[gentoo-commits] gentoo-x86 commit in kde-base/kget/files: kget-4.4.3_CVE-2010-1000.patch

[Maciej Mrozowski (reavertm)]

reavertm    10/05/10 22:08:32

  Added:                kget-4.4.3_CVE-2010-1000.patch
  Log:
  CVE-2010-1000
  (Portage version: 2.2_rc67/cvs/Linux x86_64)

Revision  Changes    Path
1.1                  kde-base/kget/files/kget-4.4.3_CVE-2010-1000.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kget/files/kget-4.4.3_CVE-2010-1000.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/kde-base/kget/files/kget-4.4.3_CVE-2010-1000.patch?rev=1.1&content-type=text/plain

Index: kget-4.4.3_CVE-2010-1000.patch
===================================================================
diff --git a/kget/transfer-plugins/metalink/metalink.cpp b/kget/transfer-plugins/metalink/metalink.cpp
index 605d4e1..c7d5d75 100644
--- a/kget/transfer-plugins/metalink/metalink.cpp
+++ b/kget/transfer-plugins/metalink/metalink.cpp
@@ -99,6 +99,7 @@ void Metalink::start()
 void Metalink::metalinkInit(const KUrl &src, const QByteArray &data)
 {
     kDebug(5001);
+
     bool justDownloaded = !m_localMetalinkLocation.isValid();
     if (!src.isEmpty())
     {
@@ -121,7 +122,9 @@ void Metalink::metalinkInit(const KUrl &src, const QByteArray &data)
     //error
     if (!m_metalink.isValid())
     {
-        kDebug(5001) << "Unknown error when trying to load the .metalink-file";
+        kError(5001) << "Unknown error when trying to load the .metalink-file. Metalink is not valid.";
+        setStatus(Job::Aborted);
+        setTransferChange(Tc_Status, true);
         return;
     }
 
@@ -202,7 +205,7 @@ void Metalink::metalinkInit(const KUrl &src, const QByteArray &data)
     if (!m_dataSourceFactory.size())
     {
         KMessageBox::error(0, i18n("Download failed, no working URLs were found."), i18n("Error"));
-        setStatus(Job::Aborted, i18n("An error occurred...."), SmallIcon("document-preview"));
+        setStatus(Job::Aborted);
         setTransferChange(Tc_Status, true);
         return;
     }
@@ -227,16 +230,29 @@ void Metalink::metalinkInit(const KUrl &src, const QByteArray &data)
         ui.treeView->hideColumn(FileItem::SignatureVerified);
         dialog->setMainWidget(widget);
         dialog->setCaption(i18n("File Selection"));
-        dialog->setButtons(KDialog::Ok);
-        connect(dialog, SIGNAL(finished()), this, SLOT(filesSelected()));
+        dialog->setButtons(KDialog::Ok | KDialog::Cancel);
+        connect(dialog, SIGNAL(finished(int)), this, SLOT(fileDlgFinished(int)));
 
         dialog->show();
     }
 }
 
-void Metalink::filesSelected()
+void Metalink::fileDlgFinished(int result)
 {
+    //BEGIN HACK if the dialog was not accepted untick every file, so that the download does not start
+    //generally setStatus should do the job as well, but does not as it appears
+    if (result != QDialog::Accepted) {
+        for (int row = 0; row < fileModel()->rowCount(); ++row) {
+            QModelIndex index = fileModel()->index(row, FileItem::File);
+            if (index.isValid()) {
+                fileModel()->setData(index, Qt::Unchecked, Qt::CheckStateRole);
+            }
+        }
+    }
+    //END
+
     QModelIndexList files = fileModel()->fileIndexes(FileItem::File);
+    int numFilesSelected = 0;
     foreach (const QModelIndex &index, files)
     {
         const KUrl dest = fileModel()->getUrl(index);
@@ -244,6 +260,9 @@ void Metalink::filesSelected()
         if (m_dataSourceFactory.contains(dest))
         {
             m_dataSourceFactory[dest]->setDoDownload(doDownload);
+            if (doDownload) {
+                ++numFilesSelected;
+            }
         }
     }
 
@@ -252,9 +271,15 @@ void Metalink::filesSelected()
     processedSizeChanged();
     speedChanged();
 
+    //no files selected to download or dialog rejected, stop the download
+    if (!numFilesSelected  || (result != QDialog::Accepted)) {
+         setStatus(Job::Stopped);//FIXME
+         setTransferChange(Tc_Status, true);
+        return;
+    }
+
     //some files may be set to download, so start them as long as the transfer is not stopped
-    if (status() != Job::Stopped)
-    {
+    if (status() != Job::Stopped) {
         startMetalink();
     }
 }
diff --git a/kget/transfer-plugins/metalink/metalink.h b/kget/transfer-plugins/metalink/metalink.h
index 41988cb..15e8698 100644
--- a/kget/transfer-plugins/metalink/metalink.h
+++ b/kget/transfer-plugins/metalink/metalink.h
@@ -81,7 +81,7 @@ class Metalink : public Transfer
 
     private Q_SLOTS:
         void metalinkInit(const KUrl &url = KUrl(), const QByteArray &data = QByteArray());
-        void filesSelected();
+        void fileDlgFinished(int result);
         void totalSizeChanged(KIO::filesize_t size);
         void processedSizeChanged();
         void speedChanged();
diff --git a/kget/ui/metalinkcreator/metalinker.cpp b/kget/ui/metalinkcreator/metalinker.cpp
index 9487c6f..019b571 100644
--- a/kget/ui/metalinkcreator/metalinker.cpp
+++ b/kget/ui/metalinkcreator/metalinker.cpp
@@ -528,14 +528,14 @@ void KGetMetalink::Verification::clear()
 
 bool KGetMetalink::File::isValid() const
 {
-    return !name.isEmpty() && resources.isValid();
+    return isValidNameAttribute() && resources.isValid();
 }
 
 void KGetMetalink::File::load(const QDomElement &e)
 {
     data.load(e);
 
-    name = e.attribute("name");
+    name = QUrl::fromPercentEncoding(e.attribute("name").toAscii());
     size = e.firstChildElement("size").text().toULongLong();
 
     verification.load(e);
@@ -575,6 +575,22 @@ void KGetMetalink::File::clear()
     resources.clear();
 }
 
+
+bool KGetMetalink::File::isValidNameAttribute() const
+{
+    if (name.isEmpty()) {
+        kError(5001) << "Name attribute of Metalink::File is empty.";
+        return false;
+    }
+
+    if (name.contains(QRegExp("$(\\.\\.?)?/")) || name.contains("/../") || name.endsWith("/..")) {
+        kError(5001) << "Name attribute of Metalink::File contains directory traversal directives:" << name;
+        return false;
+    }
+
+    return true;
+}
+
 #ifdef HAVE_NEPOMUK
 QHash<QUrl, Nepomuk::Variant> KGetMetalink::File::properties() const
 {
@@ -584,13 +600,28 @@ QHash<QUrl, Nepomuk::Variant> KGetMetalink::File::properties() const
 
 bool KGetMetalink::Files::isValid() const
 {
-    bool isValid = !files.empty();
-    foreach (const File &file, files)
-    {
-        isValid &= file.isValid();
+    if (files.isEmpty()) {
+        return false;
     }
 
-    return isValid;
+    QStringList fileNames;
+    foreach (const File &file, files) {
+        fileNames << file.name;
+        if (!file.isValid()) {
+            return false;
+        }
+    }
+
+    //The value of name must be unique for each file
+    while (!fileNames.isEmpty()) {
+        const QString fileName = fileNames.takeFirst();
+        if (fileNames.contains(fileName)) {
+            kError(5001) << "Metalink::File name" << fileName << "exists multiple times.";
+            return false;
+        }
+    }
+
+    return true;
 }
 
 void KGetMetalink::Files::load(const QDomElement &e)
@@ -751,7 +782,7 @@ void KGetMetalink::Metalink_v3::parseFiles(const QDomElement &e)
 
     for (QDomElement elem = filesElem.firstChildElement("file"); !elem.isNull(); elem = elem.nextSiblingElement("file")) {
         File file;
-        file.name = elem.attribute("name");
+        file.name = QUrl::fromPercentEncoding(elem.attribute("name").toAscii());
         file.size = elem.firstChildElement("size").text().toULongLong();
 
         file.data = parseCommonData(elem);
diff --git a/kget/ui/metalinkcreator/metalinker.h b/kget/ui/metalinkcreator/metalinker.h
index 36b5b82..867d1a7 100644
--- a/kget/ui/metalinkcreator/metalinker.h
+++ b/kget/ui/metalinkcreator/metalinker.h
@@ -259,6 +259,14 @@ class File
         KIO::filesize_t size;
         CommonData data;
         Resources resources;
+
+    private:
+        /**
+         * Controlls if the name attribute is valid, i.e. it is not empty and
+         * does not contain any directory traversal directives or information,
+         * as described in the Metalink 4.0 specification 4.1.2.1.
+         */
+        bool isValidNameAttribute() const;
 };
 
 class Files