safe_yaml-instructure 0.8.0

data/.gitignore

@@ -0,0 +1,2 @@
+Gemfile.lock
+dist/

data/.travis.yml

@@ -0,0 +1,45 @@
+language:
+  ruby
+
+before_install:
+  gem install bundler
+
+script:
+  bundle exec rake spec
+
+rvm:
+  - ruby-head
+  - 2.0.0
+  - 1.9.3
+  - 1.9.2
+  - 1.8.7
+  - rbx-19mode
+  - rbx-18mode
+  - jruby-head
+  - jruby-19mode
+  - jruby-18mode
+  - ree
+
+env:
+  - YAMLER=syck
+  - YAMLER=psych
+
+matrix:
+  allow_failures:
+    - rvm: ruby-head
+    - rvm: rbx-19mode
+    - rvm: rbx-18mode
+    - rvm: jruby-head
+    - rvm: jruby-19mode
+    - rvm: jruby-18mode
+    - rvm: ree
+
+  exclude:
+    - rvm: 1.8.7
+      env: YAMLER=psych
+    - rvm: jruby-head
+      env: YAMLER=syck
+    - rvm: jruby-19mode
+      env: YAMLER=syck
+    - rvm: jruby-18mode
+      env: YAMLER=syck

data/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2013 Dan Tao
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,124 @@
+SafeYAML
+========
+
+[![Build Status](https://travis-ci.org/instructure/safe_yaml.png)](http://travis-ci.org/instructure/safe_yaml)
+
+The **SafeYAML** gem provides an alternative implementation of `YAML.load` suitable for accepting user input in Ruby applications. Unlike Ruby's built-in implementation of `YAML.load`, SafeYAML's version will not expose apps to arbitrary code execution exploits (such as [the one recently discovered in Rails](http://www.reddit.com/r/netsec/comments/167c11/serious_vulnerability_in_ruby_on_rails_allowing/) (or [this one](http://www.h-online.com/open/news/item/Rails-developers-close-another-extremely-critical-flaw-1793511.html))).
+
+Installation
+------------
+
+Add this line to your application's Gemfile:
+
+    gem "safe_yaml-instructure"
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install safe_yaml-instructure
+
+Purpose
+-------
+
+Suppose your application were to contain some code like this:
+
+```ruby
+class ExploitableClassBuilder
+  def []=(key, value)
+    @class ||= Class.new
+
+    @class.class_eval <<-EOS
+      def #{key}
+        #{value}
+      end
+    EOS
+  end
+
+  def create
+    @class.new
+  end
+end
+```
+
+Now, if you were to use `YAML.load` on user input anywhere in your application without the SafeYAML gem installed, an attacker could make a request with a carefully-crafted YAML string to execute arbitrary code (yes, including `system("unix command")`) on your servers.
+
+Observe:
+
+    > yaml = <<-EOYAML
+    > --- !ruby/hash:ExploitableClassBuilder
+    > "foo; end; puts %(I'm in yr system!); def bar": "baz"
+    > EOYAML
+    => "--- !ruby/hash:ExploitableClassBuilder\n\"foo; end; puts %(I'm in yr system!); def bar\": \"baz\"\n"
+
+    > YAML.load(yaml)
+    I'm in yr system!
+    => #<ExploitableClassBuilder:0x007fdbbe2e25d8 @class=#<Class:0x007fdbbe2e2510>>
+
+With SafeYAML, that attacker would be thwarted:
+
+    > require "safe_yaml"
+    => true
+    > YAML.load(yaml)
+    SafeYAML::UnsafeTagError: YAML tag is not whitelisted: tag:ruby.yaml.org,2002:object:ExploitableClassBuilder
+
+Usage
+-----
+
+`YAML.safe_load` will load YAML without allowing arbitrary object deserialization.
+
+`YAML.unsafe_load` will exhibit Ruby's built-in behavior: to allow the deserialization of arbitrary objects.
+
+By default, when you require the safe_yaml gem in your project, `YAML.load` is patched to internally call `safe_load`. The patched method also accepts a `:safe` flag to specify which version to use:
+
+    # Ruby >= 1.9.3
+    YAML.load(yaml, filename, :safe => true) # calls safe_load
+    YAML.load(yaml, filename, :safe => false) # calls unsafe_load
+
+    # Ruby < 1.9.3
+    YAML.load(yaml, :safe => true) # calls safe_load
+    YAML.load(yaml, :safe => false) # calls unsafe_load
+
+The default behavior can be switched to unsafe loading by calling `YAML.enable_arbitrary_object_deserialization!`. In this case, the `:safe` flag still has the same effect, but the defaults are reversed (so calling `YAML.load` will have the same behavior as if the safe_yaml gem weren't required).
+
+This gem will also warn you whenever you use `YAML.load` without specifying the `:safe` option. If you do not want to see these messages in your logs, you can say `SafeYAML::OPTIONS[:suppress_warnings] = true` in an initializer.
+
+Notes
+-----
+
+The way that SafeYAML works is by restricting the kinds of objects that can be deserialized via `YAML.load`. More specifically, only the following types of objects can be deserialized by default:
+
+- Hashes
+- Arrays
+- Strings
+- Numbers
+- Dates
+- Times
+- Booleans
+- Nils
+
+Additionally, deserialization of symbols can be enabled by calling `YAML.enable_symbol_parsing!` (for example, in an initializer).
+
+Known Issues
+------------
+
+Also note that some Ruby libraries, particularly those requiring inter-process communication, leverage YAML's object deserialization functionality and therefore may break or otherwise be impacted by SafeYAML. The following list includes known instances of SafeYAML's interaction with other Ruby gems:
+
+- [**Guard**](https://github.com/guard/guard): Uses YAML as a serialization format for notifications. The data serialized uses symbolic keys, so calling `YAML.enable_symbol_parsing!` is necessary to allow Guard to work.
+- [**sidekiq**](https://github.com/mperham/sidekiq): Uses a YAML configiuration file with symbolic keys, so calling `YAML.enable_symbol_parsing!` should allow it to work.
+
+The above list will grow over time, as more issues are discovered.
+
+Caveat
+------
+
+This gem is quite young, and so the API may (read: *will*) change in future versions. The goal of the gem is to make it as easy as possible to protect existing applications from object deserialization exploits. Any and all feedback is more than welcome.
+
+Requirements
+------------
+
+SafeYAML requires Ruby 1.8.7 or newer and works with both [Syck](http://www.ruby-doc.org/stdlib-1.8.7/libdoc/yaml/rdoc/YAML.html) and [Psych](http://github.com/tenderlove/psych).
+
+If you are using a version of Ruby where Psych is the default YAML engine (e.g., 1.9.3) but you want to use Syck, be sure to set `YAML::ENGINE.yamler = "syck"` **before** requiring the safe_yaml gem.

data/Rakefile

@@ -0,0 +1,6 @@
+require "rspec/core/rake_task"
+
+desc "Run specs"
+RSpec::Core::RakeTask.new(:spec) do |t|
+  t.rspec_opts = %w(--color)
+end

data/lib/safe_yaml.rb

@@ -0,0 +1,145 @@
+require "set"
+require "yaml"
+
+require "safe_yaml/tag_verifier"
+require "safe_yaml/version"
+require "safe_yaml/whitelist"
+
+module SafeYAML
+  MULTI_ARGUMENT_YAML_LOAD = YAML.method(:load).arity != 1
+  YAML_ENGINE = defined?(YAML::ENGINE) ? YAML::ENGINE.yamler : "syck"
+
+  OPTIONS = {
+    :enable_symbol_parsing => false,
+    :enable_arbitrary_object_deserialization => false,
+    :suppress_warnings => false
+  }
+
+  class UnsafeTagError < RuntimeError; end
+end
+
+module YAML
+  def self.load_with_options(yaml, *filename_and_options)
+    options   = filename_and_options.last || {}
+    safe_mode = safe_mode_from_options("load", options)
+    arguments = [yaml]
+    arguments << filename_and_options.first if SafeYAML::MULTI_ARGUMENT_YAML_LOAD
+    safe_mode ? safe_load(*arguments) : unsafe_load(*arguments)
+  end
+
+  def self.load_file_with_options(file, options={})
+    safe_mode = safe_mode_from_options("load_file", options)
+    safe_mode ? safe_load_file(file) : unsafe_load_file(file)
+  end
+
+  def self.read_for_safe_load(yaml)
+    # since we're going to do two passes, we need to read out the file here
+    # into a string
+    if yaml.respond_to?(:read)
+      yaml = yaml.read
+    end
+    yaml
+  end
+
+  if SafeYAML::YAML_ENGINE == "psych"
+    require "safe_yaml/psych_tag_verifier"
+    def self.safe_load(yaml, filename=nil)
+      yaml = read_for_safe_load(yaml)
+      verifier = SafeYAML::PsychTagVerifier.new(whitelist)
+      parser = Psych::Parser.new(verifier)
+      if SafeYAML::MULTI_ARGUMENT_YAML_LOAD
+        parser.parse(yaml, filename)
+      else
+        parser.parse(yaml)
+      end
+      return unsafe_load(yaml)
+    end
+
+    def self.safe_load_file(filename)
+      File.open(filename, 'r:bom|utf-8') { |f| self.safe_load f, filename }
+    end
+
+    def self.unsafe_load_file(filename)
+      if SafeYAML::MULTI_ARGUMENT_YAML_LOAD
+        # https://github.com/tenderlove/psych/blob/v1.3.2/lib/psych.rb#L296-298
+        File.open(filename, 'r:bom|utf-8') { |f| self.unsafe_load f, filename }
+      else
+        # https://github.com/tenderlove/psych/blob/v1.2.2/lib/psych.rb#L231-233
+        self.unsafe_load File.open(filename)
+      end
+    end
+
+  else
+    require "safe_yaml/syck_tag_verifier"
+    def self.safe_load(yaml)
+      yaml = read_for_safe_load(yaml)
+      tree = YAML.parse(yaml)
+      verifier = SafeYAML::SyckTagVerifier.new(whitelist)
+      verifier.verify(tree)
+      return unsafe_load(yaml)
+    end
+
+    def self.safe_load_file(filename)
+      File.open(filename) { |f| self.safe_load f }
+    end
+
+    def self.unsafe_load_file(filename)
+      # https://github.com/indeyets/syck/blob/master/ext/ruby/lib/yaml.rb#L133-135
+      File.open(filename) { |f| self.unsafe_load f }
+    end
+  end
+
+  class << self
+    alias_method :unsafe_load, :load
+    alias_method :load, :load_with_options
+    alias_method :load_file, :load_file_with_options
+
+    def enable_symbol_parsing?
+      SafeYAML::OPTIONS[:enable_symbol_parsing]
+    end
+
+    def enable_symbol_parsing!
+      SafeYAML::OPTIONS[:enable_symbol_parsing] = true
+    end
+
+    def disable_symbol_parsing!
+      SafeYAML::OPTIONS[:enable_symbol_parsing] = false
+    end
+
+    def enable_arbitrary_object_deserialization?
+      SafeYAML::OPTIONS[:enable_arbitrary_object_deserialization]
+    end
+
+    def enable_arbitrary_object_deserialization!
+      SafeYAML::OPTIONS[:enable_arbitrary_object_deserialization] = true
+    end
+
+    def disable_arbitrary_object_deserialization!
+      SafeYAML::OPTIONS[:enable_arbitrary_object_deserialization] = false
+    end
+
+    def whitelist
+      @whitelist ||= SafeYAML::Whitelist.new
+    end
+
+    SYMBOL_REGEX = /\A:\w+\Z/.freeze
+    def check_string_for_symbol!(string)
+      if !YAML.enable_symbol_parsing? && string.match(SYMBOL_REGEX)
+        raise SafeYAML::UnsafeTagError.new("Symbol parsing is disabled")
+      end
+    end
+
+    private
+    def safe_mode_from_options(method, options={})
+      safe_mode = options[:safe]
+
+      if safe_mode.nil?
+        mode = SafeYAML::OPTIONS[:enable_arbitrary_object_deserialization] ? "unsafe" : "safe"
+        Kernel.warn "Called '#{method}' without the :safe option -- defaulting to #{mode} mode." unless SafeYAML::OPTIONS[:suppress_warnings]
+        safe_mode = !SafeYAML::OPTIONS[:enable_arbitrary_object_deserialization]
+      end
+
+      safe_mode
+    end
+  end
+end

data/lib/safe_yaml/psych_tag_verifier.rb

@@ -0,0 +1,38 @@
+module SafeYAML
+  class PsychTagVerifier < Psych::Handler
+    attr_reader :tags
+
+    def initialize(whitelist)
+      @tags = Set.new
+      @verifier = SafeYAML::TagVerifier.new(whitelist)
+    end
+
+    def streaming?
+      false
+    end
+
+    def alias(anchor)
+    end
+
+    def scalar(value, anchor, tag, plain, quoted, style)
+      if !quoted && value.is_a?(String)
+        YAML.check_string_for_symbol!(value)
+      end
+      @verifier.verify_tag!(tag, value)
+    end
+
+    def start_mapping(anchor, tag, implicit, style)
+      @verifier.verify_tag!(tag, nil)
+    end
+
+    def end_mapping
+    end
+
+    def start_sequence(anchor, tag, implicit, style)
+      @verifier.verify_tag!(tag, nil)
+    end
+
+    def end_sequence
+    end
+  end
+end

data/lib/safe_yaml/syck_tag_verifier.rb

@@ -0,0 +1,27 @@
+module SafeYAML
+  class SyckTagVerifier
+    QUOTE_STYLES = [:quote1, :quote2]
+
+    attr_reader :tags
+
+    def initialize(whitelist)
+      @tags = Set.new
+      @verifier = SafeYAML::TagVerifier.new(whitelist)
+    end
+
+    def verify(node)
+      return unless node.respond_to?(:type_id)
+      if !QUOTE_STYLES.include?(node.instance_variable_get(:@style)) && node.value.is_a?(String)
+        YAML.check_string_for_symbol!(node.value)
+      end
+      @verifier.verify_tag!(node.type_id, node.value)
+
+      case node.value
+      when Hash
+        node.value.each { |k,v| verify(k); verify(v) }
+      when Array
+        node.value.each { |i| verify(i) }
+      end
+    end
+  end
+end

data/lib/safe_yaml/tag_verifier.rb

@@ -0,0 +1,23 @@
+require 'set'
+
+module SafeYAML
+  class TagVerifier
+    def initialize(whitelist)
+      @whitelist = whitelist
+      @seen = Set.new
+    end
+
+    def verify_tag!(tag, value)
+      return if !tag || @seen.include?(tag)
+
+      case @whitelist.check(tag, value)
+      when :cacheable
+        @seen << tag
+      when :allowed
+        # in the whitelist, but can't be cached (because it called a proc for yes/no)
+      else
+        raise SafeYAML::UnsafeTagError.new("YAML tag is not whitelisted: #{tag} #{value.inspect}")
+      end
+    end
+  end
+end