mixlib-archive 1.1.7 → 1.3.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: b35fec12553ca1063ebe885c7ac8bf8104aa06a1a023bf16f3dfa4d0ce179d61
4
- data.tar.gz: ccdf277f081a43769e528a1c8e8698094b13cd96132de6b96ceba77de120e5f0
3
+ metadata.gz: 7bcacecefbbf9315c8f0aeaeb88b10960d2165d7bf1d2e3908937425d7a19070
4
+ data.tar.gz: e4e8900888fafdf9ecc45db342f5c0f3f73b6bbc589f312542cdf8872dded375
5
5
  SHA512:
6
- metadata.gz: a2a5c1b8fe30b9006201512f1ff823bf87b0896b45f4b4783e1d48d79a5f1d586cd07ba57e79728c1e58306c4e76521468115df3957981c9c48e08b464638e7e
7
- data.tar.gz: 81741f8241c8392918c0868fb4d32adb396e957e527a771dad363ac8d1efd892b9c4d3b6d0446d5b8bd3ea609dbc82f65d3eb3477dd078d62a5056b5e4573c9f
6
+ metadata.gz: 805484a3861b3fd6ccd6c2df3577ec088525e226682b5d129a585b4a13128e2141a5774d4a89f123cbdea45d23ab93887def4d17e7966231a29f5d798b9a9964
7
+ data.tar.gz: 2e9a6199bf4f40ba6d39536797eb2ee0decd3962918f97eeb79c2b11c98fa168b169a37cc090e67f6bdbbf5936ab668e5e1f678c9489057b59c5553d55f45795
@@ -14,7 +14,7 @@ module Mixlib
14
14
  # Extracts the archive to the given +destination+
15
15
  #
16
16
  # === Parameters
17
- # perms<Boolean>:: should the extracter use permissions from the archive.
17
+ # perms<Boolean>:: should the extractor use permissions from the archive.
18
18
  # ignore[Array]:: an array of matches of file paths to ignore
19
19
  def extract(destination, perms: true, ignore: [])
20
20
  ignore_re = Regexp.union(ignore)
@@ -1,4 +1,7 @@
1
1
  require "rubygems/package" unless defined?(Gem::Package)
2
+ require "rubygems/package/tar_reader" unless defined?(Gem::Package::TarReader)
3
+ require "rubygems/package/tar_writer" unless defined?(Gem::Package::TarWriter)
4
+ require "rubygems/package/tar_header" unless defined?(Gem::Package::TarHeader)
2
5
  require "tempfile" unless defined?(Tempfile)
3
6
  require "zlib" unless defined?(Zlib)
4
7
 
@@ -18,16 +21,17 @@ module Mixlib
18
21
  # Extracts the archive to the given +destination+
19
22
  #
20
23
  # === Parameters
21
- # perms<Boolean>:: should the extracter use permissions from the archive.
24
+ # perms<Boolean>:: should the extractor use permissions from the archive.
22
25
  # ignore[Array]:: an array of matches of file paths to ignore
23
26
  def extract(destination, perms: true, ignore: [])
24
27
  # (http://stackoverflow.com/a/31310593/506908)
25
28
  ignore_re = Regexp.union(ignore)
29
+ destination_root = File.expand_path(destination)
26
30
  reader do |tar|
27
31
  dest = nil
28
32
  tar.each do |entry|
29
33
  if entry.full_name == TAR_LONGLINK
30
- dest = File.join(destination, entry.read.strip)
34
+ dest = File.expand_path(File.join(destination, entry.read.strip))
31
35
  next
32
36
  end
33
37
  if entry.full_name =~ ignore_re
@@ -35,6 +39,13 @@ module Mixlib
35
39
  next
36
40
  end
37
41
  dest ||= File.expand_path(File.join(destination, entry.full_name))
42
+ # Reject any entry (including @LongLink-derived paths) that resolves
43
+ # outside destination, closing the tar-slip / path traversal bypass.
44
+ unless dest == destination_root || dest.start_with?(destination_root + File::SEPARATOR)
45
+ Mixlib::Archive::Log.warn "ignoring entry #{entry.full_name}: resolves outside #{destination}"
46
+ dest = nil
47
+ next
48
+ end
38
49
  parent = File.dirname(dest)
39
50
  FileUtils.mkdir_p(parent)
40
51
 
@@ -1,5 +1,5 @@
1
1
  module Mixlib
2
2
  class Archive
3
- VERSION = "1.1.7".freeze
3
+ VERSION = "1.3.6".freeze
4
4
  end
5
5
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: mixlib-archive
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.1.7
4
+ version: 1.3.6
5
5
  platform: ruby
6
6
  authors:
7
7
  - Chef Software, Inc
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2021-02-18 00:00:00.000000000 Z
11
+ date: 2026-09-18 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: mixlib-log
@@ -24,6 +24,20 @@ dependencies:
24
24
  - - ">="
25
25
  - !ruby/object:Gem::Version
26
26
  version: '0'
27
+ - !ruby/object:Gem::Dependency
28
+ name: cookstyle
29
+ requirement: !ruby/object:Gem::Requirement
30
+ requirements:
31
+ - - "~>"
32
+ - !ruby/object:Gem::Version
33
+ version: '8.5'
34
+ type: :development
35
+ prerelease: false
36
+ version_requirements: !ruby/object:Gem::Requirement
37
+ requirements:
38
+ - - "~>"
39
+ - !ruby/object:Gem::Version
40
+ version: '8.5'
27
41
  description: A simple interface to various archive formats
28
42
  email:
29
43
  - info@chef.io
@@ -48,14 +62,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
48
62
  requirements:
49
63
  - - ">="
50
64
  - !ruby/object:Gem::Version
51
- version: '2.4'
65
+ version: '3.1'
52
66
  required_rubygems_version: !ruby/object:Gem::Requirement
53
67
  requirements:
54
68
  - - ">="
55
69
  - !ruby/object:Gem::Version
56
70
  version: '0'
57
71
  requirements: []
58
- rubygems_version: 3.1.4
72
+ rubygems_version: 3.3.27
59
73
  signing_key:
60
74
  specification_version: 4
61
75
  summary: A simple interface to various archive formats