sup 0.13.2 → 0.13.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. data/CONTRIBUTORS +4 -5
  2. data/History.txt +4 -0
  3. data/ReleaseNotes +23 -0
  4. data/lib/sup/message_chunks.rb +46 -12
  5. data/lib/sup/version.rb +1 -1
  6. metadata +27 -55
  7. data.tar.gz.sig +0 -0
  8. metadata.gz.sig +0 -3
data/CONTRIBUTORS CHANGED
@@ -11,7 +11,6 @@ Eric Sherman <hyperbolist at the gmail dot coms>
11
11
  Tero Tilus <tero at the tilus dot nets>
12
12
  Ben Walton <bwalton at the artsci.utoronto dot cas>
13
13
  Mike Stipicevic <stipim at the rpi dot edus>
14
- Whyme.Lyu <callme5long at the gmail dot coms>
15
14
  Marcus Williams <marcus-sup at the bar-coded dot nets>
16
15
  Lionel Ott <white.magic at the gmx dot des>
17
16
  Gaudenz Steinlin <gaudenz at the soziologie dot chs>
@@ -45,21 +44,21 @@ Andrew Pimlott <andrew at the pimlott dot nets>
45
44
  Jeff Balogh <its.jeff.balogh at the gmail dot coms>
46
45
  Matías Aguirre <matiasaguirre at the gmail dot coms>
47
46
  Kornilios Kourtis <kkourt at the cslab.ece.ntua dot grs>
48
- Kevin Riggle <kevinr at the free-dissociation dot coms>
49
47
  Giorgio Lando <patroclo7 at the gmail dot coms>
48
+ Kevin Riggle <kevinr at the free-dissociation dot coms>
50
49
  Benoît PIERRE <benoit.pierre at the gmail dot coms>
51
50
  Alvaro Herrera <alvherre at the alvh.no-ip dot orgs>
52
51
  Steven Lawrance <stl at the koffein dot nets>
53
52
  Jonah <Jonah at the GoodCoffee dot cas>
54
53
  ian <itaylor at the uark dot edus>
55
- MichaelRevell <mikearevell at the gmail dot coms>
56
54
  Adam Lloyd <adam at the alloy-d dot nets>
57
- Todd Eisenberger <teisenbe at the andrew.cmu dot edus>
58
55
  Gregor Hoffleit <gregor at the sam.mediasupervision dot des>
56
+ MichaelRevell <mikearevell at the gmail dot coms>
57
+ Todd Eisenberger <teisenbe at the andrew.cmu dot edus>
59
58
  Steven Walter <swalter at the monarch.(none)>
59
+ Jon M. Dugan <jdugan at the es dot nets>
60
60
  Jonathan Lassoff <jof at the thejof dot coms>
61
61
  Matthieu Rakotojaona <matthieu.rakotojaona at the gmail dot coms>
62
62
  Stefan Lundström <lundst at the snabb.(none)>
63
63
  Matthias Vallentin <vallentin at the icir dot orgs>
64
- Jon M. Dugan <jdugan at the es dot nets>
65
64
  Kirill Smelkov <kirr at the landau.phys.spbu dot rus>
data/History.txt CHANGED
@@ -1,3 +1,7 @@
1
+ == 0.13.2.1 / 2013-10-29
2
+
3
+ * SBU1: security release
4
+
1
5
  == 0.13.2 / 2013-06-26
2
6
 
3
7
  * FreeBSD 10 comptability
data/ReleaseNotes CHANGED
@@ -1,3 +1,26 @@
1
+ Release 0.13.2.1:
2
+
3
+ Security advisory (#SBU1) for Sup
4
+
5
+ We have been notified of an potential exploit in the somewhat careless
6
+ way Sup treats attachment metadata in received e-mails. The issues
7
+ should now be fixed and I have released Sup 0.13.2.1 and 0.14.1.1 which
8
+ incorporates these fixes. Please upgrade immediately and also ensure
9
+ that your mime-decode or mime-view hooks are secure [0], [1].
10
+
11
+ This is specifically related to using quotes (',") around filename or
12
+ content_type which is already escaped using Ruby Shellwords.escape -
13
+ this means that the string (content_type, filename) is intended to be
14
+ used _without_ any further quotes. Please make sure that if you use
15
+ .mailcap (non OSX systems), you do not quote the string.
16
+
17
+ Credit goes to: joernchen of Phenoelit (http://phenoelit.de) who
18
+ discovered and suggested fixes for these issues.
19
+
20
+ [0] https://github.com/sup-heliotrope/sup/wiki/Viewing-Attachments
21
+ [1] https://github.com/sup-heliotrope/sup/wiki/Secure-usage-of-Sup
22
+
23
+
1
24
  Release 0.13.2:
2
25
 
3
26
  FreeBSD compatability and more thread safe polling.
data/lib/sup/message_chunks.rb CHANGED
@@ -1,5 +1,6 @@
1
1
  require 'tempfile'
2
2
  require 'rbconfig'
3
+ require 'shellwords'
3
4
 
4
5
  ## Here we define all the "chunks" that a message is parsed
5
6
  ## into. Chunks are used by ThreadViewMode to render a message. Chunks
@@ -59,6 +60,8 @@ end
59
60
  module Redwood
60
61
  module Chunk
61
62
  class Attachment
63
+ ## please see note in write_to_disk on important usage
64
+ ## of quotes to avoid remote command injection.
62
65
  HookManager.register "mime-decode", <<EOS
63
66
  Decodes a MIME attachment into text form. The text will be displayed
64
67
  directly in Sup. For attachments that you wish to use a separate program
@@ -75,6 +78,9 @@ Return value:
75
78
  The decoded text of the attachment, or nil if not decoded.
76
79
  EOS
77
80
 
81
+
82
+ ## please see note in write_to_disk on important usage
83
+ ## of quotes to avoid remote command injection.
78
84
  HookManager.register "mime-view", <<EOS
79
85
  Views a non-text MIME attachment. This hook allows you to run
80
86
  third-party programs for attachments that require such a thing (e.g.
@@ -100,8 +106,18 @@ EOS
100
106
  attr_reader :content_type, :filename, :lines, :raw_content
101
107
  bool_reader :quotable
102
108
 
109
+ ## store tempfile objects as class variables so that they
110
+ ## are not removed when the viewing process returns. they
111
+ ## should be garbage collected when the class variable is removed.
112
+ @@view_tempfiles = []
113
+
103
114
  def initialize content_type, filename, encoded_content, sibling_types
104
115
  @content_type = content_type.downcase
116
+ if Shellwords.escape(@content_type) != @content_type
117
+ warn "content_type #{@content_type} is not safe, changed to application/octet-stream"
118
+ @content_type = 'application/octet-stream'
119
+ end
120
+
105
121
  @filename = filename
106
122
  @quotable = false # changed to true if we can parse it through the
107
123
  # mime-decode hook, or if it's plain text
@@ -116,7 +132,9 @@ EOS
116
132
  when /^text\/plain\b/
117
133
  @raw_content
118
134
  else
119
- HookManager.run "mime-decode", :content_type => content_type,
135
+ ## please see note in write_to_disk on important usage
136
+ ## of quotes to avoid remote command injection.
137
+ HookManager.run "mime-decode", :content_type => @content_type,
120
138
  :filename => lambda { write_to_disk },
121
139
  :charset => encoded_content.charset,
122
140
  :sibling_types => sibling_types
@@ -147,11 +165,13 @@ EOS
147
165
  def initial_state; :open end
148
166
  def viewable?; @lines.nil? end
149
167
  def view_default! path
168
+ ## please see note in write_to_disk on important usage
169
+ ## of quotes to avoid remote command injection.
150
170
  case RbConfig::CONFIG['arch']
151
171
  when /darwin/
152
- cmd = "open '#{path}'"
172
+ cmd = "open #{path}"
153
173
  else
154
- cmd = "/usr/bin/run-mailcap --action=view '#{@content_type}:#{path}'"
174
+ cmd = "/usr/bin/run-mailcap --action=view #{@content_type}:#{path}"
155
175
  end
156
176
  debug "running: #{cmd.inspect}"
157
177
  BufferManager.shell_out(cmd)
@@ -159,17 +179,31 @@ EOS
159
179
  end
160
180
 
161
181
  def view!
162
- path = write_to_disk
163
- ret = HookManager.run "mime-view", :content_type => @content_type,
164
- :filename => path
165
- ret || view_default!(path)
182
+ ## please see note in write_to_disk on important usage
183
+ ## of quotes to avoid remote command injection.
184
+ write_to_disk do |file|
185
+
186
+ @@view_tempfiles.push file # make sure the tempfile is not garbage collected before sup stops
187
+
188
+ ret = HookManager.run "mime-view", :content_type => @content_type,
189
+ :filename => file.path
190
+ ret || view_default!(file.path)
191
+ end
166
192
  end
167
193
 
194
+ ## note that the path returned from write_to_disk is
195
+ ## Shellwords.escaped and is intended to be used without single
196
+ ## or double quotes. the use of either opens sup up for remote
197
+ ## code injection through the file name.
168
198
  def write_to_disk
169
- file = Tempfile.new(["sup", @filename.gsub("/", "_") || "sup-attachment"])
170
- file.print @raw_content
171
- file.close
172
- file.path
199
+ begin
200
+ file = Tempfile.new(["sup", Shellwords.escape(@filename.gsub("/", "_")) || "sup-attachment"])
201
+ file.print @raw_content
202
+ yield file if block_given?
203
+ return file.path
204
+ ensure
205
+ file.close
206
+ end
173
207
  end
174
208
 
175
209
  ## used when viewing the attachment as text
@@ -229,7 +263,7 @@ EOS
229
263
  class EnclosedMessage
230
264
  attr_reader :lines
231
265
  def initialize from, to, cc, date, subj
232
- @from = from ? "unknown sender" : from.full_adress
266
+ @from = from ? "unknown sender" : from.full_address
233
267
  @to = to ? "" : to.map { |p| p.full_address }.join(", ")
234
268
  @cc = cc ? "" : cc.map { |p| p.full_address }.join(", ")
235
269
  if date
data/lib/sup/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Redwood
2
- VERSION = "0.13.2"
2
+ VERSION = "0.13.2.1"
3
3
  end
metadata CHANGED
@@ -1,13 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: sup
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.13.2
4
+ version: 0.13.2.1
5
5
  prerelease:
6
6
  segments:
7
7
  - 0
8
8
  - 13
9
9
  - 2
10
- hash: 1496957733399950236
10
+ - 1
11
+ hash: 3165895177967591158
11
12
  platform: ruby
12
13
  authors:
13
14
  - William Morgan
@@ -16,37 +17,8 @@ authors:
16
17
  - Matthieu Rakotojaona
17
18
  autorequire:
18
19
  bindir: bin
19
- cert_chain:
20
- - !binary |-
21
- LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURWRENDQWp5Z0F3SUJB
22
- Z0lCQURBTkJna3Foa2lHOXcwQkFRVUZBREJRTVFzd0NRWURWUVFEREFKbFp6
23
- RVYKTUJNR0NnbVNKb21UOGl4a0FSa1dCV2RoZFhSbE1SVXdFd1lLQ1pJbWla
24
- UHlMR1FCR1JZRmRtVjBjMm94RXpBUgpCZ29Ka2lhSmsvSXNaQUVaRmdOamIy
25
- MHdIaGNOTVRNd05UQTRNVEF6T0RRM1doY05NVFF3TlRBNE1UQXpPRFEzCldq
26
- QlFNUXN3Q1FZRFZRUUREQUpsWnpFVk1CTUdDZ21TSm9tVDhpeGtBUmtXQldk
27
- aGRYUmxNUlV3RXdZS0NaSW0KaVpQeUxHUUJHUllGZG1WMGMyb3hFekFSQmdv
28
- SmtpYUprL0lzWkFFWkZnTmpiMjB3Z2dFaU1BMEdDU3FHU0liMwpEUUVCQVFV
29
- QUE0SUJEd0F3Z2dFS0FvSUJBUUM3c05jNXpZNE1yWUI3ZXl3RS9hSzJJb0Rx
30
- cE05bHE0WkZsSHp0ClBtcTFMRzZhaDJsdS9IZmpxeGlQb3F3WTdRa2RTT0dE
31
- TFNrN0c4WUJxREEvdE9EaGtQUFNUcXhCRHpZeUNPNDYKaGFXVHRvTjV0Smt4
32
- SURKS3AxblZYSGkwTWxiNEdKVktkOVAwcTk1QmVCWUJmczh2eVBOK3k0YjRH
33
- ZWJneDlVMwpLcU1EYmU1aDlNQVBaR210aVJGTWIzdWdtaXVqRG03djhmQUNh
34
- NUV0U3ZLL2x4TWtSRGdsZWNUL2tuRTk5TllJCmwzNVNPL0J1bmUxYnhZbWt3
35
- VzY0bVE0d1JsR1ZlQW5YKzE5bXNBTGZTOXJkSkwyNmRmVzJMZ3FXaTVRb1ZU
36
- QkgKS05LVGwvaTNmeEswbXpndG5vUkNXZE1KUUZOTm9uRlRuUFVVYXdpMWM5
37
- S2g0QWRQQWdNQkFBR2pPVEEzTUFrRwpBMVVkRXdRQ01BQXdIUVlEVlIwT0JC
38
- WUVGSk5DT3hMMFNXY2JXMk0rRElFVXpBTXoxYlpzTUFzR0ExVWREd1FFCkF3
39
- SUVzREFOQmdrcWhraUc5dzBCQVFVRkFBT0NBUUVBcjNRVWF5ZDBnZUJERXhP
40
- K1d3emFFUEF1VVozeldRWUcKRzl2cnBsQ2ttSnRqUy9YL3dWQWVmN0puL1Y1
41
- TU5rWEtYc2lPZ1hKWGtpK243SHVsTlpVZjFyenI3VW45NmdWSgoxaHEvWlR1
42
- YXBuUHBzdEJxcWR2NjBSQjhITkd5ZEhRZUV6NnVzNXozbmorS2NoUHFKNjU3
43
- RHo4b1gvTm02LzI0CjdRU1FwQ2g4eEJZZFNXRXBvSUUwelVTWTc3THRWVFJW
44
- d0lyOXVEcFdUVHI5a0NWQklOQnNPUU5qV0tydUVXalYKK0pNdURzK2lXZWZw
45
- RjRSM0J5U29PYzFRNFdvRVMzK29jMHFvMzdNc0FaeWZuUUlQVFpreUxaQ014
46
- ZUw2TWhhNApoRmMyeUFOQmo4dm9hWTVDNzRDZzJWcUV4dGNuU2F4VXRXOXdD
47
- NHc1aE9sZzBBVmZiMUpXemc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
48
- Cg==
49
- date: 2013-06-26 00:00:00.000000000 Z
20
+ cert_chain: []
21
+ date: 2013-10-29 00:00:00.000000000 Z
50
22
  dependencies:
51
23
  - !ruby/object:Gem::Dependency
52
24
  name: xapian-full-alaveteli
@@ -60,7 +32,7 @@ dependencies:
60
32
  segments:
61
33
  - 1
62
34
  - 2
63
- hash: -3733181840957152875
35
+ hash: 868825659676859863
64
36
  type: :runtime
65
37
  prerelease: false
66
38
  version_requirements: !ruby/object:Gem::Requirement
@@ -73,7 +45,7 @@ dependencies:
73
45
  segments:
74
46
  - 1
75
47
  - 2
76
- hash: -3733181840957152875
48
+ hash: 868825659676859863
77
49
  - !ruby/object:Gem::Dependency
78
50
  name: ncursesw-sup
79
51
  requirement: !ruby/object:Gem::Requirement
@@ -86,7 +58,7 @@ dependencies:
86
58
  segments:
87
59
  - 1
88
60
  - 3
89
- hash: -876597745176914036
61
+ hash: 507327302350482719
90
62
  - - ! '>='
91
63
  - !ruby/object:Gem::Version
92
64
  version: 1.3.1
@@ -95,7 +67,7 @@ dependencies:
95
67
  - 1
96
68
  - 3
97
69
  - 1
98
- hash: -640291375575489877
70
+ hash: 3105951872946229212
99
71
  type: :runtime
100
72
  prerelease: false
101
73
  version_requirements: !ruby/object:Gem::Requirement
@@ -108,7 +80,7 @@ dependencies:
108
80
  segments:
109
81
  - 1
110
82
  - 3
111
- hash: -876597745176914036
83
+ hash: 507327302350482719
112
84
  - - ! '>='
113
85
  - !ruby/object:Gem::Version
114
86
  version: 1.3.1
@@ -117,7 +89,7 @@ dependencies:
117
89
  - 1
118
90
  - 3
119
91
  - 1
120
- hash: -640291375575489877
92
+ hash: 3105951872946229212
121
93
  - !ruby/object:Gem::Dependency
122
94
  name: rmail
123
95
  requirement: !ruby/object:Gem::Requirement
@@ -130,7 +102,7 @@ dependencies:
130
102
  segments:
131
103
  - 0
132
104
  - 17
133
- hash: -2258731216383999369
105
+ hash: 3437085760670918924
134
106
  type: :runtime
135
107
  prerelease: false
136
108
  version_requirements: !ruby/object:Gem::Requirement
@@ -143,7 +115,7 @@ dependencies:
143
115
  segments:
144
116
  - 0
145
117
  - 17
146
- hash: -2258731216383999369
118
+ hash: 3437085760670918924
147
119
  - !ruby/object:Gem::Dependency
148
120
  name: highline
149
121
  requirement: !ruby/object:Gem::Requirement
@@ -155,7 +127,7 @@ dependencies:
155
127
  prerelease:
156
128
  segments:
157
129
  - 0
158
- hash: -3965538710650358713
130
+ hash: 780439954604562836
159
131
  type: :runtime
160
132
  prerelease: false
161
133
  version_requirements: !ruby/object:Gem::Requirement
@@ -167,7 +139,7 @@ dependencies:
167
139
  prerelease:
168
140
  segments:
169
141
  - 0
170
- hash: -3965538710650358713
142
+ hash: 780439954604562836
171
143
  - !ruby/object:Gem::Dependency
172
144
  name: trollop
173
145
  requirement: !ruby/object:Gem::Requirement
@@ -180,7 +152,7 @@ dependencies:
180
152
  segments:
181
153
  - 1
182
154
  - 12
183
- hash: -2988883823466951243
155
+ hash: -1471803907522368170
184
156
  type: :runtime
185
157
  prerelease: false
186
158
  version_requirements: !ruby/object:Gem::Requirement
@@ -193,7 +165,7 @@ dependencies:
193
165
  segments:
194
166
  - 1
195
167
  - 12
196
- hash: -2988883823466951243
168
+ hash: -1471803907522368170
197
169
  - !ruby/object:Gem::Dependency
198
170
  name: lockfile
199
171
  requirement: !ruby/object:Gem::Requirement
@@ -205,7 +177,7 @@ dependencies:
205
177
  prerelease:
206
178
  segments:
207
179
  - 0
208
- hash: -3965538710650358713
180
+ hash: 780439954604562836
209
181
  type: :runtime
210
182
  prerelease: false
211
183
  version_requirements: !ruby/object:Gem::Requirement
@@ -217,7 +189,7 @@ dependencies:
217
189
  prerelease:
218
190
  segments:
219
191
  - 0
220
- hash: -3965538710650358713
192
+ hash: 780439954604562836
221
193
  - !ruby/object:Gem::Dependency
222
194
  name: mime-types
223
195
  requirement: !ruby/object:Gem::Requirement
@@ -229,7 +201,7 @@ dependencies:
229
201
  prerelease:
230
202
  segments:
231
203
  - 1
232
- hash: -1212563861242074830
204
+ hash: -2685865212927832791
233
205
  type: :runtime
234
206
  prerelease: false
235
207
  version_requirements: !ruby/object:Gem::Requirement
@@ -241,7 +213,7 @@ dependencies:
241
213
  prerelease:
242
214
  segments:
243
215
  - 1
244
- hash: -1212563861242074830
216
+ hash: -2685865212927832791
245
217
  - !ruby/object:Gem::Dependency
246
218
  name: locale
247
219
  requirement: !ruby/object:Gem::Requirement
@@ -254,7 +226,7 @@ dependencies:
254
226
  segments:
255
227
  - 2
256
228
  - 0
257
- hash: 1592099054184333623
229
+ hash: -535226096568000350
258
230
  type: :runtime
259
231
  prerelease: false
260
232
  version_requirements: !ruby/object:Gem::Requirement
@@ -267,7 +239,7 @@ dependencies:
267
239
  segments:
268
240
  - 2
269
241
  - 0
270
- hash: 1592099054184333623
242
+ hash: -535226096568000350
271
243
  - !ruby/object:Gem::Dependency
272
244
  name: chronic
273
245
  requirement: !ruby/object:Gem::Requirement
@@ -280,7 +252,7 @@ dependencies:
280
252
  segments:
281
253
  - 0
282
254
  - 9
283
- hash: 2378526325938346664
255
+ hash: 2184205100294773721
284
256
  - - ! '>='
285
257
  - !ruby/object:Gem::Version
286
258
  version: 0.9.1
@@ -289,7 +261,7 @@ dependencies:
289
261
  - 0
290
262
  - 9
291
263
  - 1
292
- hash: 4569877028918522321
264
+ hash: -1556404584947433146
293
265
  type: :runtime
294
266
  prerelease: false
295
267
  version_requirements: !ruby/object:Gem::Requirement
@@ -302,7 +274,7 @@ dependencies:
302
274
  segments:
303
275
  - 0
304
276
  - 9
305
- hash: 2378526325938346664
277
+ hash: 2184205100294773721
306
278
  - - ! '>='
307
279
  - !ruby/object:Gem::Version
308
280
  version: 0.9.1
@@ -311,7 +283,7 @@ dependencies:
311
283
  - 0
312
284
  - 9
313
285
  - 1
314
- hash: 4569877028918522321
286
+ hash: -1556404584947433146
315
287
  - !ruby/object:Gem::Dependency
316
288
  name: bundler
317
289
  requirement: !ruby/object:Gem::Requirement
data.tar.gz.sig DELETED
Binary file
metadata.gz.sig DELETED
@@ -1,3 +0,0 @@
1
- /�F�;V��*->Ɂ����g'��Z����s2��Y*3A��\_`�m��өL%�A�􄅫��uA;1G�l��>aH�C��$?S8��K^� ���8 �h�&��UQ��*��X��j���nz����0���a��'�w0ք�L�Ք����qA@|#PKL���
2
- M}"�o��W�-l+1�񣞭ʐ��-~ZB�,����)��p-�
3
- �L���%s�����|�����Б����B9�T�������'�