dragonfly 0.8.2 → 0.8.4

data/History.md

@@ -1,3 +1,9 @@
+0.8.4 (2010-04-27)
+==================
+Fixes
+-----
+- Security fix for file data store
+
 0.8.2 (2010-01-11)
 ==================
 Fixes

data/VERSION

@@ -1 +1 @@
-0.8.2
+0.8.4

data/dragonfly.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{dragonfly}
-  s.version = "0.8.2"
+  s.version = "0.8.4"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Mark Evans"]
-  s.date = %q{2011-01-11}
+  s.date = %q{2011-04-27}
   s.email = %q{mark@new-bamboo.co.uk}
   s.extra_rdoc_files = [
     "LICENSE",
@@ -176,7 +176,7 @@ Gem::Specification.new do |s|
   ]
   s.homepage = %q{http://github.com/markevans/dragonfly}
   s.require_paths = ["lib"]
-  s.rubygems_version = %q{1.3.7}
+  s.rubygems_version = %q{1.5.2}
   s.summary = %q{Dragonfly is an on-the-fly Rack-based image handling framework. It is suitable for use with Rails, Sinatra and other web frameworks. Although it's mainly used for images, it can handle any content type.}
   s.test_files = [
     "spec/argument_matchers.rb",
@@ -228,7 +228,6 @@ Gem::Specification.new do |s|
   ]
 
   if s.respond_to? :specification_version then
-    current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
     s.specification_version = 3
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then

data/lib/dragonfly/data_storage/file_data_store.rb

@@ -5,6 +5,9 @@ module Dragonfly
 
     class FileDataStore
 
+      # Exceptions
+      class BadUID < RuntimeError; end
+
       include Configurable
 
       configurable_attr :root_path, '/var/tmp/dragonfly'
@@ -33,6 +36,7 @@ module Dragonfly
       end
 
       def retrieve(relative_path)
+        validate_uid!(relative_path)
         path = absolute(relative_path)
         file = File.new(path)
         file.close
@@ -45,6 +49,7 @@ module Dragonfly
       end
 
       def destroy(relative_path)
+        validate_uid!(relative_path)
         path = absolute(relative_path)
         FileUtils.rm path
         FileUtils.rm extra_data_path(path)
@@ -108,6 +113,10 @@ module Dragonfly
         end
       end
 
+      def validate_uid!(uid)
+        raise BadUID, "tried to fetch uid #{uid.inspect} - perhaps due to a malicious user" if uid['..']
+      end
+
     end
 
   end

data/spec/dragonfly/data_storage/file_data_store_spec.rb

@@ -136,11 +136,13 @@ describe Dragonfly::DataStorage::FileDataStore do
   end
   
   describe "retrieve" do
+    
     it "should return a closed file" do
       uid = @data_store.store(@temp_object)
       file, extra = @data_store.retrieve(uid)
       file.should be_closed
     end
+
     it "should be able to retrieve any file, stored or not (and without extra data)" do
       FileUtils.mkdir_p("#{@data_store.root_path}/jelly_beans/are")
       File.open("#{@data_store.root_path}/jelly_beans/are/good", 'w'){|f| f.write('hey dog') }
@@ -148,10 +150,15 @@ describe Dragonfly::DataStorage::FileDataStore do
       File.read(file.path).should == 'hey dog'
       meta.should == {}
     end
+
+    it "should raise an error if the file path has .. in it" do
+      expect{
+        @data_store.retrieve('jelly_beans/../are/good')
+      }.to raise_error(Dragonfly::DataStorage::FileDataStore::BadUID)
+    end
   end
   
   describe "destroying" do
-
     it "should raise an error if the data doesn't exist" do
       lambda{
         @data_store.destroy('gooble/gubbub')
@@ -164,6 +171,11 @@ describe Dragonfly::DataStorage::FileDataStore do
       @data_store.root_path.should be_an_empty_directory
     end
 
+    it "should raise an error if the file path has .. in it" do
+      expect{
+        @data_store.destroy('jelly_beans/../are/good')
+      }.to raise_error(Dragonfly::DataStorage::FileDataStore::BadUID)
+    end
   end
 
 end

metadata

@@ -1,12 +1,8 @@
 --- !ruby/object:Gem::Specification 
 name: dragonfly
 version: !ruby/object:Gem::Version 
-  prerelease: false
-  segments: 
-  - 0
-  - 8
-  - 2
-  version: 0.8.2
+  prerelease: 
+  version: 0.8.4
 platform: ruby
 authors: 
 - Mark Evans
@@ -14,7 +10,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-01-11 00:00:00 +00:00
+date: 2011-04-27 00:00:00 +01:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -24,8 +20,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -37,8 +31,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -50,10 +42,6 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
-        - 8
-        - 5
         version: 0.8.5
   type: :development
   prerelease: false
@@ -65,8 +53,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -78,10 +64,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
-        - 5
-        - 0
         version: 0.5.0
   type: :development
   prerelease: false
@@ -93,9 +75,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        segments: 
-        - 1
-        - 4
         version: "1.4"
   type: :development
   prerelease: false
@@ -107,10 +86,6 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 2
-        - 1
-        - 4
         version: 2.1.4
   type: :development
   prerelease: false
@@ -122,8 +97,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -135,12 +108,6 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 1
-        - 5
-        - 0
-        - beta
-        - 2
         version: 1.5.0.beta.2
   type: :development
   prerelease: false
@@ -152,9 +119,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        segments: 
-        - 1
-        - 1
         version: "1.1"
   type: :development
   prerelease: false
@@ -166,8 +130,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -179,10 +141,6 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 3
-        - 0
-        - 3
         version: 3.0.3
   type: :development
   prerelease: false
@@ -194,8 +152,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -207,9 +163,6 @@ dependencies:
     requirements: 
     - - ~>
       - !ruby/object:Gem::Version 
-        segments: 
-        - 1
-        - 3
         version: "1.3"
   type: :development
   prerelease: false
@@ -221,8 +174,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -234,8 +185,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :development
   prerelease: false
@@ -247,10 +196,6 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 2
-        - 12
-        - 2
         version: 2.12.2
   type: :development
   prerelease: false
@@ -262,10 +207,6 @@ dependencies:
     requirements: 
     - - "="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 1
-        - 3
-        - 0
         version: 1.3.0
   type: :development
   prerelease: false
@@ -277,8 +218,6 @@ dependencies:
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        segments: 
-        - 0
         version: "0"
   type: :runtime
   prerelease: false
@@ -464,21 +403,17 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      segments: 
-      - 0
       version: "0"
 required_rubygems_version: !ruby/object:Gem::Requirement 
   none: false
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
-      segments: 
-      - 0
       version: "0"
 requirements: []
 
 rubyforge_project: 
-rubygems_version: 1.3.7
+rubygems_version: 1.5.2
 signing_key: 
 specification_version: 3
 summary: Dragonfly is an on-the-fly Rack-based image handling framework. It is suitable for use with Rails, Sinatra and other web frameworks. Although it's mainly used for images, it can handle any content type.