sup 0.13.2 → 0.13.2.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (8) hide show
  1. data/CONTRIBUTORS +4 -5
  2. data/History.txt +4 -0
  3. data/ReleaseNotes +23 -0
  4. data/lib/sup/message_chunks.rb +46 -12
  5. data/lib/sup/version.rb +1 -1
  6. metadata +27 -55
  7. data.tar.gz.sig +0 -0
  8. metadata.gz.sig +0 -3
data/CONTRIBUTORS CHANGED
@@ -11,7 +11,6 @@ Eric Sherman <hyperbolist at the gmail dot coms>
11
11
  Tero Tilus <tero at the tilus dot nets>
12
12
  Ben Walton <bwalton at the artsci.utoronto dot cas>
13
13
  Mike Stipicevic <stipim at the rpi dot edus>
14
- Whyme.Lyu <callme5long at the gmail dot coms>
15
14
  Marcus Williams <marcus-sup at the bar-coded dot nets>
16
15
  Lionel Ott <white.magic at the gmx dot des>
17
16
  Gaudenz Steinlin <gaudenz at the soziologie dot chs>
@@ -45,21 +44,21 @@ Andrew Pimlott <andrew at the pimlott dot nets>
45
44
  Jeff Balogh <its.jeff.balogh at the gmail dot coms>
46
45
  Matías Aguirre <matiasaguirre at the gmail dot coms>
47
46
  Kornilios Kourtis <kkourt at the cslab.ece.ntua dot grs>
48
- Kevin Riggle <kevinr at the free-dissociation dot coms>
49
47
  Giorgio Lando <patroclo7 at the gmail dot coms>
48
+ Kevin Riggle <kevinr at the free-dissociation dot coms>
50
49
  Benoît PIERRE <benoit.pierre at the gmail dot coms>
51
50
  Alvaro Herrera <alvherre at the alvh.no-ip dot orgs>
52
51
  Steven Lawrance <stl at the koffein dot nets>
53
52
  Jonah <Jonah at the GoodCoffee dot cas>
54
53
  ian <itaylor at the uark dot edus>
55
- MichaelRevell <mikearevell at the gmail dot coms>
56
54
  Adam Lloyd <adam at the alloy-d dot nets>
57
- Todd Eisenberger <teisenbe at the andrew.cmu dot edus>
58
55
  Gregor Hoffleit <gregor at the sam.mediasupervision dot des>
56
+ MichaelRevell <mikearevell at the gmail dot coms>
57
+ Todd Eisenberger <teisenbe at the andrew.cmu dot edus>
59
58
  Steven Walter <swalter at the monarch.(none)>
59
+ Jon M. Dugan <jdugan at the es dot nets>
60
60
  Jonathan Lassoff <jof at the thejof dot coms>
61
61
  Matthieu Rakotojaona <matthieu.rakotojaona at the gmail dot coms>
62
62
  Stefan Lundström <lundst at the snabb.(none)>
63
63
  Matthias Vallentin <vallentin at the icir dot orgs>
64
- Jon M. Dugan <jdugan at the es dot nets>
65
64
  Kirill Smelkov <kirr at the landau.phys.spbu dot rus>
data/History.txt CHANGED
@@ -1,3 +1,7 @@
1
+ == 0.13.2.1 / 2013-10-29
2
+
3
+ * SBU1: security release
4
+
1
5
  == 0.13.2 / 2013-06-26
2
6
 
3
7
  * FreeBSD 10 comptability
data/ReleaseNotes CHANGED
@@ -1,3 +1,26 @@
1
+ Release 0.13.2.1:
2
+
3
+ Security advisory (#SBU1) for Sup
4
+
5
+ We have been notified of an potential exploit in the somewhat careless
6
+ way Sup treats attachment metadata in received e-mails. The issues
7
+ should now be fixed and I have released Sup 0.13.2.1 and 0.14.1.1 which
8
+ incorporates these fixes. Please upgrade immediately and also ensure
9
+ that your mime-decode or mime-view hooks are secure [0], [1].
10
+
11
+ This is specifically related to using quotes (',") around filename or
12
+ content_type which is already escaped using Ruby Shellwords.escape -
13
+ this means that the string (content_type, filename) is intended to be
14
+ used _without_ any further quotes. Please make sure that if you use
15
+ .mailcap (non OSX systems), you do not quote the string.
16
+
17
+ Credit goes to: joernchen of Phenoelit (http://phenoelit.de) who
18
+ discovered and suggested fixes for these issues.
19
+
20
+ [0] https://github.com/sup-heliotrope/sup/wiki/Viewing-Attachments
21
+ [1] https://github.com/sup-heliotrope/sup/wiki/Secure-usage-of-Sup
22
+
23
+
1
24
  Release 0.13.2:
2
25
 
3
26
  FreeBSD compatability and more thread safe polling.
data/lib/sup/message_chunks.rb CHANGED
@@ -1,5 +1,6 @@
1
1
  require 'tempfile'
2
2
  require 'rbconfig'
3
+ require 'shellwords'
3
4
 
4
5
  ## Here we define all the "chunks" that a message is parsed
5
6
  ## into. Chunks are used by ThreadViewMode to render a message. Chunks
@@ -59,6 +60,8 @@ end
59
60
  module Redwood
60
61
  module Chunk
61
62
  class Attachment
63
+ ## please see note in write_to_disk on important usage
64
+ ## of quotes to avoid remote command injection.
62
65
  HookManager.register "mime-decode", <<EOS
63
66
  Decodes a MIME attachment into text form. The text will be displayed
64
67
  directly in Sup. For attachments that you wish to use a separate program
@@ -75,6 +78,9 @@ Return value:
75
78
  The decoded text of the attachment, or nil if not decoded.
76
79
  EOS
77
80
 
81
+
82
+ ## please see note in write_to_disk on important usage
83
+ ## of quotes to avoid remote command injection.
78
84
  HookManager.register "mime-view", <<EOS
79
85
  Views a non-text MIME attachment. This hook allows you to run
80
86
  third-party programs for attachments that require such a thing (e.g.
@@ -100,8 +106,18 @@ EOS
100
106
  attr_reader :content_type, :filename, :lines, :raw_content
101
107
  bool_reader :quotable
102
108
 
109
+ ## store tempfile objects as class variables so that they
110
+ ## are not removed when the viewing process returns. they
111
+ ## should be garbage collected when the class variable is removed.
112
+ @@view_tempfiles = []
113
+
103
114
  def initialize content_type, filename, encoded_content, sibling_types
104
115
  @content_type = content_type.downcase
116
+ if Shellwords.escape(@content_type) != @content_type
117
+ warn "content_type #{@content_type} is not safe, changed to application/octet-stream"
118
+ @content_type = 'application/octet-stream'
119
+ end
120
+
105
121
  @filename = filename
106
122
  @quotable = false # changed to true if we can parse it through the
107
123
  # mime-decode hook, or if it's plain text
@@ -116,7 +132,9 @@ EOS
116
132
  when /^text\/plain\b/
117
133
  @raw_content
118
134
  else
119
- HookManager.run "mime-decode", :content_type => content_type,
135
+ ## please see note in write_to_disk on important usage
136
+ ## of quotes to avoid remote command injection.
137
+ HookManager.run "mime-decode", :content_type => @content_type,
120
138
  :filename => lambda { write_to_disk },
121
139
  :charset => encoded_content.charset,
122
140
  :sibling_types => sibling_types
@@ -147,11 +165,13 @@ EOS
147
165
  def initial_state; :open end
148
166
  def viewable?; @lines.nil? end
149
167
  def view_default! path
168
+ ## please see note in write_to_disk on important usage
169
+ ## of quotes to avoid remote command injection.
150
170
  case RbConfig::CONFIG['arch']
151
171
  when /darwin/
152
- cmd = "open '#{path}'"
172
+ cmd = "open #{path}"
153
173
  else
154
- cmd = "/usr/bin/run-mailcap --action=view '#{@content_type}:#{path}'"
174
+ cmd = "/usr/bin/run-mailcap --action=view #{@content_type}:#{path}"
155
175
  end
156
176
  debug "running: #{cmd.inspect}"
157
177
  BufferManager.shell_out(cmd)
@@ -159,17 +179,31 @@ EOS
159
179
  end
160
180
 
161
181
  def view!
162
- path = write_to_disk
163
- ret = HookManager.run "mime-view", :content_type => @content_type,
164
- :filename => path
165
- ret || view_default!(path)
182
+ ## please see note in write_to_disk on important usage
183
+ ## of quotes to avoid remote command injection.
184
+ write_to_disk do |file|
185
+
186
+ @@view_tempfiles.push file # make sure the tempfile is not garbage collected before sup stops
187
+
188
+ ret = HookManager.run "mime-view", :content_type => @content_type,
189
+ :filename => file.path
190
+ ret || view_default!(file.path)
191
+ end
166
192
  end
167
193
 
194
+ ## note that the path returned from write_to_disk is
195
+ ## Shellwords.escaped and is intended to be used without single
196
+ ## or double quotes. the use of either opens sup up for remote
197
+ ## code injection through the file name.
168
198
  def write_to_disk
169
- file = Tempfile.new(["sup", @filename.gsub("/", "_") || "sup-attachment"])
170
- file.print @raw_content
171
- file.close
172
- file.path
199
+ begin
200
+ file = Tempfile.new(["sup", Shellwords.escape(@filename.gsub("/", "_")) || "sup-attachment"])
201
+ file.print @raw_content
202
+ yield file if block_given?
203
+ return file.path
204
+ ensure
205
+ file.close
206
+ end
173
207
  end
174
208
 
175
209
  ## used when viewing the attachment as text
@@ -229,7 +263,7 @@ EOS
229
263
  class EnclosedMessage
230
264
  attr_reader :lines
231
265
  def initialize from, to, cc, date, subj
232
- @from = from ? "unknown sender" : from.full_adress
266
+ @from = from ? "unknown sender" : from.full_address
233
267
  @to = to ? "" : to.map { |p| p.full_address }.join(", ")
234
268
  @cc = cc ? "" : cc.map { |p| p.full_address }.join(", ")
235
269
  if date
data/lib/sup/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Redwood
2
- VERSION = "0.13.2"
2
+ VERSION = "0.13.2.1"
3
3
  end
metadata CHANGED
@@ -1,13 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: sup
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.13.2
4
+ version: 0.13.2.1
5
5
  prerelease:
6
6
  segments:
7
7
  - 0
8
8
  - 13
9
9
  - 2
10
- hash: 1496957733399950236
10
+ - 1
11
+ hash: 3165895177967591158
11
12
  platform: ruby
12
13
  authors:
13
14
  - William Morgan
@@ -16,37 +17,8 @@ authors:
16
17
  - Matthieu Rakotojaona
17
18
  autorequire:
18
19
  bindir: bin
19
- cert_chain:
20
- - !binary |-
21
- LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWRENDQWp5Z0F3SUJB
22
- Z0lCQURBTkJna3Foa2lHOXcwQkFRVUZBREJRTVFzd0NRWURWUVFEREFKbFp6
23
- RVYKTUJNR0NnbVNKb21UOGl4a0FSa1dCV2RoZFhSbE1SVXdFd1lLQ1pJbWla
24
- UHlMR1FCR1JZRmRtVjBjMm94RXpBUgpCZ29Ka2lhSmsvSXNaQUVaRmdOamIy
25
- MHdIaGNOTVRNd05UQTRNVEF6T0RRM1doY05NVFF3TlRBNE1UQXpPRFEzCldq
26
- QlFNUXN3Q1FZRFZRUUREQUpsWnpFVk1CTUdDZ21TSm9tVDhpeGtBUmtXQldk
27
- aGRYUmxNUlV3RXdZS0NaSW0KaVpQeUxHUUJHUllGZG1WMGMyb3hFekFSQmdv
28
- SmtpYUprL0lzWkFFWkZnTmpiMjB3Z2dFaU1BMEdDU3FHU0liMwpEUUVCQVFV
29
- QUE0SUJEd0F3Z2dFS0FvSUJBUUM3c05jNXpZNE1yWUI3ZXl3RS9hSzJJb0Rx
30
- cE05bHE0WkZsSHp0ClBtcTFMRzZhaDJsdS9IZmpxeGlQb3F3WTdRa2RTT0dE
31
- TFNrN0c4WUJxREEvdE9EaGtQUFNUcXhCRHpZeUNPNDYKaGFXVHRvTjV0Smt4
32
- SURKS3AxblZYSGkwTWxiNEdKVktkOVAwcTk1QmVCWUJmczh2eVBOK3k0YjRH
33
- ZWJneDlVMwpLcU1EYmU1aDlNQVBaR210aVJGTWIzdWdtaXVqRG03djhmQUNh
34
- NUV0U3ZLL2x4TWtSRGdsZWNUL2tuRTk5TllJCmwzNVNPL0J1bmUxYnhZbWt3
35
- VzY0bVE0d1JsR1ZlQW5YKzE5bXNBTGZTOXJkSkwyNmRmVzJMZ3FXaTVRb1ZU
36
- QkgKS05LVGwvaTNmeEswbXpndG5vUkNXZE1KUUZOTm9uRlRuUFVVYXdpMWM5
37
- S2g0QWRQQWdNQkFBR2pPVEEzTUFrRwpBMVVkRXdRQ01BQXdIUVlEVlIwT0JC
38
- WUVGSk5DT3hMMFNXY2JXMk0rRElFVXpBTXoxYlpzTUFzR0ExVWREd1FFCkF3
39
- SUVzREFOQmdrcWhraUc5dzBCQVFVRkFBT0NBUUVBcjNRVWF5ZDBnZUJERXhP
40
- K1d3emFFUEF1VVozeldRWUcKRzl2cnBsQ2ttSnRqUy9YL3dWQWVmN0puL1Y1
41
- TU5rWEtYc2lPZ1hKWGtpK243SHVsTlpVZjFyenI3VW45NmdWSgoxaHEvWlR1
42
- YXBuUHBzdEJxcWR2NjBSQjhITkd5ZEhRZUV6NnVzNXozbmorS2NoUHFKNjU3
43
- RHo4b1gvTm02LzI0CjdRU1FwQ2g4eEJZZFNXRXBvSUUwelVTWTc3THRWVFJW
44
- d0lyOXVEcFdUVHI5a0NWQklOQnNPUU5qV0tydUVXalYKK0pNdURzK2lXZWZw
45
- RjRSM0J5U29PYzFRNFdvRVMzK29jMHFvMzdNc0FaeWZuUUlQVFpreUxaQ014
46
- ZUw2TWhhNApoRmMyeUFOQmo4dm9hWTVDNzRDZzJWcUV4dGNuU2F4VXRXOXdD
47
- NHc1aE9sZzBBVmZiMUpXemc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
48
- Cg==
49
- date: 2013-06-26 00:00:00.000000000 Z
20
+ cert_chain: []
21
+ date: 2013-10-29 00:00:00.000000000 Z
50
22
  dependencies:
51
23
  - !ruby/object:Gem::Dependency
52
24
  name: xapian-full-alaveteli
@@ -60,7 +32,7 @@ dependencies:
60
32
  segments:
61
33
  - 1
62
34
  - 2
63
- hash: -3733181840957152875
35
+ hash: 868825659676859863
64
36
  type: :runtime
65
37
  prerelease: false
66
38
  version_requirements: !ruby/object:Gem::Requirement
@@ -73,7 +45,7 @@ dependencies:
73
45
  segments:
74
46
  - 1
75
47
  - 2
76
- hash: -3733181840957152875
48
+ hash: 868825659676859863
77
49
  - !ruby/object:Gem::Dependency
78
50
  name: ncursesw-sup
79
51
  requirement: !ruby/object:Gem::Requirement
@@ -86,7 +58,7 @@ dependencies:
86
58
  segments:
87
59
  - 1
88
60
  - 3
89
- hash: -876597745176914036
61
+ hash: 507327302350482719
90
62
  - - ! '>='
91
63
  - !ruby/object:Gem::Version
92
64
  version: 1.3.1
@@ -95,7 +67,7 @@ dependencies:
95
67
  - 1
96
68
  - 3
97
69
  - 1
98
- hash: -640291375575489877
70
+ hash: 3105951872946229212
99
71
  type: :runtime
100
72
  prerelease: false
101
73
  version_requirements: !ruby/object:Gem::Requirement
@@ -108,7 +80,7 @@ dependencies:
108
80
  segments:
109
81
  - 1
110
82
  - 3
111
- hash: -876597745176914036
83
+ hash: 507327302350482719
112
84
  - - ! '>='
113
85
  - !ruby/object:Gem::Version
114
86
  version: 1.3.1
@@ -117,7 +89,7 @@ dependencies:
117
89
  - 1
118
90
  - 3
119
91
  - 1
120
- hash: -640291375575489877
92
+ hash: 3105951872946229212
121
93
  - !ruby/object:Gem::Dependency
122
94
  name: rmail
123
95
  requirement: !ruby/object:Gem::Requirement
@@ -130,7 +102,7 @@ dependencies:
130
102
  segments:
131
103
  - 0
132
104
  - 17
133
- hash: -2258731216383999369
105
+ hash: 3437085760670918924
134
106
  type: :runtime
135
107
  prerelease: false
136
108
  version_requirements: !ruby/object:Gem::Requirement
@@ -143,7 +115,7 @@ dependencies:
143
115
  segments:
144
116
  - 0
145
117
  - 17
146
- hash: -2258731216383999369
118
+ hash: 3437085760670918924
147
119
  - !ruby/object:Gem::Dependency
148
120
  name: highline
149
121
  requirement: !ruby/object:Gem::Requirement
@@ -155,7 +127,7 @@ dependencies:
155
127
  prerelease:
156
128
  segments:
157
129
  - 0
158
- hash: -3965538710650358713
130
+ hash: 780439954604562836
159
131
  type: :runtime
160
132
  prerelease: false
161
133
  version_requirements: !ruby/object:Gem::Requirement
@@ -167,7 +139,7 @@ dependencies:
167
139
  prerelease:
168
140
  segments:
169
141
  - 0
170
- hash: -3965538710650358713
142
+ hash: 780439954604562836
171
143
  - !ruby/object:Gem::Dependency
172
144
  name: trollop
173
145
  requirement: !ruby/object:Gem::Requirement
@@ -180,7 +152,7 @@ dependencies:
180
152
  segments:
181
153
  - 1
182
154
  - 12
183
- hash: -2988883823466951243
155
+ hash: -1471803907522368170
184
156
  type: :runtime
185
157
  prerelease: false
186
158
  version_requirements: !ruby/object:Gem::Requirement
@@ -193,7 +165,7 @@ dependencies:
193
165
  segments:
194
166
  - 1
195
167
  - 12
196
- hash: -2988883823466951243
168
+ hash: -1471803907522368170
197
169
  - !ruby/object:Gem::Dependency
198
170
  name: lockfile
199
171
  requirement: !ruby/object:Gem::Requirement
@@ -205,7 +177,7 @@ dependencies:
205
177
  prerelease:
206
178
  segments:
207
179
  - 0
208
- hash: -3965538710650358713
180
+ hash: 780439954604562836
209
181
  type: :runtime
210
182
  prerelease: false
211
183
  version_requirements: !ruby/object:Gem::Requirement
@@ -217,7 +189,7 @@ dependencies:
217
189
  prerelease:
218
190
  segments:
219
191
  - 0
220
- hash: -3965538710650358713
192
+ hash: 780439954604562836
221
193
  - !ruby/object:Gem::Dependency
222
194
  name: mime-types
223
195
  requirement: !ruby/object:Gem::Requirement
@@ -229,7 +201,7 @@ dependencies:
229
201
  prerelease:
230
202
  segments:
231
203
  - 1
232
- hash: -1212563861242074830
204
+ hash: -2685865212927832791
233
205
  type: :runtime
234
206
  prerelease: false
235
207
  version_requirements: !ruby/object:Gem::Requirement
@@ -241,7 +213,7 @@ dependencies:
241
213
  prerelease:
242
214
  segments:
243
215
  - 1
244
- hash: -1212563861242074830
216
+ hash: -2685865212927832791
245
217
  - !ruby/object:Gem::Dependency
246
218
  name: locale
247
219
  requirement: !ruby/object:Gem::Requirement
@@ -254,7 +226,7 @@ dependencies:
254
226
  segments:
255
227
  - 2
256
228
  - 0
257
- hash: 1592099054184333623
229
+ hash: -535226096568000350
258
230
  type: :runtime
259
231
  prerelease: false
260
232
  version_requirements: !ruby/object:Gem::Requirement
@@ -267,7 +239,7 @@ dependencies:
267
239
  segments:
268
240
  - 2
269
241
  - 0
270
- hash: 1592099054184333623
242
+ hash: -535226096568000350
271
243
  - !ruby/object:Gem::Dependency
272
244
  name: chronic
273
245
  requirement: !ruby/object:Gem::Requirement
@@ -280,7 +252,7 @@ dependencies:
280
252
  segments:
281
253
  - 0
282
254
  - 9
283
- hash: 2378526325938346664
255
+ hash: 2184205100294773721
284
256
  - - ! '>='
285
257
  - !ruby/object:Gem::Version
286
258
  version: 0.9.1
@@ -289,7 +261,7 @@ dependencies:
289
261
  - 0
290
262
  - 9
291
263
  - 1
292
- hash: 4569877028918522321
264
+ hash: -1556404584947433146
293
265
  type: :runtime
294
266
  prerelease: false
295
267
  version_requirements: !ruby/object:Gem::Requirement
@@ -302,7 +274,7 @@ dependencies:
302
274
  segments:
303
275
  - 0
304
276
  - 9
305
- hash: 2378526325938346664
277
+ hash: 2184205100294773721
306
278
  - - ! '>='
307
279
  - !ruby/object:Gem::Version
308
280
  version: 0.9.1
@@ -311,7 +283,7 @@ dependencies:
311
283
  - 0
312
284
  - 9
313
285
  - 1
314
- hash: 4569877028918522321
286
+ hash: -1556404584947433146
315
287
  - !ruby/object:Gem::Dependency
316
288
  name: bundler
317
289
  requirement: !ruby/object:Gem::Requirement
data.tar.gz.sig DELETED
Binary file
metadata.gz.sig DELETED
@@ -1,3 +0,0 @@
1
- /�F�;V��*->Ɂ����g'��Z����s2��Y*3A��\_`�m��өL%�A�􄅫��uA;1G�l��>aH�C��$?S8��K^� ���8 �h�&��UQ��*��X��j���nz����0���a��'�w0ք�L�Ք����qA@|#PKL���
2
- M}"�o��W�-l+1�񣞭ʐ��-~ZB�,����)��p-�
3
- �L���%s�����|�����Б����B9�T�������'�