Source Mage code commit list

[Treeve Jelbert <scm AT sourcemage.org>]

GIT changes to master grimoire by Treeve Jelbert <treeve AT sourcemage.org>:

 kde5-utils/ark/DETAILS               |    2 -
 kde5-utils/ark/HISTORY               |    4 ++
 kde5-utils/ark/PRE_BUILD             |    1 
 kde5-utils/ark/patches/cve.patch     |   41 ---------------------------
 kde5-utils/ark/patches/symlink.patch |   53 
+++++++++++++++++++++++++++++++++++
 5 files changed, 59 insertions(+), 42 deletions(-)

New commits:
commit cd366ca2ac333a1720ab1d47a4884ca6bbc53ebb
Author: Treeve Jelbert <treeve AT sourcemage.org>
Commit: Treeve Jelbert <treeve AT sourcemage.org>

    ark - SECURITY FIX - CVE-2020-24654

diff --git a/kde5-utils/ark/DETAILS b/kde5-utils/ark/DETAILS
index 63b344a..ef54790 100644
--- a/kde5-utils/ark/DETAILS
+++ b/kde5-utils/ark/DETAILS
@@ -9,7 +9,7 @@
 SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
         WEB_SITE=https://www.kde.org/release-service/utilities/ark
          ENTERED=20110821
-  SECURITY_PATCH=1
+  SECURITY_PATCH=2
       LICENSE[0]=GPL
         KEYWORDS="kde5"
            SHORT="archive utility for KDE"
diff --git a/kde5-utils/ark/HISTORY b/kde5-utils/ark/HISTORY
index ea0945e3..8651ef5 100644
--- a/kde5-utils/ark/HISTORY
+++ b/kde5-utils/ark/HISTORY
@@ -1,3 +1,7 @@
+2020-08-28 Treeve Jelbert <treeve AT sourcemage.org>
+       * patches/symlink.patch: added, fix CVE-2020-24654
+       * PRE_BUILD: adjust
+
 2020-08-13 Treeve Jelbert <treeve AT sourcemage.org>
        * DETAILS: version 20.08.0
 
diff --git a/kde5-utils/ark/PRE_BUILD b/kde5-utils/ark/PRE_BUILD
index 2b28599..7d6b041 100755
--- a/kde5-utils/ark/PRE_BUILD
+++ b/kde5-utils/ark/PRE_BUILD
@@ -1,3 +1,4 @@
 default_pre_build    &&
 cd $SOURCE_DIRECTORY &&
 sed -i '/update_xdg_mimetypes/D' kerfuffle/CMakeLists.txt
+apply_patch_dir patches
diff --git a/kde5-utils/ark/patches/cve.patch 
b/kde5-utils/ark/patches/cve.patch
deleted file mode 100644
index a258ed8..0000000
--- a/kde5-utils/ark/patches/cve.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-commit 0df592524fed305d6fbe74ddf8a196bc9ffdb92f
-Author: Elvis Angelaccio <elvis.angelaccio AT kde.org>
-Date:   Wed Jul 29 23:45:30 2020 +0200
-
-    Fix vulnerability to path traversal attacks
-    
-    Ark was vulnerable to directory traversal attacks because of
-    missing validation of file paths in the archive.
-    
-    More details about this attack are available at:
-    https://github.com/snyk/zip-slip-vulnerability
-    
-    Job::onEntry() is the only place where we can safely check the path of
-    every entry in the archive. There shouldn't be a valid reason
-    to have a "../" in an archive path, so we can just play safe and abort
-    the LoadJob if we detect such an entry. This makes impossibile to
-    extract this kind of malicious archives and perform the attack.
-    
-    Thanks to Albert Astals Cid for suggesting to use QDir::cleanPath()
-    so that we can still allow loading of legitimate archives that
-    contain "../" in their paths but still resolve inside the extraction 
folder.
-
-diff --git a/kerfuffle/jobs.cpp b/kerfuffle/jobs.cpp
-index fdaa4869..f73b56f8 100644
---- a/kerfuffle/jobs.cpp
-+++ b/kerfuffle/jobs.cpp
-@@ -180,6 +180,14 @@ void Job::onError(const QString & message, const 
QString & details)
- 
- void Job::onEntry(Archive::Entry *entry)
- {
-+    const QString entryFullPath = entry->fullPath();
-+    if (QDir::cleanPath(entryFullPath).contains(QLatin1String("../"))) {
-+        qCWarning(ARK) << "Possibly malicious archive. Detected entry that 
could lead to a directory traversal attack:" << entryFullPath;
-+        onError(i18n("Could not load the archive because it contains 
ill-formed entries and might be a malicious archive."), QString());
-+        onFinished(false);
-+        return;
-+    }
-+
-     emit newEntry(entry);
- }
- 
diff --git a/kde5-utils/ark/patches/symlink.patch 
b/kde5-utils/ark/patches/symlink.patch
new file mode 100644
index 0000000..8b38218
--- /dev/null
+++ b/kde5-utils/ark/patches/symlink.patch
@@ -0,0 +1,53 @@
+From 8bf8c5ef07b0ac5e914d752681e470dea403a5bd Mon Sep 17 00:00:00 2001
+From: Fabian Vogt <fabian AT ritter-vogt.de>
+Date: Tue, 25 Aug 2020 22:14:37 +0200
+Subject: [PATCH] Pass the ARCHIVE_EXTRACT_SECURE_SYMLINKS flag to libarchive
+
+There are archive types which allow to first create a symlink and then
+later on dereference it. If the symlink points outside of the archive,
+this results in writing outside of the destination directory.
+
+With the ARCHIVE_EXTRACT_SECURE_SYMLINKS option set, libarchive avoids
+this situation by verifying that none of the target path components are
+symlinks before writing.
+
+Remove the commented out code in the method, which would actually
+misbehave if enabled again.
+
+Signed-off-by: Fabian Vogt <fabian AT ritter-vogt.de>
+---
+ plugins/libarchive/libarchiveplugin.cpp | 18 +++---------------
+ 1 file changed, 3 insertions(+), 15 deletions(-)
+
+diff --git a/plugins/libarchive/libarchiveplugin.cpp 
b/plugins/libarchive/libarchiveplugin.cpp
+index 50e81da1..8a0fed21 100644
+--- a/plugins/libarchive/libarchiveplugin.cpp
++++ b/plugins/libarchive/libarchiveplugin.cpp
+@@ -509,21 +509,9 @@ void LibarchivePlugin::emitEntryFromArchiveEntry(struct 
archive_entry *aentry)
+ 
+ int LibarchivePlugin::extractionFlags() const
+ {
+-    int result = ARCHIVE_EXTRACT_TIME;
+-    result |= ARCHIVE_EXTRACT_SECURE_NODOTDOT;
+-
+-    // TODO: Don't use arksettings here
+-    /*if ( ArkSettings::preservePerms() )
+-    {
+-        result &= ARCHIVE_EXTRACT_PERM;
+-    }
+-
+-    if ( !ArkSettings::extractOverwrite() )
+-    {
+-        result &= ARCHIVE_EXTRACT_NO_OVERWRITE;
+-    }*/
+-
+-    return result;
++    return ARCHIVE_EXTRACT_TIME
++           | ARCHIVE_EXTRACT_SECURE_NODOTDOT
++           | ARCHIVE_EXTRACT_SECURE_SYMLINKS;
+ }
+ 
+ void LibarchivePlugin::copyData(const QString& filename, struct archive 
*dest, bool partialprogress)
+-- 
+GitLab
+