From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 8C0F2138334 for ; Mon, 10 Sep 2018 20:38:42 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id B51A9E09FB; Mon, 10 Sep 2018 20:38:41 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 7429DE09FB for ; Mon, 10 Sep 2018 20:38:41 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id C477E335D04 for ; Mon, 10 Sep 2018 20:38:39 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 6425E3C3 for ; Mon, 10 Sep 2018 20:38:37 +0000 (UTC) From: "Andreas Sturmlechner" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Andreas Sturmlechner" Message-ID: <1536611883.75a72fe24a730420ec692367e4e108d4a0a6d617.asturm@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: kde-apps/okular/, kde-apps/okular/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch kde-apps/okular/okular-18.04.3-r1.ebuild X-VCS-Directories: kde-apps/okular/files/ kde-apps/okular/ X-VCS-Committer: asturm X-VCS-Committer-Name: Andreas Sturmlechner X-VCS-Revision: 75a72fe24a730420ec692367e4e108d4a0a6d617 X-VCS-Branch: master Date: Mon, 10 Sep 2018 20:38:37 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 7c24ee29-0537-49cb-b59f-8a27f6788f7e X-Archives-Hash: 2f7743c4d8287ea1fb6ec8bcf0b6cbb2 commit: 75a72fe24a730420ec692367e4e108d4a0a6d617 Author: Andreas Sturmlechner gentoo org> AuthorDate: Mon Sep 10 20:33:04 2018 +0000 Commit: Andreas Sturmlechner gentoo org> CommitDate: Mon Sep 10 20:38:03 2018 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=75a72fe2 kde-apps/okular: Fix path traversal issue when extracting .okular file With a specially crafted .okular files it was possible to trick okular to create temporary files outside the temporary folder. Bug: https://bugs.gentoo.org/665662 KDE-Bug: https://bugs.kde.org/show_bug.cgi?id=398096 See also: https://phabricator.kde.org/D15192 Package-Manager: Portage-2.3.49, Repoman-2.3.10 .../okular-18.04.3-path-traversal-issue.patch | 46 +++++++++ kde-apps/okular/okular-18.04.3-r1.ebuild | 106 +++++++++++++++++++++ 2 files changed, 152 insertions(+) diff --git a/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch b/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch new file mode 100644 index 00000000000..216f235d864 --- /dev/null +++ b/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch @@ -0,0 +1,46 @@ +From 8ff7abc14d41906ad978b6bc67e69693863b9d47 Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid +Date: Mon, 3 Sep 2018 21:14:30 +0200 +Subject: Fix path traversal issue when extracting an .okular file + +Summary: +With specially crafted .okular files you can trick okular to create temporary files outside the temporary folder + +We fix that by making sure the file doesn't have folders since the ones we create don't + +BUGS: 398096 + +Subscribers: okular-devel + +Tags: #okular + +Differential Revision: https://phabricator.kde.org/D15192 +--- + core/document.cpp | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/core/document.cpp b/core/document.cpp +index 5e3c169..7d46173 100644 +--- a/core/document.cpp ++++ b/core/document.cpp +@@ -4819,6 +4819,18 @@ ArchiveData *DocumentPrivate::unpackDocumentArchive( const QString &archivePath + return nullptr; + + const KArchiveDirectory * mainDir = okularArchive.directory(); ++ ++ // Check the archive doesn't have folders, we don't create them when saving the archive ++ // and folders mean paths and paths mean path traversal issues ++ for ( const QString &entry : mainDir->entries() ) ++ { ++ if ( mainDir->entry( entry )->isDirectory() ) ++ { ++ qWarning() << "Warning: Found a directory inside" << archivePath << " - Okular does not create files like that so it is most probably forged."; ++ return nullptr; ++ } ++ } ++ + const KArchiveEntry * mainEntry = mainDir->entry( QStringLiteral("content.xml") ); + if ( !mainEntry || !mainEntry->isFile() ) + return nullptr; +-- +cgit v0.11.2 diff --git a/kde-apps/okular/okular-18.04.3-r1.ebuild b/kde-apps/okular/okular-18.04.3-r1.ebuild new file mode 100644 index 00000000000..f802a174ab1 --- /dev/null +++ b/kde-apps/okular/okular-18.04.3-r1.ebuild @@ -0,0 +1,106 @@ +# Copyright 1999-2018 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +EAPI=6 + +KDE_HANDBOOK="forceoptional" +KDE_TEST="forceoptional" +VIRTUALX_REQUIRED="test" +inherit kde5 + +DESCRIPTION="Universal document viewer based on KDE Frameworks" +HOMEPAGE="https://okular.kde.org https://www.kde.org/applications/graphics/okular" +KEYWORDS="~amd64 ~x86" +IUSE="chm crypt djvu epub +image-backend markdown mobi mobile +pdf plucker +postscript share speech +tiff" + +DEPEND=" + $(add_frameworks_dep kactivities) + $(add_frameworks_dep karchive) + $(add_frameworks_dep kbookmarks) + $(add_frameworks_dep kcompletion) + $(add_frameworks_dep kconfig) + $(add_frameworks_dep kconfigwidgets) + $(add_frameworks_dep kcoreaddons) + $(add_frameworks_dep kcrash) + $(add_frameworks_dep kio) + $(add_frameworks_dep kjs) + $(add_frameworks_dep kparts) + $(add_frameworks_dep kpty) + $(add_frameworks_dep kwallet) + $(add_frameworks_dep threadweaver) + $(add_qt_dep qtdbus) + $(add_qt_dep qtgui) + $(add_qt_dep qtprintsupport) + $(add_qt_dep qtsvg) + $(add_qt_dep qtwidgets) + media-libs/freetype + media-libs/phonon[qt5(+)] + sys-libs/zlib + chm? ( + $(add_frameworks_dep khtml) + dev-libs/chmlib + ) + crypt? ( app-crypt/qca:2[qt5(+)] ) + djvu? ( app-text/djvu ) + epub? ( app-text/ebook-tools ) + image-backend? ( + $(add_kdeapps_dep libkexiv2) + $(add_qt_dep qtgui 'gif,jpeg,png') + ) + markdown? ( app-text/discount ) + mobi? ( $(add_kdeapps_dep kdegraphics-mobipocket) ) + pdf? ( app-text/poppler[qt5] ) + plucker? ( virtual/jpeg:0 ) + postscript? ( app-text/libspectre ) + share? ( $(add_frameworks_dep purpose) ) + speech? ( $(add_qt_dep qtspeech) ) + tiff? ( media-libs/tiff:0 ) +" +RDEPEND="${DEPEND} + image-backend? ( $(add_frameworks_dep kimageformats) ) + mobile? ( + $(add_frameworks_dep kirigami) + $(add_qt_dep qtquickcontrols) + ) +" + +PATCHES=( + "${FILESDIR}/${PN}-tests.patch" + "${FILESDIR}/${P}-path-traversal-issue.patch" +) + +src_prepare() { + kde5_src_prepare + use mobile || cmake_comment_add_subdirectory mobile + use test || cmake_comment_add_subdirectory conf/autotests +} + +src_configure() { + local mycmakeargs=( + $(cmake-utils_use_find_package chm CHM) + $(cmake-utils_use_find_package crypt Qca-qt5) + $(cmake-utils_use_find_package djvu DjVuLibre) + $(cmake-utils_use_find_package epub EPub) + $(cmake-utils_use_find_package image-backend KF5KExiv2) + $(cmake-utils_use_find_package markdown Discount) + $(cmake-utils_use_find_package mobi QMobipocket) + $(cmake-utils_use_find_package pdf Poppler) + $(cmake-utils_use_find_package plucker JPEG) + $(cmake-utils_use_find_package postscript LibSpectre) + $(cmake-utils_use_find_package share KDEExperimentalPurpose) + $(cmake-utils_use_find_package speech Qt5TextToSpeech) + $(cmake-utils_use_find_package tiff TIFF) + ) + + kde5_src_configure +} + +src_test() { + # mainshelltest hangs, chmgeneratortest fails, bug #603116 + # parttest hangs, bug #641728 + local myctestargs=( + -E "(mainshelltest|chmgeneratortest|parttest)" + ) + + kde5_src_test +}