dradis-projects 3.14.0 → 3.14.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: d6fc70a27fa19b6a05ceb21ddd2d1ce140cd01a0
4
- data.tar.gz: faddb3da14a31adbd6e9906ce1d2267695b84990
3
+ metadata.gz: 4bcb99879ce1660ca26e84dfa80564c46aaf5e99
4
+ data.tar.gz: c9838ef567edba5bd151ca33651661ff7d0d05f3
5
5
  SHA512:
6
- metadata.gz: a4521a538811350eb4244a0fc2bad39a78853f13f38a08055fe2d861dd838c0ba374aa918d47f3e82e0e68509978b1db35874d0b67950b2c2dd20d412825f88d
7
- data.tar.gz: 0527cb5c5ea5aa9f45a30df6ab76dfb156afef7471ce6c140e4c16c61f915cc9dfbcdd4e1de645b9a1e8db8f89e95698fdb62b6d4d5f17c16734f72c95d55bf9
6
+ metadata.gz: 86bd5c1ee5bdb8793b10e9e17f2da497dfadaf0b1a70a693b4b76d43756a6c6e47cba220defe57ec94c3a783a19fe04fc69786bb668c4000c75c758a02120292
7
+ data.tar.gz: 8d9ed93eb3d32eadba159a2bcd6051de9b8c4c8f87e62c72d4a9a21fa77a76a978b016218781b8e55fddb121ef8059d31e95ae158ca55553dd8ba5fe27350ce6
@@ -1,3 +1,7 @@
1
+ ## Dradis Framework 3.14.1 (October, 2019) ##
2
+
3
+ * Fix directory traversal vulnerability
4
+
1
5
  ## Dradis Framework 3.14 (August, 2019) ##
2
6
 
3
7
  * No changes
@@ -26,5 +26,5 @@ Gem::Specification.new do |spec|
26
26
  spec.add_development_dependency 'rspec'
27
27
 
28
28
  spec.add_dependency 'dradis-plugins', '~> 3.7'
29
- spec.add_dependency 'rubyzip', '~> 1.2.2'
29
+ spec.add_dependency 'rubyzip'
30
30
  end
@@ -9,7 +9,7 @@ module Dradis
9
9
  module VERSION
10
10
  MAJOR = 3
11
11
  MINOR = 14
12
- TINY = 0
12
+ TINY = 1
13
13
  PRE = nil
14
14
 
15
15
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
@@ -18,18 +18,21 @@ module Dradis::Plugins::Projects::Upload
18
18
  success = false
19
19
 
20
20
  # Unpack the archive in a temporary location
21
- FileUtils.mkdir Rails.root.join('tmp', 'zip')
21
+ temporary_dir = Rails.root.join('tmp', 'zip')
22
+ FileUtils.mkdir temporary_dir
22
23
 
23
24
  begin
24
25
  logger.info { 'Uncompressing the file...' }
25
26
  #TODO: this could be improved by only uncompressing the XML, then parsing
26
27
  # it to get the node_lookup table and then uncompressing each entry to its
27
28
  # final destination
28
- Zip::File.foreach(package) do |entry|
29
- path = Rails.root.join('tmp', 'zip', entry.name)
30
- FileUtils.mkdir_p(File.dirname(path))
31
- entry.extract(path)
32
- logger.info { "\t#{entry.name}" }
29
+ Dir.chdir(temporary_dir) do
30
+ Zip::File.foreach(package) do |entry|
31
+ path = temporary_dir.join(entry.name)
32
+ FileUtils.mkdir_p(File.dirname(path))
33
+ entry.extract
34
+ logger.info { "\t#{entry.name}" }
35
+ end
33
36
  end
34
37
  logger.info { 'Done.' }
35
38
 
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: dradis-projects
3
3
  version: !ruby/object:Gem::Version
4
- version: 3.14.0
4
+ version: 3.14.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Daniel Martin
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2019-08-12 00:00:00.000000000 Z
11
+ date: 2019-10-25 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -84,16 +84,16 @@ dependencies:
84
84
  name: rubyzip
85
85
  requirement: !ruby/object:Gem::Requirement
86
86
  requirements:
87
- - - "~>"
87
+ - - ">="
88
88
  - !ruby/object:Gem::Version
89
- version: 1.2.2
89
+ version: '0'
90
90
  type: :runtime
91
91
  prerelease: false
92
92
  version_requirements: !ruby/object:Gem::Requirement
93
93
  requirements:
94
- - - "~>"
94
+ - - ">="
95
95
  - !ruby/object:Gem::Version
96
- version: 1.2.2
96
+ version: '0'
97
97
  description: This plugin allows you to dump the contents of the repo into a zip archive
98
98
  and restore the state from one of them.
99
99
  email:
@@ -153,7 +153,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
153
153
  version: '0'
154
154
  requirements: []
155
155
  rubyforge_project:
156
- rubygems_version: 2.4.5
156
+ rubygems_version: 2.6.8
157
157
  signing_key:
158
158
  specification_version: 4
159
159
  summary: Project export/upload for the Dradis Framework.