geminabox 4.0.0 → 4.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 758c29c033252b87dc6fbe24ee015340f6f0c365ecc01aed02b7809e15ff3a6e
-  data.tar.gz: 321199cded3cc8b60cf4ecf7f9b04c2a14ec5cc5246a0f072e3d4d12307106cd
+  metadata.gz: a7be0ebee3d899057907a90084837978a25915b3a82683e8ea74e0d1227d3125
+  data.tar.gz: 12a531294faf2cb0745b44ac1c9191a759f0d82ba05acabfa33d05637e4d551f
 SHA512:
-  metadata.gz: b726d61fe2807fb6c2d0d19544c9e52d8b3cef10be0dd8d772e72f866d286017609034e54ff15ac222cb5bca6fac9394e57b964ae8cb939c7a4e34bc73431f89
-  data.tar.gz: 0d84ea5560b6cc1bd32de94dd0b6952256f820e98ca5fdfbda9656c47eea1fecac25c8f3177518fc6ca59ba2fc293f072f75c18154f69d1e50cb70131208c05a
+  metadata.gz: 149594466d61a7637ec9e308aba64b4b076588f9e01523fac0cded7465f7bfeb257a9ea6b051e17a408580775f64210201b87d1fc5a81bb1d9555b28caab978d
+  data.tar.gz: c9ff3b58f3c76ca47330a9949ad6d01c98a88a5970d06eb06c0e0c417122315e3fadefc9b69e6e777c5b4adfc5a53b6675b014a53c2d9849cf455a547051fe6d

data/lib/geminabox/hostess.rb

@@ -9,7 +9,10 @@ module Geminabox
 
     def serve
       headers["Cache-Control"] = 'no-transform'
-      send_file(File.expand_path(File.join(Geminabox.data, *request.path_info)), :type => response['Content-Type'])
+      path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+      # Rack::Protection normally strips ".." first; this holds without it.
+      halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+      send_file(path, :type => response['Content-Type'])
     end
 
     %w[/specs.4.8.gz

data/lib/geminabox/incoming_gem.rb

@@ -26,8 +26,12 @@ module Geminabox
       File.open(@tempfile.path, "rb")
     end
 
+    # spec comes from the uploaded archive and RubyGems does not validate it on
+    # read, so the name must be checked before it becomes part of a path.
     def valid?
-      spec && spec.name && spec.version
+      spec && spec.name && spec.version &&
+        spec.name.match?(Gem::Specification::VALID_NAME_PATTERN) &&
+        File.basename(name) == name
     rescue Gem::Package::Error
       false
     end

data/lib/geminabox/server.rb

@@ -174,8 +174,9 @@ module Geminabox
         error_response(403, 'Gem deletion is disabled - see https://github.com/geminabox/geminabox/issues/115')
       end
 
+      path = file_path
       serialize_update do
-        File.delete file_path if File.exist? file_path
+        File.delete path if File.exist? path
         self.class.reindex(:force_rebuild)
         redirect url("/")
       end
@@ -309,7 +310,10 @@ HTML
     end
 
     def file_path
-      File.expand_path(File.join(Geminabox.data, *request.path_info))
+      path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+      # Rack::Protection normally strips ".." first; this holds without it.
+      halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+      path
     end
 
     def dependency_cache

data/lib/geminabox/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Geminabox
-  VERSION = '4.0.0' unless defined? VERSION
+  VERSION = '4.0.1' unless defined? VERSION
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: geminabox
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.0.1
 platform: ruby
 authors:
 - Tom Lea