mixlib-archive 1.1.7 → 1.3.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/lib/mixlib/archive/lib_archive.rb +1 -1
- data/lib/mixlib/archive/tar.rb +13 -2
- data/lib/mixlib/archive/version.rb +1 -1
- metadata +18 -4
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 7bcacecefbbf9315c8f0aeaeb88b10960d2165d7bf1d2e3908937425d7a19070
|
|
4
|
+
data.tar.gz: e4e8900888fafdf9ecc45db342f5c0f3f73b6bbc589f312542cdf8872dded375
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 805484a3861b3fd6ccd6c2df3577ec088525e226682b5d129a585b4a13128e2141a5774d4a89f123cbdea45d23ab93887def4d17e7966231a29f5d798b9a9964
|
|
7
|
+
data.tar.gz: 2e9a6199bf4f40ba6d39536797eb2ee0decd3962918f97eeb79c2b11c98fa168b169a37cc090e67f6bdbbf5936ab668e5e1f678c9489057b59c5553d55f45795
|
|
@@ -14,7 +14,7 @@ module Mixlib
|
|
|
14
14
|
# Extracts the archive to the given +destination+
|
|
15
15
|
#
|
|
16
16
|
# === Parameters
|
|
17
|
-
# perms<Boolean>:: should the
|
|
17
|
+
# perms<Boolean>:: should the extractor use permissions from the archive.
|
|
18
18
|
# ignore[Array]:: an array of matches of file paths to ignore
|
|
19
19
|
def extract(destination, perms: true, ignore: [])
|
|
20
20
|
ignore_re = Regexp.union(ignore)
|
data/lib/mixlib/archive/tar.rb
CHANGED
|
@@ -1,4 +1,7 @@
|
|
|
1
1
|
require "rubygems/package" unless defined?(Gem::Package)
|
|
2
|
+
require "rubygems/package/tar_reader" unless defined?(Gem::Package::TarReader)
|
|
3
|
+
require "rubygems/package/tar_writer" unless defined?(Gem::Package::TarWriter)
|
|
4
|
+
require "rubygems/package/tar_header" unless defined?(Gem::Package::TarHeader)
|
|
2
5
|
require "tempfile" unless defined?(Tempfile)
|
|
3
6
|
require "zlib" unless defined?(Zlib)
|
|
4
7
|
|
|
@@ -18,16 +21,17 @@ module Mixlib
|
|
|
18
21
|
# Extracts the archive to the given +destination+
|
|
19
22
|
#
|
|
20
23
|
# === Parameters
|
|
21
|
-
# perms<Boolean>:: should the
|
|
24
|
+
# perms<Boolean>:: should the extractor use permissions from the archive.
|
|
22
25
|
# ignore[Array]:: an array of matches of file paths to ignore
|
|
23
26
|
def extract(destination, perms: true, ignore: [])
|
|
24
27
|
# (http://stackoverflow.com/a/31310593/506908)
|
|
25
28
|
ignore_re = Regexp.union(ignore)
|
|
29
|
+
destination_root = File.expand_path(destination)
|
|
26
30
|
reader do |tar|
|
|
27
31
|
dest = nil
|
|
28
32
|
tar.each do |entry|
|
|
29
33
|
if entry.full_name == TAR_LONGLINK
|
|
30
|
-
dest = File.join(destination, entry.read.strip)
|
|
34
|
+
dest = File.expand_path(File.join(destination, entry.read.strip))
|
|
31
35
|
next
|
|
32
36
|
end
|
|
33
37
|
if entry.full_name =~ ignore_re
|
|
@@ -35,6 +39,13 @@ module Mixlib
|
|
|
35
39
|
next
|
|
36
40
|
end
|
|
37
41
|
dest ||= File.expand_path(File.join(destination, entry.full_name))
|
|
42
|
+
# Reject any entry (including @LongLink-derived paths) that resolves
|
|
43
|
+
# outside destination, closing the tar-slip / path traversal bypass.
|
|
44
|
+
unless dest == destination_root || dest.start_with?(destination_root + File::SEPARATOR)
|
|
45
|
+
Mixlib::Archive::Log.warn "ignoring entry #{entry.full_name}: resolves outside #{destination}"
|
|
46
|
+
dest = nil
|
|
47
|
+
next
|
|
48
|
+
end
|
|
38
49
|
parent = File.dirname(dest)
|
|
39
50
|
FileUtils.mkdir_p(parent)
|
|
40
51
|
|
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: mixlib-archive
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.
|
|
4
|
+
version: 1.3.6
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Chef Software, Inc
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date:
|
|
11
|
+
date: 2026-09-18 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: mixlib-log
|
|
@@ -24,6 +24,20 @@ dependencies:
|
|
|
24
24
|
- - ">="
|
|
25
25
|
- !ruby/object:Gem::Version
|
|
26
26
|
version: '0'
|
|
27
|
+
- !ruby/object:Gem::Dependency
|
|
28
|
+
name: cookstyle
|
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
|
30
|
+
requirements:
|
|
31
|
+
- - "~>"
|
|
32
|
+
- !ruby/object:Gem::Version
|
|
33
|
+
version: '8.5'
|
|
34
|
+
type: :development
|
|
35
|
+
prerelease: false
|
|
36
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
37
|
+
requirements:
|
|
38
|
+
- - "~>"
|
|
39
|
+
- !ruby/object:Gem::Version
|
|
40
|
+
version: '8.5'
|
|
27
41
|
description: A simple interface to various archive formats
|
|
28
42
|
email:
|
|
29
43
|
- info@chef.io
|
|
@@ -48,14 +62,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
|
48
62
|
requirements:
|
|
49
63
|
- - ">="
|
|
50
64
|
- !ruby/object:Gem::Version
|
|
51
|
-
version: '
|
|
65
|
+
version: '3.1'
|
|
52
66
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
|
53
67
|
requirements:
|
|
54
68
|
- - ">="
|
|
55
69
|
- !ruby/object:Gem::Version
|
|
56
70
|
version: '0'
|
|
57
71
|
requirements: []
|
|
58
|
-
rubygems_version: 3.
|
|
72
|
+
rubygems_version: 3.3.27
|
|
59
73
|
signing_key:
|
|
60
74
|
specification_version: 4
|
|
61
75
|
summary: A simple interface to various archive formats
|