| Brad Bishop | 1a4b7ee | 2018-12-16 17:11:34 -0800 | [diff] [blame^] | 1 | From 1b931fc03b819b9a0214be3eaca844ef534175e2 Mon Sep 17 00:00:00 2001 |
| 2 | From: Jonathan Claudius <jclaudius@mozilla.com> |
| 3 | Date: Wed, 7 Feb 2018 23:54:52 -0500 |
| 4 | Subject: [PATCH] Non-working patch for deducing symlinked base-dirs |
| 5 | |
| 6 | --- |
| 7 | CVE: CVE-2018-1000073 |
| 8 | |
| 9 | Fixed in ruby 2.7.6. |
| 10 | |
| 11 | Upstream-Status: Backport [github.com/rubygems/rubygems/commit/1b931fc...] |
| 12 | |
| 13 | Signed-off-by: Joe Slater <joe.slater@windriver.com> |
| 14 | |
| 15 | --- |
| 16 | lib/rubygems/package.rb | 2 ++ |
| 17 | 1 file changed, 2 insertions(+) |
| 18 | |
| 19 | diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb |
| 20 | index dede959..cb9c74a 100644 |
| 21 | --- a/lib/rubygems/package.rb |
| 22 | +++ b/lib/rubygems/package.rb |
| 23 | @@ -421,6 +421,8 @@ EOM |
| 24 | destination_dir = File.expand_path destination_dir |
| 25 | |
| 26 | destination = File.join destination_dir, filename |
| 27 | + destination = File.realpath destination if |
| 28 | + File.respond_to? :realpath |
| 29 | destination = File.expand_path destination |
| 30 | |
| 31 | raise Gem::Package::PathError.new(destination, destination_dir) unless |
| 32 | -- |
| 33 | 1.7.9.5 |
| 34 | |