diff options
| author | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2021-07-03 17:10:28 +0000 |
|---|---|---|
| committer | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2021-07-03 17:10:28 +0000 |
| commit | fe3c49c9baeeab58304ede915b7edd18ecf360fc (patch) | |
| tree | 62f2244ec899e4a839b7a0ddfd6d33edb9f5c79f | |
| parent | 83c255e89f376068f632fc1f17e67253184e4451 (diff) | |
merge revision(s) b1c73f23,c9ab8fe2: [Backport #17877]
[ruby/rdoc] Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799
https://github.com/ruby/rdoc/commit/a7f5d6ab88
The test for command injection on Unix platforms should be omitted on Windows
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67947 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
| -rw-r--r-- | lib/rdoc/rdoc.rb | 2 | ||||
| -rw-r--r-- | lib/rdoc/version.rb | 2 | ||||
| -rw-r--r-- | test/rdoc/test_rdoc_rdoc.rb | 12 |
3 files changed, 14 insertions, 2 deletions
diff --git a/lib/rdoc/rdoc.rb b/lib/rdoc/rdoc.rb index ca2c1abefd..46aace7839 100644 --- a/lib/rdoc/rdoc.rb +++ b/lib/rdoc/rdoc.rb @@ -430,7 +430,7 @@ The internal error was: files.reject do |file| file =~ /\.(?:class|eps|erb|scpt\.txt|svg|ttf|yml)$/i or (file =~ /tags$/i and - open(file, 'rb') { |io| + File.open(file, 'rb') { |io| io.read(100) =~ /\A(\f\n[^,]+,\d+$|!_TAG_)/ }) end diff --git a/lib/rdoc/version.rb b/lib/rdoc/version.rb index 3291414597..dc1ea6cbb1 100644 --- a/lib/rdoc/version.rb +++ b/lib/rdoc/version.rb @@ -3,6 +3,6 @@ module RDoc ## # RDoc version you are using - VERSION = '6.1.2' + VERSION = '6.1.2.1' end diff --git a/test/rdoc/test_rdoc_rdoc.rb b/test/rdoc/test_rdoc_rdoc.rb index 3bce54b243..123b1a4f87 100644 --- a/test/rdoc/test_rdoc_rdoc.rb +++ b/test/rdoc/test_rdoc_rdoc.rb @@ -420,6 +420,18 @@ class TestRDocRDoc < RDoc::TestCase end end + def test_remove_unparseable_CVE_2021_31799 + skip 'for Un*x platforms' if Gem.win_platform? + temp_dir do + file_list = ['| touch evil.txt && echo tags'] + file_list.each do |f| + FileUtils.touch f + end + assert_equal file_list, @rdoc.remove_unparseable(file_list) + assert_equal file_list, Dir.children('.') + end + end + def test_setup_output_dir Dir.mktmpdir {|d| path = File.join d, 'testdir' |