sfpagent 0.4.14 → 0.4.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 92378212d9d54d84e43fb733aae5cc827dde5a70
-  data.tar.gz: 2dcb686aeef8f2560972305f3117f2af9a7db486
+  metadata.gz: fe5120a666d50dfc4b5e1e27aa69c844a869d6b1
+  data.tar.gz: 931daacdf7163d66f11a790f2b980785263a7a2f
 SHA512:
-  metadata.gz: 6581a22dea149f20bc3cd273559a43f0177321843cfc97ebaef3818ef142f11dc649ef7a8329316413a98c7d159bce7319ab5114097d2fe98f04f3fe77e61637
-  data.tar.gz: c885f49400902ca291253f1a10e0b1d7773a965195b67ed39387658aa683f2a22260ff48be93b2f5183559e5acf38899ed99afd19cca29d31c64422ac7bdbef1
+  metadata.gz: b1093d7a3097c88a038ad3dad0f11301e5080dd495246199bdd479a4f0c044fabf80db13de8ab244822e65dcc74930978cd2a072f093789f6b3daabbace5ff1d
+  data.tar.gz: 23b3509b55f952fbcc08db3cd7ee33fa5d3783ccf7ac08483553e0b3af948345ee443aff4e62f195d64ac32b8e6d200bbaec6b4befe733cbbfdcd6227ae9d4eb

data/VERSION

@@ -1 +1 @@
-0.4.14
+0.4.15

data/lib/sfpagent/agent.rb

@@ -8,6 +8,7 @@ require 'net/http'
 require 'logger'
 require 'json'
 require 'digest/md5'
+require 'shellwords'
 
 module Sfp
 	module Agent
@@ -513,8 +514,8 @@ module Sfp
 
 		def self.uninstall_module(name)
 			return false if @@config[:modules_dir] == ''
-			
-			module_dir = "#{@@config[:modules_dir]}/#{name}"
+			module_dir = Shellwords.escape(File.expand_path("#{@@config[:modules_dir]}/#{name}"))
+			return false if not subpath(module_dir, @@config[:modules_dir])
 			if File.directory?(module_dir)
 				result = !!system("rm -rf #{module_dir}")
 			else
@@ -542,8 +543,9 @@ module Sfp
 			end
 
 			# delete old files
-			module_dir = "#{@@config[:modules_dir]}/#{name}"
-			system("rm -rf #{module_dir}") if File.exist? module_dir
+			module_dir = Shellwords.escape("#{@@config[:modules_dir]}/#{name}")
+			return false if not subpath(module_dir, @@config[:modules_dir])
+			system("rm -rf #{module_dir}") if File.exist?(module_dir)
 
 			# save the archive
 			Dir.mkdir("#{module_dir}", 0700)
@@ -553,10 +555,14 @@ module Sfp
 			system("cd #{module_dir}; tar xvf data.tgz")
 			Dir.entries(module_dir).each { |name|
 				next if name == '.' or name == '..'
-				if File.directory? "#{module_dir}/#{name}"
-					system("cd #{module_dir}/#{name}; mv * ..; mv .* .. 2>/dev/null; cd ..; rm -rf #{name}")
+				name = Shellwords.escape(name)
+				target = "#{module_dir}/#{name}"
+				return false if not subpath(target, @@config[:modules_dir])
+				if File.directory? target
+					system("cd #{target} && mv * .. && mv .* .. 2>/dev/null ; cd .. && rm -rf #{name}")
 				end
-				system("cd #{module_dir}; rm data.tgz")
+				datafile = "#{module_dir}/data.tgz"
+				File.delete(datafile) if File.exist?(datafile)
 			}
 
 			load_modules(@@config) if reload
@@ -661,7 +667,7 @@ module Sfp
 						f.truncate(f.pos)
 					end
 				rescue Exception => e
-					Sfp::Agent.logger.error e.to_s
+					Sfp::Agent.warn 'cannot update /etc/hosts'
 				end
 			end
 
@@ -677,6 +683,15 @@ module Sfp
 			@@agents_database = JSON[File.read(AgentsDataFile)]
 		end
 
+		# return true if path1 is subpath of path2, otherwise false
+		def self.subpath(path1, path2)
+			path1 = File.expand_path(path1)
+			path2 = File.expand_path(path2)
+			(path1[0,path2.length] == path2)
+		end
+
+
+
 		class Maintenance
 			IntervalTime = 600 # 10 minutes
 

data/lib/sfpagent/sfplanner.rb

@@ -1,5 +1,7 @@
 #!/usr/bin/env ruby
 
+require 'shellwords'
+
 class Planner
 	def initialize(p={})
 		# TODO
@@ -63,7 +65,7 @@ class Planner
 				f.write(dot)
 				f.flush
 			}
-			!!system("dot -Tpng -o #{image_file} #{dot_file}")
+			!!system("dot -Tpng -o #{Shellwords.escape(image_file)} #{Shellwords.escape(dot_file)}")
 		ensure
 			File.delete(dot_file) if File.exist?(dot_file)
 		end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sfpagent
 version: !ruby/object:Gem::Version
-  version: 0.4.14
+  version: 0.4.15
 platform: ruby
 authors:
 - Herry
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-01-29 00:00:00.000000000 Z
+date: 2014-04-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sfp
@@ -101,7 +101,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: sfpagent
-rubygems_version: 2.0.14
+rubygems_version: 2.1.10
 signing_key: 
 specification_version: 4
 summary: SFP Agent