1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 1 Oct 2019 11:01:53 +0000
Subject: lib/shell/command-processor.rb (Shell#[]): prevent unknown command
Origin: https://github.com/ruby/ruby/commit/3af01ae1101e0b8815ae5a106be64b0e82a58640
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2019-16255
`FileTest.send(command, ...)` allows to call not only FileTest-related
methods but also any method that belongs to Kernel, Object, etc.
patched by <mame@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67814 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[Salvatore Bonaccorso: Backport to 2.3.3:
- Context changes in test/shell/test_command_processor.rb
]
---
lib/shell/command-processor.rb | 3 +++
test/shell/test_command_processor.rb | 18 ++++++++++++++++++
2 files changed, 21 insertions(+)
diff --git a/lib/shell/command-processor.rb b/lib/shell/command-processor.rb
index b52cb0043f75..08ea5c874c12 100644
--- a/lib/shell/command-processor.rb
+++ b/lib/shell/command-processor.rb
@@ -180,6 +180,9 @@ def test(command, file1, file2=nil)
top_level_test(command, file1)
end
else
+ unless FileTest.methods(false).include?(command.to_sym)
+ raise "unsupported command: #{ command }"
+ end
if file2
FileTest.send(command, file1, file2)
else
--- a/test/shell/test_command_processor.rb
+++ b/test/shell/test_command_processor.rb
@@ -66,4 +66,22 @@ class TestShell::CommandProcessor < Test
Process.waitall
Dir.rmdir(path)
end
+
+ def test_test
+ name = "foo#{exeext}"
+ path = File.join(@tmpdir, name)
+ open(path, "w", 0644) {}
+
+ assert_equal(true, @shell[?e, path])
+ assert_equal(true, @shell[:e, path])
+ assert_equal(true, @shell["e", path])
+ assert_equal(true, @shell[:exist?, path])
+ assert_equal(true, @shell["exist?", path])
+ assert_raise_with_message(RuntimeError, /unsupported command/) do
+ assert_equal(true, @shell[:instance_eval, path])
+ end
+ ensure
+ Process.waitall
+ File.unlink(path)
+ end
end
|
