geminabox 3.1.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cfce489e43841df96a314d9a85776328e77a48c3093fabbd9333f5ac0a83079
-  data.tar.gz: d3b23957c2ac25f41aab48528e49f85d24fb6701aabec0ae5d8ef622ea189521
+  metadata.gz: 4da5997cf6f07bf5f5c18308b50ddabae4e3acad3c59b5e725555632c94338ec
+  data.tar.gz: 27a3b1392251204e9f210b9efd1b2dbb0e081e851381fce830385f1eb9db4c28
 SHA512:
-  metadata.gz: '0985c4ba1960c2ef314f18a9a3a6209e76401ffd00ffed6ad79b5e75a3de169f47c315c87e25e930d8d72ecf3f41b94f2cd1d1d41f027ae0aa4c83796cd71cb8'
-  data.tar.gz: 9a28c37de926675893b4d620c037531e44894d084025ffbd6deb77d2f55be4e76fbc0f866e8547d29e6454f996dd9b1f5aea43c21ed44f9fd463c011d5e92c5b
+  metadata.gz: 74b98e66ccc6112d37fb694189c216297cbdfedaeaf1570ce2c0682db24722cb59c1ea5f513f7068743beb7b607969c6eca404f47d72aac822d99a066e9c07be
+  data.tar.gz: 4c818745e2edf7e128e4c6849d07a01f54b29cc851eaa57d5ffb9f101076b28db02f2c45ec49cc8c2bb25500f8e0ad1c67930b54b851122b4041e0f42fac8591

data/lib/geminabox/hostess.rb

@@ -9,7 +9,10 @@ module Geminabox
 
     def serve
       headers["Cache-Control"] = 'no-transform'
-      send_file(File.expand_path(File.join(Geminabox.data, *request.path_info)), :type => response['Content-Type'])
+      path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+      # Rack::Protection normally strips ".." first; this holds without it.
+      halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+      send_file(path, :type => response['Content-Type'])
     end
 
     %w[/specs.4.8.gz

data/lib/geminabox/incoming_gem.rb

@@ -26,8 +26,12 @@ module Geminabox
       File.open(@tempfile.path, "rb")
     end
 
+    # spec comes from the uploaded archive and RubyGems does not validate it on
+    # read, so the name must be checked before it becomes part of a path.
     def valid?
-      spec && spec.name && spec.version
+      spec && spec.name && spec.version &&
+        spec.name.match?(Gem::Specification::VALID_NAME_PATTERN) &&
+        File.basename(name) == name
     rescue Gem::Package::Error
       false
     end

data/lib/geminabox/proxy/file_handler.rb

@@ -8,6 +8,11 @@ module Geminabox
 
       def initialize(file_name)
         @file_name = file_name
+        # file_name comes from the request path; both paths get mkdir_p and writes.
+        root = File.expand_path(root_path) + File::SEPARATOR
+        unless local_path.start_with?(root) && proxy_path.start_with?(root)
+          raise ArgumentError, "#{file_name} resolves outside #{root_path}"
+        end
         ensure_destination_exists
       end
 

data/lib/geminabox/proxy/hostess.rb

@@ -14,7 +14,7 @@ module Geminabox
         if file_handler
           send_file file_handler.proxy_path
         else
-          send_file(File.expand_path(File.join(Geminabox.data, *request.path_info)), :type => response['Content-Type'])
+          send_file(data_path, :type => response['Content-Type'])
         end
       end
 
@@ -53,9 +53,7 @@ module Geminabox
       private
       def get_from_rubygems_if_not_local
 
-        file = File.expand_path(File.join(Geminabox.data, *request.path_info))
-
-        unless File.exist?(file)
+        unless File.exist?(data_path)
           ruby_gems_url = Geminabox.ruby_gems_url
           path = File.join(ruby_gems_url, *request.path_info)
           content = Geminabox.http_adapter.get_content(path)
@@ -70,6 +68,15 @@ module Geminabox
 
       def copy_file(file_name)
         self.file_handler = Copier.copy(file_name)
+      rescue ArgumentError
+        halt 404
+      end
+
+      # Rack::Protection normally strips ".." first; this holds without it.
+      def data_path
+        path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+        halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+        path
       end
 
 

data/lib/geminabox/server.rb

@@ -144,8 +144,9 @@ module Geminabox
         error_response(403, 'Gem deletion is disabled - see https://github.com/geminabox/geminabox/issues/115')
       end
 
+      path = file_path
       serialize_update do
-        File.delete file_path if File.exist? file_path
+        File.delete path if File.exist? path
         self.class.reindex(:force_rebuild)
         redirect url("/")
       end
@@ -255,7 +256,10 @@ HTML
     end
 
     def file_path
-      File.expand_path(File.join(Geminabox.data, *request.path_info))
+      path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+      # Rack::Protection normally strips ".." first; this holds without it.
+      halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+      path
     end
 
     def dependency_cache

data/lib/geminabox/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Geminabox
-  VERSION = '3.1.0' unless defined? VERSION
+  VERSION = '3.1.1' unless defined? VERSION
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: geminabox
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Tom Lea