[pkgsrc/pkgsrc-2006Q4]: pkgsrc/misc/rubygems Pullup ticket 2008 - requested b...

[salo <salo%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/d115b9f5f651
branches:  pkgsrc-2006Q4
changeset: 522998:d115b9f5f651
user:      salo <salo%pkgsrc.org@localhost>
date:      Sat Feb 03 20:59:11 2007 +0000

description:
Pullup ticket 2008 - requested by taca
security fix for rubygems

Revisions pulled up:
- pkgsrc/misc/rubygems/Makefile                         1.6
- pkgsrc/misc/rubygems/distinfo                         1.6, 1.7
- pkgsrc/misc/rubygems/patches/patch-ab                 1.1, 1.2

   Module Name:         pkgsrc
   Committed By:        taca
   Date:                Sun Jan 28 16:08:55 UTC 2007

   Modified Files:
        pkgsrc/misc/rubygems: Makefile distinfo
   Added Files:
        pkgsrc/misc/rubygems/patches: patch-ab

   Log Message:
   Add a patch to fix security problem of RubyGems 0.9.0 and prior.
   (http://www.frsirt.com/english/advisories/2007/0295)

   Bump PKGREVISION.
---
   Module Name:         pkgsrc
   Committed By:        salo
   Date:                Sat Feb  3 20:42:33 UTC 2007

   Modified Files:
        pkgsrc/misc/rubygems: distinfo
        pkgsrc/misc/rubygems/patches: patch-ab

   Log Message:
   Add missing rcsid.

diffstat:

 misc/rubygems/Makefile         |   4 ++--
 misc/rubygems/distinfo         |   3 ++-
 misc/rubygems/patches/patch-ab |  35 +++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 3 deletions(-)

diffs (64 lines):

diff -r 5b464bc40629 -r d115b9f5f651 misc/rubygems/Makefile
--- a/misc/rubygems/Makefile    Sat Feb 03 20:22:50 2007 +0000
+++ b/misc/rubygems/Makefile    Sat Feb 03 20:59:11 2007 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.5 2006/10/05 09:30:27 cube Exp $
+# $NetBSD: Makefile,v 1.5.2.1 2007/02/03 20:59:11 salo Exp $
 
 DISTNAME=      rubygems-0.9.0
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    misc ruby
 MASTER_SITES=  http://rubyforge.org/frs/download.php/11289/
 EXTRACT_SUFX=  .tgz
diff -r 5b464bc40629 -r d115b9f5f651 misc/rubygems/distinfo
--- a/misc/rubygems/distinfo    Sat Feb 03 20:22:50 2007 +0000
+++ b/misc/rubygems/distinfo    Sat Feb 03 20:59:11 2007 +0000
@@ -1,6 +1,7 @@
-$NetBSD: distinfo,v 1.5 2006/10/05 09:30:27 cube Exp $
+$NetBSD: distinfo,v 1.5.2.1 2007/02/03 20:59:11 salo Exp $
 
 SHA1 (rubygems-0.9.0.tgz) = 90d2193e9bb91dbbfbb81ce749abcd827e3b6b53
 RMD160 (rubygems-0.9.0.tgz) = 7d2a4ec1a615f608e75c68ee346d957efbb34ed1
 Size (rubygems-0.9.0.tgz) = 174321 bytes
 SHA1 (patch-aa) = 3fc54ebc8b4ea141bea54fb5a96f1408c6ca5b95
+SHA1 (patch-ab) = 5c3b1edc8111b02fd931ae832c6f6ca8d6b800f2
diff -r 5b464bc40629 -r d115b9f5f651 misc/rubygems/patches/patch-ab
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/misc/rubygems/patches/patch-ab    Sat Feb 03 20:59:11 2007 +0000
@@ -0,0 +1,35 @@
+$NetBSD: patch-ab,v 1.2.2.2 2007/02/03 20:59:11 salo Exp $
+
+Index: lib/rubygems/installer.rb
+===================================================================
+--- lib/rubygems/installer.rb  (revision 1195)
++++ lib/rubygems/installer.rb  (working copy)
+@@ -335,14 +335,20 @@ TEXT
+     #
+     def extract_files(directory, format)
+       require 'fileutils'
+-      wd = Dir.getwd
+-      Dir.chdir directory do
+-        format.file_entries.each do |entry, file_data|
+-          path = entry['path'].untaint
+-          FileUtils.mkdir_p File.dirname(path)
+-          File.open(path, "wb") do |out|
+-            out.write file_data
+-          end
++      format.file_entries.each do |entry, file_data|
++        path = entry['path'].untaint
++        if path =~ /\A\// then # for extra sanity
++          raise Gem::InstallError,
++                "attempt to install file into #{entry['path'].inspect}"
++        end
++        path = File.expand_path File.join(directory, path)
++        if path !~ /\A#{Regexp.escape directory}/ then
++          raise Gem::InstallError,
++                "attempt to install file into #{entry['path'].inspect}"
++        end
++        FileUtils.mkdir_p File.dirname(path)
++        File.open(path, "wb") do |out|
++          out.write file_data
+         end
+       end
+     end