']
+          checksum node['nginx']['foo123']['checksum']
+          owner 'root'
+          group 'root'
+          mode '0755'
+        end
+
+        bash 'extract_module' do
+          cwd ::File.dirname(src_filepath)
+          code <<-EOH
+            mkdir -p #{extract_path}
+            tar xzf #{src_filename} -C #{extract_path}
+            mv #{extract_path}/*/* #{extract_path}/
+          EOH
+          not_if { ::File.exist?(extract_path) }
+        end
+        ```
+
+        **Install an application from git**
+
+        ```ruby
+        git "#{Chef::Config[:file_cache_path]}/ruby-build" do
+          repository 'git://github.com/rbenv/ruby-build.git'
+          revision 'master'
+          action :sync
+        end
+
+        bash 'install_ruby_build' do
+          cwd "#{Chef::Config[:file_cache_path]}/ruby-build"
+          user 'rbenv'
+          group 'rbenv'
+          code <<-EOH
+            ./install.sh
+          EOH
+          environment 'PREFIX' => '/usr/local'
+        end
+        ```
+
+        **Using Attributes in Bash Code**
+
+        The following recipe shows how an attributes file can be used to store certain settings. An attributes file is located in the `attributes/`` directory in the same cookbook as the recipe which calls the attributes file. In this example, the attributes file specifies certain settings for Python that are then used across all nodes against which this recipe will run.
+
+        Python packages have versions, installation directories, URLs, and checksum files. An attributes file that exists to support this type of recipe would include settings like the following:
+
+        ```ruby
+        default['python']['version'] = '2.7.1'
+
+        if python['install_method'] == 'package'
+          default['python']['prefix_dir'] = '/usr'
+        else
+          default['python']['prefix_dir'] = '/usr/local'
+        end
+
+        default['python']['url'] = 'http://www.python.org/ftp/python'
+        default['python']['checksum'] = '80e387...85fd61'
+        ```
+
+        and then the methods in the recipe may refer to these values. A recipe that is used to install Python will need to do the following:
+
+          - Identify each package to be installed (implied in this example, not shown)
+          - Define variables for the package `version` and the `install_path`
+          - Get the package from a remote location, but only if the package does not already exist on the target system
+          - Use the **bash** resource to install the package on the node, but only when the package is not already installed
+
+        ```ruby
+        version = node['python']['version']
+        install_path = "#{node['python']['prefix_dir']}/lib/python#{version.split(/(^\d+\.\d+)/)[1]}"
+
+        remote_file "#{Chef::Config[:file_cache_path]}/Python-#{version}.tar.bz2" do
+          source "#{node['python']['url']}/#{version}/Python-#{version}.tar.bz2"
+          checksum node['python']['checksum']
+          mode '0755'
+          not_if { ::File.exist?(install_path) }
+        end
+
+        bash 'build-and-install-python' do
+          cwd Chef::Config[:file_cache_path]
+          code <<-EOF
+            tar -jxvf Python-#{version}.tar.bz2
+            (cd Python-#{version} && ./configure #{configure_options})
+            (cd Python-#{version} && make && make install)
+          EOF
+          not_if { ::File.exist?(install_path) }
+        end
+        ```
       DOC
 
       def initialize(name, run_context = nil)

data/lib/chef/resource/bff_package.rb

@@ -28,25 +28,25 @@ class Chef
       description "Use the **bff_package** resource to manage packages for the AIX platform using the installp utility. When a package is installed from a local file, it must be added to the node using the **remote_file** or **cookbook_file** resources."
       introduced "12.0"
       examples <<~DOC
-      The **bff_package** resource is the default package provider on the AIX platform. The base **package** resource may be used, and then when the platform is AIX, #{ChefUtils::Dist::Infra::PRODUCT} will identify the correct package provider. The following examples show how to install part of the IBM XL C/C++ compiler.
+        The **bff_package** resource is the default package provider on the AIX platform. The base **package** resource may be used, and then when the platform is AIX, #{ChefUtils::Dist::Infra::PRODUCT} will identify the correct package provider. The following examples show how to install part of the IBM XL C/C++ compiler.
 
-      **Installing using the base package resource**
+        **Installing using the base package resource**
 
-      ```ruby
-      package 'xlccmp.13.1.0' do
-        source '/var/tmp/IBM_XL_C_13.1.0/usr/sys/inst.images/xlccmp.13.1.0'
-        action :install
-      end
-      ```
+        ```ruby
+        package 'xlccmp.13.1.0' do
+          source '/var/tmp/IBM_XL_C_13.1.0/usr/sys/inst.images/xlccmp.13.1.0'
+          action :install
+        end
+        ```
 
-      **Installing using the bff_package resource**
+        **Installing using the bff_package resource**
 
-      ```ruby
-      bff_package 'xlccmp.13.1.0' do
-        source '/var/tmp/IBM_XL_C_13.1.0/usr/sys/inst.images/xlccmp.13.1.0'
-        action :install
-      end
-      ```
+        ```ruby
+        bff_package 'xlccmp.13.1.0' do
+          source '/var/tmp/IBM_XL_C_13.1.0/usr/sys/inst.images/xlccmp.13.1.0'
+          action :install
+        end
+        ```
       DOC
 
       property :package_name, String,

data/lib/chef/resource/breakpoint.rb

@@ -28,61 +28,61 @@ class Chef
       description "Use the **breakpoint** resource to add breakpoints to recipes. Run the #{ChefUtils::Dist::Infra::SHELL} in #{ChefUtils::Dist::Infra::PRODUCT} mode, and then use those breakpoints to debug recipes. Breakpoints are ignored by the #{ChefUtils::Dist::Infra::CLIENT} during an actual #{ChefUtils::Dist::Infra::CLIENT} run. That said, breakpoints are typically used to debug recipes only when running them in a non-production environment, after which they are removed from those recipes before the parent cookbook is uploaded to the Chef server."
       introduced "12.0"
       examples <<~DOC
-      **A recipe without a breakpoint**
+        **A recipe without a breakpoint**
 
-      ```ruby
-      yum_key node['yum']['elrepo']['key'] do
-        url  node['yum']['elrepo']['key_url']
-        action :add
-      end
+        ```ruby
+        yum_key node['yum']['elrepo']['key'] do
+          url  node['yum']['elrepo']['key_url']
+          action :add
+        end
 
-      yum_repository 'elrepo' do
-        description 'ELRepo.org Community Enterprise Linux Extras Repository'
-        key node['yum']['elrepo']['key']
-        mirrorlist node['yum']['elrepo']['url']
-        includepkgs node['yum']['elrepo']['includepkgs']
-        exclude node['yum']['elrepo']['exclude']
-        action :create
-      end
-      ```
+        yum_repository 'elrepo' do
+          description 'ELRepo.org Community Enterprise Linux Extras Repository'
+          key node['yum']['elrepo']['key']
+          mirrorlist node['yum']['elrepo']['url']
+          includepkgs node['yum']['elrepo']['includepkgs']
+          exclude node['yum']['elrepo']['exclude']
+          action :create
+        end
+        ```
 
-      **The same recipe with breakpoints**
+        **The same recipe with breakpoints**
 
-      In the following example, the name of each breakpoint is an arbitrary string.
+        In the following example, the name of each breakpoint is an arbitrary string.
 
-      ```ruby
-      breakpoint "before yum_key node['yum']['repo_name']['key']" do
-        action :break
-      end
+        ```ruby
+        breakpoint "before yum_key node['yum']['repo_name']['key']" do
+          action :break
+        end
 
-      yum_key node['yum']['repo_name']['key'] do
-        url  node['yum']['repo_name']['key_url']
-        action :add
-      end
+        yum_key node['yum']['repo_name']['key'] do
+          url  node['yum']['repo_name']['key_url']
+          action :add
+        end
 
-      breakpoint "after yum_key node['yum']['repo_name']['key']" do
-        action :break
-      end
+        breakpoint "after yum_key node['yum']['repo_name']['key']" do
+          action :break
+        end
 
-      breakpoint "before yum_repository 'repo_name'" do
-        action :break
-      end
+        breakpoint "before yum_repository 'repo_name'" do
+          action :break
+        end
 
-      yum_repository 'repo_name' do
-        description 'description'
-        key node['yum']['repo_name']['key']
-        mirrorlist node['yum']['repo_name']['url']
-        includepkgs node['yum']['repo_name']['includepkgs']
-        exclude node['yum']['repo_name']['exclude']
-        action :create
-      end
+        yum_repository 'repo_name' do
+          description 'description'
+          key node['yum']['repo_name']['key']
+          mirrorlist node['yum']['repo_name']['url']
+          includepkgs node['yum']['repo_name']['includepkgs']
+          exclude node['yum']['repo_name']['exclude']
+          action :create
+        end
 
-      breakpoint "after yum_repository 'repo_name'" do
-        action :break
-      end
-      ```
+        breakpoint "after yum_repository 'repo_name'" do
+          action :break
+        end
+        ```
 
-      In the previous examples, the names are used to indicate if the breakpoint is before or after a resource and also to specify which resource it is before or after.
+        In the previous examples, the names are used to indicate if the breakpoint is before or after a resource and also to specify which resource it is before or after.
       DOC
 
       default_action :break

data/lib/chef/resource/cab_package.rb

@@ -29,33 +29,33 @@ class Chef
       description "Use the **cab_package** resource to install or remove Microsoft Windows cabinet (.cab) packages."
       introduced "12.15"
       examples <<~'DOC'
-      **Using local path in source**
+        **Using local path in source**
 
-      ```ruby
-      cab_package 'Install .NET 3.5 sp1 via KB958488' do
-        source 'C:\Users\xyz\AppData\Local\Temp\Windows6.1-KB958488-x64.cab'
-        action :install
-      end
+        ```ruby
+        cab_package 'Install .NET 3.5 sp1 via KB958488' do
+          source 'C:\Users\xyz\AppData\Local\Temp\Windows6.1-KB958488-x64.cab'
+          action :install
+        end
 
-      cab_package 'Remove .NET 3.5 sp1 via KB958488' do
-        source 'C:\Users\xyz\AppData\Local\Temp\Windows6.1-KB958488-x64.cab'
-        action :remove
-      end
-      ```
+        cab_package 'Remove .NET 3.5 sp1 via KB958488' do
+          source 'C:\Users\xyz\AppData\Local\Temp\Windows6.1-KB958488-x64.cab'
+          action :remove
+        end
+        ```
 
-      **Using URL in source**
+        **Using URL in source**
 
-      ```ruby
-      cab_package 'Install .NET 3.5 sp1 via KB958488' do
-        source 'https://s3.amazonaws.com/my_bucket/Windows6.1-KB958488-x64.cab'
-        action :install
-      end
+        ```ruby
+        cab_package 'Install .NET 3.5 sp1 via KB958488' do
+          source 'https://s3.amazonaws.com/my_bucket/Windows6.1-KB958488-x64.cab'
+          action :install
+        end
 
-      cab_package 'Remove .NET 3.5 sp1 via KB958488' do
-        source 'https://s3.amazonaws.com/my_bucket/Temp\Windows6.1-KB958488-x64.cab'
-        action :remove
-      end
-      ```
+        cab_package 'Remove .NET 3.5 sp1 via KB958488' do
+          source 'https://s3.amazonaws.com/my_bucket/Temp\Windows6.1-KB958488-x64.cab'
+          action :remove
+        end
+        ```
       DOC
 
       allowed_actions :install, :remove