dradis-projects 3.21.0 → 4.1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d19a3cf6f2164c69c08fd2fa151849338f50cd2756c85a004caee2b304a34019
-  data.tar.gz: ae3b507fa0d58612cdd148237e2bf5d3d61430ce83e6e4ae43efa40cc21c64d2
+  metadata.gz: 68ddaed8e020a33f06c7dd722bbb0502f7598a76eaf61a0f2c4a05716ebbf2be
+  data.tar.gz: 66d06ddd0941b6eaa9ab7b1839af76620b2e764cf25ce0cc90778a91ecfe003b
 SHA512:
-  metadata.gz: ab39dd0a946b71c978443de7f921c30edcba47e4485459247b4cd4565998066fd53b5511747e0723faf4773aebe5ee37e9ec4c5b632aa47d35c04d08e37c8f23
-  data.tar.gz: 4e6527f380b9baaf70d974eb6b54ced56e471d02874a77ca6b23a6c0a5b6f9fa3cb44ac56bbd5b0be00cc24189a279c7601014cf9ec2637fe0a3f6979be7fd09
+  metadata.gz: 7d3b899c0aa7a605c47fdc85d52baea5b966a94392f123a835495a14ae05ba8a6637e37a2dd74cfa76458b19f12a1013979afed7a191e1ea95c6ff5e1015ccb7
+  data.tar.gz: 8d84010325dfadaa0d51ef0ae3e45e27d049bcd7ed0a0754d1c3c605b7598c2bbc78e3dc7306b600a09e5ad77a4c208c170aa27fcd4c9d2c44c00093afff5cb6

data/.ruby-version

@@ -1 +1 @@
-2.4.1
+2.7.2

data/CHANGELOG.md

@@ -1,85 +1,76 @@
-## Dradis Framework 3.21 (February, 2021) ##
+v4.1.2.1 (December 2021)
+  - Security Fixes:
+    - High: Authenticated author path traversal
 
-*  No changes
+v4.1.1 (November 2021)
+  - Loosen dradis-plugins version requirement
 
-## Dradis Framework 3.20 (Jan, 2020) ##
+v4.1.0 (November 2021)
+  - No changes
 
-*  Add views for the export view.
-*  Fix exporting projects with comments by deleted users.
+v4.0.0 (July 2021)
+  - No changes
 
-## Dradis Framework 3.19 (September, 2020) ##
+v3.22.0 (April 2021)
+  - No changes
 
-*  No changes
+v3.21.0 (February 2021)
+  - No changes
 
-## Dradis Framework 3.18 (July, 2020) ##
+v3.20.0 (January 2020)
+  - Add views for the export view
+  - Fix exporting projects with comments by deleted users
 
-*  No changes
+v3.19.0 (September 2020)
+  - No changes
 
-## Dradis Framework 3.17 (May, 2020) ##
+v3.18.0 (July 2020)
+  - No changes
 
-*  No changes
+v3.17.0 (May 2020)
+  - No changes
 
-## Dradis Framework 3.16 (February, 2020) ##
+v3.16.0 (February 2020)
+  - No changes
 
-*  No changes
+v3.15.0 (November 2019)
+  - Being able to export/upload boards (v3)
+  - Fix upload with attachments
 
-## Dradis Framework 3.15 (November, 2019) ##
+v3.14.1 (October 2019)
+  - Fix directory traversal vulnerability
 
-*  Fix upload with attachments
-*  Being able to export/upload boards (v3)
+v3.14.0 (August 2019)
+  - No changes
 
-## Dradis Framework 3.14.1 (October, 2019) ##
+v3.13.0 (June 2019)
+  - No changes
 
-*  Fix directory traversal vulnerability
+v3.12.0 (March 2019)
+  - No changes
 
-## Dradis Framework 3.14 (August, 2019) ##
+v3.11.0 (November 2018)
+  - Note and evidence comments in export/import
 
-*  No changes
+v3.10.0 (August 2018)
+  - Check project existence for default user id
+  - Issue comments in export/import
+  - Replace Node methods that are now Project methods
+  - Use project scopes
 
-## Dradis Framework 3.13 (June, 2019) ##
+v3.9.0 (January 2018)
+  - Add default user id as fallback for activity user when importing
+  - Fix nodes upload
 
-*  No changes
+v3.8.0 (September 2017)
+  - Add parse_report_content placeholders to import/export
+  - Add version attribute to exported methodologies
 
-## Dradis Framework 3.12 (March, 2019) ##
+v3.7.0 (July 2017)
+  - Skip closing the logger in thorfile
 
-*  No changes
-
-## Dradis Framework 3.11 (November, 2018) ##
-
-*  Note and evidence comments in export/import
-
-## Dradis Framework 3.10 (August, 2018) ##
-
-*   Use project scopes
-
-*   Check project existence for default user id
-
-*   Issue comments in export/import
-
-*   Replace Node methods that are now Project methods
-
-## Dradis Framework 3.9 (January, 2018) ##
-
-*   Fix nodes upload
-
-*   Add default user id as fallback for activity user when importing
-
-## Dradis Framework 3.8 (September, 2017) ##
-
-*   Add version attribute to exported methodologies
-
-*   Add parse_report_content placeholders to import/export.
-
-## Dradis Framework 3.7 (July, 2017) ##
-
-*   Skip closing the logger in thorfile
-
-## Dradis Framework 3.6 (March, 2017) ##
-
-*   Include file version in project template export.
-
-*   Stop using homegrown configuration and use `Rails.application.config`.
-
-*   Make the project template exporter / uploader configurable.
-
-*   Break down the #export and #parse methods into smaller tasks.
+v3.6.0 (March 2017)
+  - Break down the #export and #parse methods into smaller tasks
+  - Include file version in project template export
+  - Make the project template exporter / uploader configurable
+  - Stop using homegrown configuration and use `Rails.application.config`

data/CHANGELOG.template

@@ -0,0 +1,12 @@
+[v#.#.#] ([month] [YYYY])
+  - [future tense verb] [feature]
+  - Upgraded gems:
+    - [gem]
+  - Bugs fixes:
+    - [future tense verb] [bug fix]
+    - Bug tracker items:
+      - [item]
+  - Security Fixes:
+    - High: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description]
+    - Medium: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description]
+    - Low: (Authenticated|Unauthenticated) (admin|author|contributor) [vulnerability description]

data/dradis-projects.gemspec

@@ -20,11 +20,11 @@ Gem::Specification.new do |spec|
   spec.executables = spec.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
   spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
 
-  spec.add_development_dependency 'bundler', '~> 1.6'
+  spec.add_development_dependency 'bundler', '~> 2.2'
   spec.add_development_dependency 'combustion'
   spec.add_development_dependency 'rake', '~> 10.0'
   spec.add_development_dependency 'rspec'
 
-  spec.add_dependency 'dradis-plugins', '~> 3.7'
+  spec.add_dependency 'dradis-plugins', '~> 4.0'
   spec.add_dependency 'rubyzip'
 end

data/lib/dradis/plugins/projects/export/v3/template.rb

@@ -13,43 +13,7 @@ module Dradis::Plugins::Projects::Export::V3
           node_id =
             board.node == project.methodology_library ? nil : board.node_id
 
-          methodologies_builder.board(version: VERSION) do |board_builder|
-            board_builder.id(board.id)
-            board_builder.name(board.name)
-            board_builder.node_id(node_id)
-
-            board.ordered_items.each do |list|
-
-              board_builder.list do |list_builder|
-                list_builder.id(list.id)
-                list_builder.name(list.name)
-                list_builder.previous_id(list.previous_id)
-
-                list.ordered_items.each do |card|
-
-                  list_builder.card do |card_builder|
-                    card_builder.id(card.id)
-                    card_builder.name(card.name)
-                    card_builder.description do
-                      card_builder.cdata!(card.description)
-                    end
-                    card_builder.due_date(card.due_date)
-                    card_builder.previous_id(card.previous_id)
-
-                    card_builder.assignees do |assignee_builder|
-                      card.assignees.each do |assignee|
-                        assignee_builder.assignee(assignee.email)
-                      end
-                    end
-
-                    build_activities_for(card_builder, card)
-                    build_comments_for(card_builder, card)
-                  end
-
-                end
-              end
-            end
-          end
+          board.to_xml(methodologies_builder, includes: [:activities, :assignees, :comments], version: VERSION)
         end
       end
     end

data/lib/dradis/plugins/projects/gem_version.rb

@@ -7,10 +7,10 @@ module Dradis
       end
 
       module VERSION
-        MAJOR = 3
-        MINOR = 21
-        TINY = 0
-        PRE = nil
+        MAJOR = 4
+        MINOR = 1
+        TINY = 2
+        PRE = 1
 
         STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
       end

data/lib/dradis/plugins/projects/upload/package.rb

@@ -47,13 +47,18 @@ module Dradis::Plugins::Projects::Upload
 
 
           logger.info { 'Moving attachments to their final destinations...' }
-          lookup_table[:nodes].each do |oldid,newid|
-            if File.directory? Rails.root.join('tmp', 'zip', oldid)
-              FileUtils.mkdir_p Attachment.pwd.join(newid.to_s)
+          lookup_table[:nodes].each do |oldid, newid|
+            tmp_dir = Rails.root.join('tmp', 'zip')
+            old_attachments_dir = File.expand_path(tmp_dir.join(oldid.to_s))
 
-              Dir.glob(Rails.root.join('tmp', 'zip', oldid, '*')).each do |attachment|
-                FileUtils.mv(attachment, Attachment.pwd.join(newid.to_s))
-              end
+            # Ensure once the path is expanded it's still within the expected
+            # tmp directory to prevent unauthorized access to other dirs
+            next unless old_attachments_dir.starts_with?(tmp_dir.to_s) && File.directory?(old_attachments_dir)
+
+            FileUtils.mkdir_p Attachment.pwd.join(newid.to_s)
+
+            Dir.glob(Pathname.new(old_attachments_dir).join('*')).each do |attachment|
+              FileUtils.mv(attachment, Attachment.pwd.join(newid.to_s))
             end
           end
           logger.info { 'Done.' }

data/lib/dradis/plugins/projects/upload/v1/template.rb

@@ -105,7 +105,7 @@ module Dradis::Plugins::Projects::Upload::V1
           logger.info { "Adjusting screenshot URLs: #{item.class.name} ##{item.id}" }
 
           new_text = item.send(text_attr).gsub(ATTACHMENT_URL) do |_|
-            "!%s/projects/%d/nodes/%d/attachments/%s!" % [$1, project.id, lookup_table[:nodes][$2], $3]
+            "!%s/projects/%d/nodes/%d/attachments/%s!" % [$1, project.id, lookup_table[:nodes][$2.to_i], $3]
           end
           item.send(text_attr.to_s + "=", new_text)
 
@@ -121,7 +121,7 @@ module Dradis::Plugins::Projects::Upload::V1
           evidence.issue_id = lookup_table[:issues][evidence.issue_id.to_s]
 
           new_content = evidence.content.gsub(ATTACHMENT_URL) do |_|
-            "!%s/projects/%d/nodes/%d/attachments/%s!" % [$1, project.id, lookup_table[:nodes][$2], $3]
+            "!%s/projects/%d/nodes/%d/attachments/%s!" % [$1, project.id, lookup_table[:nodes][$2.to_i], $3]
           end
           evidence.content = new_content
 
@@ -289,7 +289,12 @@ module Dradis::Plugins::Projects::Upload::V1
           node = parse_node(xml_node)
 
           # keep track of reassigned ids
-          lookup_table[:nodes][xml_node.at_xpath('id').text.strip] = node.id
+          # Convert the id to an integer as it has no place being a string, or
+          # directory path. We later use this ID to build a directory structure
+          # to place attachments and without validation opens the potential for
+          # path traversal.
+          node_original_id = Integer(xml_node.at_xpath('id').text.strip)
+          lookup_table[:nodes][node_original_id] = node.id
         end
 
         logger.info { 'Done.' }

data/lib/dradis/plugins/projects/upload/v3/template.rb

@@ -131,7 +131,7 @@ module Dradis::Plugins::Projects::Upload::V3
           xml_node_id = xml_board.at_xpath('node_id').try(:text)
           node_id =
             if xml_node_id.present?
-              lookup_table[:nodes][xml_node_id]
+              lookup_table[:nodes][xml_node_id.to_i]
             else
               project.methodology_library.id
             end

data/spec/fixtures/files/malformed_ids.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<dradis-template version="1">
+  <nodes>
+    <node>
+      <id>../../../../../../tmp</id>
+      <label>Node 1</label>
+      <parent-id/>
+      <position>0</position>
+      <properties><![CDATA[{
+}]]></properties>
+      <type-id>1</type-id>
+    </node>
+  </nodes>
+</dradis-template>

data/spec/lib/dradis/plugins/projects/upload/v1/template_spec.rb

@@ -1,15 +1,17 @@
+# frozen_string_literal: true
+
 require 'rails_helper'
 
 describe Dradis::Plugins::Projects::Upload::V1::Template::Importer do
-
   let(:project) { create(:project) }
   let(:user) { create(:user) }
   let(:importer_class) { Dradis::Plugins::Projects::Upload::Template }
-  let(:file_path) {
-    File.join(File.dirname(__FILE__), '../../../../../../', 'fixtures', 'files', 'attachments_url.xml')
-  }
 
   context 'uploading a template with attachments url' do
+    let(:file_path) do
+      File.join(File.dirname(__FILE__), '../../../../../../', 'fixtures', 'files', 'attachments_url.xml')
+    end
+
     it 'converts the urls' do
       importer = importer_class::Importer.new(
         default_user_id: user.id,
@@ -30,4 +32,20 @@ describe Dradis::Plugins::Projects::Upload::V1::Template::Importer do
       )
     end
   end
+
+  context 'uploading a template malformed paths as ids' do
+    let(:file_path) do
+      File.join(File.dirname(__FILE__), '../../../../../../', 'fixtures', 'files', 'malformed_ids.xml')
+    end
+
+    it 'returns false' do
+      importer = importer_class::Importer.new(
+        default_user_id: user.id,
+        plugin: importer_class,
+        project_id: project.id
+      )
+
+      expect(importer.import(file: file_path)).to be false
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dradis-projects
 version: !ruby/object:Gem::Version
-  version: 3.21.0
+  version: 4.1.2.1
 platform: ruby
 authors:
 - Daniel Martin
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-02-12 00:00:00.000000000 Z
+date: 2021-12-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: combustion
   requirement: !ruby/object:Gem::Requirement
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.7'
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.7'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
@@ -105,6 +105,7 @@ files:
 - ".gitignore"
 - ".ruby-version"
 - CHANGELOG.md
+- CHANGELOG.template
 - CONTRIBUTING.md
 - Gemfile
 - LICENSE
@@ -133,6 +134,7 @@ files:
 - lib/dradis/plugins/projects/version.rb
 - lib/tasks/thorfile.rb
 - spec/fixtures/files/attachments_url.xml
+- spec/fixtures/files/malformed_ids.xml
 - spec/fixtures/files/with_comments.xml
 - spec/lib/dradis/plugins/projects/export/v2/template_spec.rb
 - spec/lib/dradis/plugins/projects/upload/v1/template_spec.rb
@@ -141,7 +143,7 @@ homepage: http://dradisframework.org
 licenses:
 - GPL-2
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -156,12 +158,13 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.4
-signing_key:
+rubygems_version: 3.2.28
+signing_key: 
 specification_version: 4
 summary: Project export/upload for the Dradis Framework.
 test_files:
 - spec/fixtures/files/attachments_url.xml
+- spec/fixtures/files/malformed_ids.xml
 - spec/fixtures/files/with_comments.xml
 - spec/lib/dradis/plugins/projects/export/v2/template_spec.rb
 - spec/lib/dradis/plugins/projects/upload/v1/template_spec.rb