diff options
Diffstat (limited to 'meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch')
-rw-r--r-- | meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch | 97 |
1 files changed, 97 insertions, 0 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch new file mode 100644 index 0000000000..6f4b35a786 --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2024-27281.patch | |||
@@ -0,0 +1,97 @@ | |||
1 | From da7a0c7553ef7250ca665a3fecdc01dbaacbb43d Mon Sep 17 00:00:00 2001 | ||
2 | From: Nobuyoshi Nakada <nobu@ruby-lang.org> | ||
3 | Date: Mon, 15 Apr 2024 11:40:00 +0000 | ||
4 | Subject: [PATCH] Filter marshaled objets | ||
5 | |||
6 | CVE: CVE-2024-27281 | ||
7 | Upstream-Status: Backport [https://github.com/ruby/rdoc/commit/da7a0c7553ef7250ca665a3fecdc01dbaacbb43d] | ||
8 | |||
9 | Signed-off-by: Yogita Urade <yogita.urade@windriver.com> | ||
10 | --- | ||
11 | lib/rdoc/store.rb | 45 ++++++++++++++++++++++++++------------------- | ||
12 | 1 file changed, 26 insertions(+), 19 deletions(-) | ||
13 | |||
14 | diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb | ||
15 | index 5ba671c..c793e49 100644 | ||
16 | --- a/lib/rdoc/store.rb | ||
17 | +++ b/lib/rdoc/store.rb | ||
18 | @@ -556,9 +556,7 @@ class RDoc::Store | ||
19 | def load_cache | ||
20 | #orig_enc = @encoding | ||
21 | |||
22 | - File.open cache_path, 'rb' do |io| | ||
23 | - @cache = Marshal.load io.read | ||
24 | - end | ||
25 | + @cache = marshal_load(cache_path) | ||
26 | |||
27 | load_enc = @cache[:encoding] | ||
28 | |||
29 | @@ -615,9 +613,7 @@ class RDoc::Store | ||
30 | def load_class_data klass_name | ||
31 | file = class_file klass_name | ||
32 | |||
33 | - File.open file, 'rb' do |io| | ||
34 | - Marshal.load io.read | ||
35 | - end | ||
36 | + marshal_load(file) | ||
37 | rescue Errno::ENOENT => e | ||
38 | error = MissingFileError.new(self, file, klass_name) | ||
39 | error.set_backtrace e.backtrace | ||
40 | @@ -630,14 +626,10 @@ class RDoc::Store | ||
41 | def load_method klass_name, method_name | ||
42 | file = method_file klass_name, method_name | ||
43 | |||
44 | - File.open file, 'rb' do |io| | ||
45 | - obj = Marshal.load io.read | ||
46 | - obj.store = self | ||
47 | - obj.parent = | ||
48 | - find_class_or_module(klass_name) || load_class(klass_name) unless | ||
49 | - obj.parent | ||
50 | - obj | ||
51 | - end | ||
52 | + obj = marshal_load(file) | ||
53 | + obj.store = self | ||
54 | + obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name) | ||
55 | + obj | ||
56 | rescue Errno::ENOENT => e | ||
57 | error = MissingFileError.new(self, file, klass_name + method_name) | ||
58 | error.set_backtrace e.backtrace | ||
59 | @@ -650,11 +642,9 @@ class RDoc::Store | ||
60 | def load_page page_name | ||
61 | file = page_file page_name | ||
62 | |||
63 | - File.open file, 'rb' do |io| | ||
64 | - obj = Marshal.load io.read | ||
65 | - obj.store = self | ||
66 | - obj | ||
67 | - end | ||
68 | + obj = marshal_load(file) | ||
69 | + obj.store = self | ||
70 | + obj | ||
71 | rescue Errno::ENOENT => e | ||
72 | error = MissingFileError.new(self, file, page_name) | ||
73 | error.set_backtrace e.backtrace | ||
74 | @@ -976,4 +966,21 @@ class RDoc::Store | ||
75 | @unique_modules | ||
76 | end | ||
77 | |||
78 | + private | ||
79 | + def marshal_load(file) | ||
80 | + File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)} | ||
81 | + end | ||
82 | + | ||
83 | + MarshalFilter = proc do |obj| | ||
84 | + case obj | ||
85 | + when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text | ||
86 | + else | ||
87 | + unless obj.class.name.start_with?("RDoc::") | ||
88 | + raise TypeError, "not permitted class: #{obj.class.name}" | ||
89 | + end | ||
90 | + end | ||
91 | + obj | ||
92 | + end | ||
93 | + private_constant :MarshalFilter | ||
94 | + | ||
95 | end | ||
96 | -- | ||
97 | 2.35.5 | ||