Star0
20
代码
代码
Issues2
Pull Requests3
项目讨论
Wiki
分析
Star0
20
已合并
fix CVE-2026-82455 #347
tong_1001创建于 29 天前
fix CVE-2026-82455 #347
已合并
tong_1001创建于 29 天前
从已删除 :openEuler-24.03-LTS-SP4合入到src-openeuler/rubyopenEuler-24.03-LTS-SP4
共 3 个文件变更+194-1
Abackport-CVE-2026-82455.patch+78-0
@@ -0,0 +1,78 @@
1+From 643e0235fd7ea2bcb464c97eb2336a81d31b81b4 Mon Sep 17 00:00:00 2001
2+From: thesmartshadow <firaswq12@gmail.com>
3+Date: Sun, 19 Apr 2026 02:20:37 +0300
4+Subject: [PATCH] Prevent symlink-based escape during gem extraction
5+ 
6+Reference:https://github.com/ruby/rubygems/commit/643e0235fd7ea2bcb464c97eb2336a81d31b81b4
7+Conflict:(1) delete `omit "Symlinks not supported or not enabled" unless symlink_supported?` in testcase
8+(2) Define `destination_dir` at the start of the function, as seen in commits
9+https://github.com/ruby/rubygems/commit/58173ff2eaae7dbc50da1b3ac66a604637b90ec9
10+and https://github.com/ruby/rubygems/commit/ac3b85bd5e90d003aa2d9296aec0bc48b5728f1
11+---
12+ lib/rubygems/package.rb | 7 +++++++
13+ test/rubygems/test_gem_package.rb | 24 ++++++++++++++++++++++++
14+ 2 files changed, 31 insertions(+)
15+ 
16+diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
17+index 4672866985f8..2591a349f947 100644
18+--- a/lib/rubygems/package.rb
19++++ b/lib/rubygems/package.rb
20+@@ -408,6 +408,8 @@ EOM
21+ # extracted.
22+
23+ def extract_tar_gz(io, destination_dir, pattern = "*") # :nodoc:
24++ destination_dir = File.realpath(destination_dir)
25++
26+ directories = []
27+ symlinks = []
28+
29+@@ -444,6 +446,11 @@ EOM
30+ directories << mkdir
31+ end
32+
33++ real_mkdir = File.realpath(mkdir)
34++ unless real_mkdir == destination_dir || normalize_path(real_mkdir).start_with?(normalize_path(destination_dir + "/"))
35++ raise Gem::Package::PathError.new(real_mkdir, destination_dir)
36++ end
37++
38+ if entry.file?
39+ File.open(destination, "wb") {|out| out.write entry.read }
40+ FileUtils.chmod file_mode(entry.header.mode), destination
41+diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb
42+index 9d6215838d63..b228a6170537 100644
43+--- a/test/rubygems/test_gem_package.rb
44++++ b/test/rubygems/test_gem_package.rb
45+@@ -542,6 +542,30 @@ class TestGemPackage < Gem::Package::TarTestCase
46+ "#{@destination} is not allowed", e.message)
47+ end
48+
49++ def test_extract_tar_gz_rejects_preexisting_symlink_escape
50++ package = Gem::Package.new @gem
51++
52++ tgz_io = util_tar_gz do |tar|
53++ tar.add_file "lib/owned.txt", 0o644 do |io|
54++ io.write "poc-content"
55++ end
56++ end
57++
58++ escape_dir = File.join(@tempdir, "escape")
59++ FileUtils.mkdir_p escape_dir
60++
61++ FileUtils.rm_rf File.join(@destination, "lib")
62++ File.symlink escape_dir, File.join(@destination, "lib")
63++
64++ escaped = File.join(escape_dir, "owned.txt")
65++
66++ assert_raise Gem::Package::PathError do
67++ package.extract_tar_gz tgz_io, @destination
68++ end
69++
70++ refute File.exist?(escaped), "must not write outside extraction root via symlink"
71++ end
72++
73+ def test_extract_tar_gz_symlink_relative_path
74+ package = Gem::Package.new @gem
75+ package.verify
76+--
77+2.43.0
78+ 
Abackport-Check-the-resolved-parent-directory-before-extractin.patch+107-0
@@ -0,0 +1,107 @@
1+From 20e729f9a5d52aaa5a01aa4712ebfeb3ed6c2db0 Mon Sep 17 00:00:00 2001
2+From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
3+Date: Mon, 3 Aug 2026 11:38:39 +0900
4+Subject: [PATCH] Check the resolved parent directory before extracting old
5+ format gems
6+ 
7+Gem::Package::Old#extract_files only validated entry paths by string
8+expansion, so a preexisting symlink in the extraction directory redirected
9+writes outside of it. Gem::Package#extract_tar_gz already re-resolves the
10+parent directory with File.realpath, so extract the shared check into
11+verify_extraction_dir and call it from both.
12+ 
13+Reference:https://github.com/ruby/rubygems/commit/20e729f9a5d52aaa5a01aa4712ebfeb3ed6c2db0
14+Conflict:delete `omit "Symlinks not supported or not enabled" unless symlink_supported?` in testcase
15+ 
16+Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
17+---
18+ lib/rubygems/package.rb | 19 +++++++++++++++----
19+ lib/rubygems/package/old.rb | 6 ++++--
20+ test/rubygems/test_gem_package_old.rb | 15 +++++++++++++++
21+ 3 files changed, 34 insertions(+), 6 deletions(-)
22+ 
23+diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
24+index cb78a7d15c9d..1cc550a431c8 100644
25+--- a/lib/rubygems/package.rb
26++++ b/lib/rubygems/package.rb
27+@@ -444,10 +444,7 @@ EOM
28+ directories << mkdir
29+ end
30+
31+- real_mkdir = File.realpath(mkdir)
32+- unless real_mkdir == destination_dir || normalize_path(real_mkdir).start_with?(normalize_path(destination_dir + "/"))
33+- raise Gem::Package::PathError.new(real_mkdir, destination_dir)
34+- end
35++ verify_extraction_dir mkdir, destination_dir
36+
37+ if entry.file?
38+ File.open(destination, "wb") {|out| out.write entry.read }
39+@@ -635,6 +632,20 @@ EOM
40+ raise Gem::Package::FormatError.new e.message, @gem
41+ end
42+
43++ ##
44++ # Raises an exception unless +dir+, with symlinks resolved, is
45++ # +destination_dir+ or a directory inside it. +destination_dir+ must
46++ # already be resolved with File.realpath by the caller.
47++
48++ def verify_extraction_dir(dir, destination_dir) # :nodoc:
49++ real_dir = File.realpath(dir)
50++
51++ return if real_dir == destination_dir ||
52++ normalize_path(real_dir).start_with?(normalize_path(destination_dir + "/"))
53++
54++ raise Gem::Package::PathError.new(real_dir, destination_dir)
55++ end
56++
57+ ##
58+ # Verifies the +checksums+ against the +digests+. This check is not
59+ # cryptographically secure. Missing checksums are ignored.
60+diff --git a/lib/rubygems/package/old.rb b/lib/rubygems/package/old.rb
61+index 09a02d3ecd62..0b0b3b643199 100644
62+--- a/lib/rubygems/package/old.rb
63++++ b/lib/rubygems/package/old.rb
64+@@ -75,10 +75,12 @@ class Gem::Package::Old < Gem::Package
65+ raise Gem::Package::FormatError, "#{full_name} in #{@gem} is corrupt" if
66+ file_data.length != entry["size"].to_i
67+
68+- FileUtils.rm_rf destination
69+-
70+ FileUtils.mkdir_p File.dirname(destination), :mode => dir_mode && 0755
71+
72++ verify_extraction_dir File.dirname(destination), destination_dir
73++
74++ FileUtils.rm_rf destination
75++
76+ File.open destination, "wb", file_mode(entry["mode"]) do |out|
77+ out.write file_data
78+ end
79+diff --git a/test/rubygems/test_gem_package_old.rb b/test/rubygems/test_gem_package_old.rb
80+index d65d1edad65a..b232f9712f99 100644
81+--- a/test/rubygems/test_gem_package_old.rb
82++++ b/test/rubygems/test_gem_package_old.rb
83+@@ -43,6 +43,21 @@ unless Gem.java_platform? # jruby can't require the simple_gem file
84+ assert_equal mask, File.stat(extracted).mode unless win_platform?
85+ end
86+
87++ def test_extract_files_rejects_preexisting_symlink_escape
88++
89++ escape_dir = File.join @tempdir, "escape"
90++ FileUtils.mkdir_p escape_dir
91++
92++ File.symlink escape_dir, File.join(@destination, "lib")
93++
94++ assert_raise Gem::Package::PathError do
95++ @package.extract_files @destination
96++ end
97++
98++ assert_path_not_exist File.join(escape_dir, "foo.rb"),
99++ "must not write outside extraction root via symlink"
100++ end
101++
102+ def test_extract_files_security_policy
103+ pend "openssl is missing" unless Gem::HAVE_OPENSSL
104+
105+--
106+2.43.0
107+ 
Mruby.spec+9-1
@@ -33,7 +33,7 @@
33 33 
34Name: ruby34Name: ruby
35Version: %{ruby_version}35Version: %{ruby_version}
36-Release: 15936+Release: 160
37Summary: Object-oriented scripting language interpreter37Summary: Object-oriented scripting language interpreter
38License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD38License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD
39URL: https://www.ruby-lang.org/en/39URL: https://www.ruby-lang.org/en/
@@ -157,6 +157,8 @@ Patch6080: backport-0001-CVE-2026-47242-Refactor-RawText-add-improve-test-covera
157Patch6081: backport-0002-CVE-2026-47242-Validate-QuotedString-contains-only-valid-bytes.patch157Patch6081: backport-0002-CVE-2026-47242-Validate-QuotedString-contains-only-valid-bytes.patch
158Patch6082: backport-CVE-2026-80212.patch158Patch6082: backport-CVE-2026-80212.patch
159Patch6083: backport-CVE-2026-80213.patch159Patch6083: backport-CVE-2026-80213.patch
160+Patch6084: backport-CVE-2026-82455.patch
161+Patch6085: backport-Check-the-resolved-parent-directory-before-extractin.patch
160 162 
161Patch9000: fix-dynamic-constant-assignment-SyntaxError.patch163Patch9000: fix-dynamic-constant-assignment-SyntaxError.patch
162 164 
@@ -946,6 +948,12 @@ make runruby TESTRUN_SCRIPT=%{SOURCE13}
946%{gem_dir}/specifications/matrix-%{matrix_version}.gemspec948%{gem_dir}/specifications/matrix-%{matrix_version}.gemspec
947 949 
948%changelog950%changelog
951+* Mon Aug 31 2026 shixuantong <sxt1001@qq.com> - 3.2.2-160
952+- Type:CVE
953+- CVE:CVE-2026-82455
954+- SUG:NA
955+- DESC:fix CVE-2026-82455
956+ 
949* Sat Aug 29 2026 shixuantong <sxt1001@qq.com> - 3.2.2-159957* Sat Aug 29 2026 shixuantong <sxt1001@qq.com> - 3.2.2-159
950- Type:CVE958- Type:CVE
951- CVE:CVE-2026-80212 CVE-2026-80213959- CVE:CVE-2026-80212 CVE-2026-80213