metasploit_data_models 5.0.5 → 5.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 00bd68f8a0e9727e8a61a8ef62c77265a527b86c39e700e0244e9974e7db1039
-  data.tar.gz: 323300caafddc850752818a075abd7fd998e16591f2d42f7d23ba5797bbae77d
+  metadata.gz: 507d624327960ae9ad2055e39b92350caa4f5c1e045f4c72885b9ed4666206d8
+  data.tar.gz: 4d4910b9e92ae2c2b245b592c145104c957212c0782f7f64dc4db51d2a099264
 SHA512:
-  metadata.gz: 15f22b13afb57fc18fad9a19f7ebb6b18bab95b13cb6f5f562dae9578fd411e81b3ff1692d2349ecad5991ee99183191730e5aa8f5a255957ec17901d31a64bf
-  data.tar.gz: 0e43b630f2a3c3207795eb22de079c2fc0a09a36d70c71d0dc0b831dd22f1531d9f3f4fff22d83a0af2153de4392b4374c8168d25ca87482feb8fb7ede13d458
+  metadata.gz: 7559d185736e6efd66db60a061eeae9f231654cf43a794fe90f14078deffcf14f353b05e40449627e2a6b207c1db5e482c59491e2876c3a90b9800f64455a38e
+  data.tar.gz: 4edb158f27af03fcdbd76b62d25497966214fdcd4a1c3a7b4a4ec25a958f2ecbe78e0265dd46f4cb138dc5695910257c37a51685015b1cbc657aa30b2876661a

data/.github/workflows/verify.yml

@@ -1,5 +1,21 @@
 name: Verify
 
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  actions: none
+  checks: none
+  contents: none
+  deployments: none
+  id-token: none
+  issues: none
+  discussions: none
+  packages: none
+  pages: none
+  pull-requests: none
+  repository-projects: none
+  security-events: none
+  statuses: none
+
 on:
   push:
     branches:
@@ -10,7 +26,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-18.04
+    runs-on: ${{ matrix.os }}
     timeout-minutes: 40
 
     services:
@@ -34,11 +50,18 @@ jobs:
           - 2.7
           - 3.0
           - 3.1
+        os:
+          - ubuntu-18.04
+          - ubuntu-22.04
+        exclude:
+          - { os: ubuntu-22.04, ruby: 2.6 }
+          - { os: ubuntu-22.04, ruby: 2.7 }
+          - { os: ubuntu-22.04, ruby: 3.0 }
 
     env:
       RAILS_ENV: test
 
-    name: Ruby ${{ matrix.ruby }}
+    name: ${{ matrix.os }} - Ruby ${{ matrix.ruby }}
     steps:
       - name: Install system dependencies
         run: sudo apt-get install libpcap-dev graphviz

data/Gemfile

@@ -3,7 +3,6 @@ source "https://rubygems.org"
 # Specify your gem's dependencies in metasploit_data_models.gemspec
 gemspec
 
-
 group :development do
   #gem 'metasploit-erd'
   # embed ERDs on index, namespace Module and Class<ApplicationRecord> pages
@@ -13,7 +12,7 @@ end
 # used by dummy application
 group :development, :test do
   # Upload coverage reports to coveralls.io
-  gem 'coveralls', require: false  
+  gem 'coveralls', require: false
   # supplies factories for producing model instance for specs
   # Version 4.1.0 or newer is needed to support generate calls without the 'FactoryBot.' in factory definitions syntax.
   gem 'factory_bot'
@@ -21,6 +20,8 @@ group :development, :test do
   gem 'factory_bot_rails'
 
   gem 'rails', '~> 6.0'
+  gem 'net-smtp', require: false
+
   # Used to create fake data
   gem "faker"
 

data/app/models/mdm/web_page.rb

@@ -1,6 +1,6 @@
 # Web page requested from a {#web_site}.
 class Mdm::WebPage < ApplicationRecord
-  
+
   #
   # Associations
   #

data/lib/metasploit_data_models/base64_serializer.rb

@@ -27,7 +27,7 @@ class MetasploitDataModels::Base64Serializer
       },
       lambda { |serialized|
         # Support legacy YAML encoding for existing data
-        YAML.load(serialized)
+        YAML.safe_load(serialized, permitted_classes: Rails.application.config.active_record.yaml_column_permitted_classes)
       },
       lambda { |serialized|
         # Fall back to string decoding

data/lib/metasploit_data_models/serialized_prefs.rb

@@ -24,4 +24,4 @@ module MetasploitDataModels::SerializedPrefs
       class_eval method_declarations, __FILE__, __LINE__
     end
   end
-end
+end

data/lib/metasploit_data_models/version.rb

@@ -1,6 +1,6 @@
 module MetasploitDataModels
   # VERSION is managed by GemRelease
-  VERSION = '5.0.5'
+  VERSION = '5.0.6'
 
   # @return [String]
   #

data/lib/metasploit_data_models/yaml.rb

@@ -0,0 +1,31 @@
+# Namespace for YAML configuration
+class MetasploitDataModels::YAML
+  #
+  # CONSTANTS
+  #
+
+  # List of supported classes when deserializing YAML classes
+  # See: https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
+  #
+  PERMITTED_CLASSES = [
+    Range,
+    Set,
+    Symbol,
+    Time,
+    'WEBrick::Cookie'.to_sym,
+    'ActionController::Parameters'.to_sym,
+    'ActiveModel::Attribute::FromDatabase'.to_sym,
+    'ActiveModel::Attribute::FromUser'.to_sym,
+    'ActiveModel::Attribute::WithCastValue'.to_sym,
+    'ActiveModel::Type::Boolean'.to_sym,
+    'ActiveModel::Type::Integer'.to_sym,
+    'ActiveModel::Type::String'.to_sym,
+    'ActiveRecord::Coders::JSON'.to_sym,
+    'ActiveSupport::TimeWithZone'.to_sym,
+    'ActiveSupport::TimeZone'.to_sym,
+    'ActiveRecord::Type::Serialized'.to_sym,
+    'ActiveRecord::Type::Text'.to_sym,
+    'ActiveSupport::HashWithIndifferentAccess'.to_sym,
+    'Mdm::Workspace'.to_sym
+  ].freeze
+end

data/lib/metasploit_data_models.rb

@@ -39,6 +39,7 @@ module MetasploitDataModels
   autoload :ModuleRun
   autoload :Search
   autoload :SerializedPrefs
+  autoload :YAML
 
   # The root directory of `metasploit_data_models` gem in both development and gem installs.
   #

data/metasploit_data_models.gemspec

@@ -41,7 +41,7 @@ Gem::Specification.new do |s|
   s.add_runtime_dependency 'webrick'
 
   # os fingerprinting
-  s.add_runtime_dependency 'recog', '~> 2.0'
+  s.add_runtime_dependency 'recog'
 
   # arel-helpers: Useful tools to help construct database queries with ActiveRecord and Arel.
   s.add_runtime_dependency 'arel-helpers'

data/spec/app/models/mdm/host_spec.rb

@@ -547,14 +547,14 @@ RSpec.describe Mdm::Host, type: :model do
         it "when the string contains 'ppc'" do
           expect(host.send(:get_arch_from_string, 'blahppcblah')).to eq('PowerPC')
         end
-      end
 
-      context 'should return nil' do
         it 'when PowerPC is cased incorrectly' do
-          expect(host.send(:get_arch_from_string, 'powerPC')).to eq(nil)
-          expect(host.send(:get_arch_from_string, 'Powerpc')).to eq(nil)
+          expect(host.send(:get_arch_from_string, 'powerPC')).to eq('PowerPC')
+          expect(host.send(:get_arch_from_string, 'Powerpc')).to eq('PowerPC')
         end
+      end
 
+      context 'should return nil' do
         it 'when no recognized arch string is present' do
           expect(host.send(:get_arch_from_string, 'blahblah')).to eq(nil)
         end

data/spec/app/models/metasploit_data_models/ip_address/v4/range_spec.rb

@@ -185,7 +185,7 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Range, type: :model do
   end
 
   context '#to_s' do
-    subject(:to_s) {
+    subject(:to_s_result) {
       range.to_s
     }
 
@@ -195,7 +195,7 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Range, type: :model do
       }
 
       it 'equals the original formatted value' do
-        expect(to_s).to eq(formatted_value)
+        expect(to_s_result).to eq(formatted_value)
       end
     end
 
@@ -295,4 +295,4 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Range, type: :model do
       it { is_expected.not_to be_a Range }
     end
   end
-end
+end

data/spec/app/models/metasploit_data_models/ip_address/v4/segment/nmap/list_spec.rb

@@ -135,7 +135,7 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Segment::Nmap::List, type: :
   end
 
   context '#to_s' do
-    subject(:to_s) do
+    subject(:to_s_value) do
       nmap.to_s
     end
 
@@ -145,7 +145,7 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Segment::Nmap::List, type: :
       }
 
       it 'returns a string equal to the original formatted value' do
-        expect(to_s).to eq(formatted_value)
+        expect(to_s_value).to eq(formatted_value)
       end
     end
 
@@ -155,7 +155,7 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Segment::Nmap::List, type: :
       }
 
       it 'returned the formatted value as a string' do
-        expect(to_s).to eq(formatted_value.to_s)
+        expect(to_s_value).to eq(formatted_value.to_s)
       end
     end
   end
@@ -273,4 +273,4 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Segment::Nmap::List, type: :
       end
     end
   end
-end
+end

data/spec/app/models/metasploit_data_models/ip_address/v4/segment/nmap/range_spec.rb

@@ -185,7 +185,7 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Segment::Nmap::Range, type:
   end
 
   context '#to_s' do
-    subject(:to_s) {
+    subject(:to_s_result) {
       range.to_s
     }
 
@@ -195,7 +195,7 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Segment::Nmap::Range, type:
       }
 
       it 'equals the original formatted value' do
-        expect(to_s).to eq(formatted_value)
+        expect(to_s_result).to eq(formatted_value)
       end
     end
 
@@ -299,4 +299,4 @@ RSpec.describe MetasploitDataModels::IPAddress::V4::Segment::Nmap::Range, type:
       it { is_expected.not_to be_a Range }
     end
   end
-end
+end

data/spec/dummy/config/application.rb

@@ -39,13 +39,15 @@ module Dummy
 
     # Configure sensitive parameters which will be filtered from the log file.
     config.filter_parameters += [:password]
-    
+
     # Raise deprecations as errors
     config.active_support.deprecation = :raise
 
     # Enable escaping HTML in JSON.
     config.active_support.escape_html_entities_in_json = true
 
+    config.active_record.yaml_column_permitted_classes = MetasploitDataModels::YAML::PERMITTED_CLASSES
+
     # Use SQL instead of Active Record's schema dumper when creating the database.
     # This is necessary if your schema can't be completely dumped by the schema dumper,
     # like if you have constraints or database-specific column types

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: metasploit_data_models
 version: !ruby/object:Gem::Version
-  version: 5.0.5
+  version: 5.0.6
 platform: ruby
 authors:
 - Metasploit Hackers
@@ -93,7 +93,7 @@ cert_chain:
   EknWpNgVhohbot1lfVAMmIhdtOVaRVcQQixWPwprDj/ydB8ryDMDosIMcw+fkoXU
   9GJsSaSRRYQ9UUkVL27b64okU8D48m8=
   -----END CERTIFICATE-----
-date: 2022-04-07 00:00:00.000000000 Z
+date: 2022-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: metasploit-yard
@@ -267,16 +267,16 @@ dependencies:
   name: recog
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: arel-helpers
   requirement: !ruby/object:Gem::Requirement
@@ -576,6 +576,7 @@ files:
 - lib/metasploit_data_models/search/visitor.rb
 - lib/metasploit_data_models/serialized_prefs.rb
 - lib/metasploit_data_models/version.rb
+- lib/metasploit_data_models/yaml.rb
 - metasploit_data_models.gemspec
 - script/rails
 - spec/app/models/mdm/api_key_spec.rb