[gentoo-commits] repo/gentoo:master commit in: kde-apps/ark/files/, kde-apps/ark/

[Andreas Sturmlechner]

commit:     55a42a5c7060468e5406884bfa4294b3cdc824c7
Author:     Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
AuthorDate: Sat Aug  1 15:41:53 2020 +0000
Commit:     Andreas Sturmlechner <asturm <AT> gentoo <DOT> org>
CommitDate: Sat Aug  1 22:57:17 2020 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=55a42a5c

kde-apps/ark: Fix CVE-2020-16116

Bug: https://bugs.gentoo.org/734622
Package-Manager: Portage-3.0.1, Repoman-2.3.23
Signed-off-by: Andreas Sturmlechner <asturm <AT> gentoo.org>

 kde-apps/ark/ark-20.04.3-r1.ebuild                 | 85 ++++++++++++++++++++++
 .../ark/files/ark-20.04.3-CVE-2020-16116.patch     | 46 ++++++++++++
 2 files changed, 131 insertions(+)

diff --git a/kde-apps/ark/ark-20.04.3-r1.ebuild b/kde-apps/ark/ark-20.04.3-r1.ebuild
new file mode 100644
index 00000000000..0777dc7a6bc
--- /dev/null
+++ b/kde-apps/ark/ark-20.04.3-r1.ebuild
@@ -0,0 +1,85 @@
+# Copyright 1999-2020 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+ECM_HANDBOOK="forceoptional"
+ECM_TEST="optional"
+KFMIN=5.70.0
+QTMIN=5.14.2
+VIRTUALX_REQUIRED="test"
+inherit ecm kde.org
+
+DESCRIPTION="KDE Archiving tool"
+HOMEPAGE="https://kde.org/applications/utilities/org.kde.ark
+https://utils.kde.org/projects/ark/"
+
+LICENSE="GPL-2" # TODO: CHECK
+SLOT="5"
+KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
+IUSE="bzip2 lzma zip"
+
+BDEPEND="
+	sys-devel/gettext
+"
+RDEPEND="
+	app-arch/libarchive:=[bzip2?,lzma?,zlib]
+	>=dev-qt/qtdbus-${QTMIN}:5
+	>=dev-qt/qtgui-${QTMIN}:5
+	>=dev-qt/qtwidgets-${QTMIN}:5
+	>=kde-frameworks/karchive-${KFMIN}:5
+	>=kde-frameworks/kcompletion-${KFMIN}:5
+	>=kde-frameworks/kconfig-${KFMIN}:5
+	>=kde-frameworks/kconfigwidgets-${KFMIN}:5
+	>=kde-frameworks/kcoreaddons-${KFMIN}:5
+	>=kde-frameworks/kcrash-${KFMIN}:5
+	>=kde-frameworks/kdbusaddons-${KFMIN}:5
+	>=kde-frameworks/ki18n-${KFMIN}:5
+	>=kde-frameworks/kio-${KFMIN}:5
+	>=kde-frameworks/kitemmodels-${KFMIN}:5
+	>=kde-frameworks/kjobwidgets-${KFMIN}:5
+	>=kde-frameworks/kparts-${KFMIN}:5
+	>=kde-frameworks/kpty-${KFMIN}:5
+	>=kde-frameworks/kservice-${KFMIN}:5
+	>=kde-frameworks/kwidgetsaddons-${KFMIN}:5
+	>=kde-frameworks/kxmlgui-${KFMIN}:5
+	sys-libs/zlib
+	zip? ( >=dev-libs/libzip-1.2.0:= )
+"
+DEPEND="${RDEPEND}
+	>=dev-qt/qtconcurrent-${QTMIN}:5
+"
+
+# bug #560548, last checked with 16.04.1
+RESTRICT+=" test"
+
+PATCHES=( "${FILESDIR}/${P}-CVE-2020-16116.patch" )
+
+src_configure() {
+	local mycmakeargs=(
+		$(cmake_use_find_package bzip2 BZip2)
+		$(cmake_use_find_package lzma LibLZMA)
+		$(cmake_use_find_package zip LibZip)
+	)
+
+	ecm_src_configure
+}
+
+pkg_postinst() {
+	ecm_pkg_postinst
+
+	if [[ -z "${REPLACING_VERSIONS}" ]]; then
+		if ! has_version app-arch/rar; then
+			elog "For creating/extracting rar archives, installing app-arch/rar is required."
+			if ! has_version app-arch/unar && ! has_version app-arch/unrar; then
+				elog "Alternatively, for only extracting rar archives, install app-arch/unar (free) or app-arch/unrar (non-free)."
+			fi
+		fi
+
+		has_version app-arch/p7zip || \
+			elog "For handling 7-Zip archives, install app-arch/p7zip."
+
+		has_version app-arch/lrzip || \
+			elog "For handling lrz archives, install app-arch/lrzip."
+	fi
+}

diff --git a/kde-apps/ark/files/ark-20.04.3-CVE-2020-16116.patch b/kde-apps/ark/files/ark-20.04.3-CVE-2020-16116.patch
new file mode 100644
index 00000000000..79129c7be6e
--- /dev/null
+++ b/kde-apps/ark/files/ark-20.04.3-CVE-2020-16116.patch
@@ -0,0 +1,46 @@
+From 0df592524fed305d6fbe74ddf8a196bc9ffdb92f Mon Sep 17 00:00:00 2001
+From: Elvis Angelaccio <elvis.angelaccio@×××.org>
+Date: Wed, 29 Jul 2020 23:45:30 +0200
+Subject: [PATCH] Fix vulnerability to path traversal attacks
+
+Ark was vulnerable to directory traversal attacks because of
+missing validation of file paths in the archive.
+
+More details about this attack are available at:
+https://github.com/snyk/zip-slip-vulnerability
+
+Job::onEntry() is the only place where we can safely check the path of
+every entry in the archive. There shouldn't be a valid reason
+to have a "../" in an archive path, so we can just play safe and abort
+the LoadJob if we detect such an entry. This makes impossibile to
+extract this kind of malicious archives and perform the attack.
+
+Thanks to Albert Astals Cid for suggesting to use QDir::cleanPath()
+so that we can still allow loading of legitimate archives that
+contain "../" in their paths but still resolve inside the extraction folder.
+---
+ kerfuffle/jobs.cpp | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/kerfuffle/jobs.cpp b/kerfuffle/jobs.cpp
+index fdaa48695..f73b56f86 100644
+--- a/kerfuffle/jobs.cpp
++++ b/kerfuffle/jobs.cpp
+@@ -180,6 +180,14 @@ void Job::onError(const QString & message, const QString & details)
+ 
+ void Job::onEntry(Archive::Entry *entry)
+ {
++    const QString entryFullPath = entry->fullPath();
++    if (QDir::cleanPath(entryFullPath).contains(QLatin1String("../"))) {
++        qCWarning(ARK) << "Possibly malicious archive. Detected entry that could lead to a directory traversal attack:" << entryFullPath;
++        onError(i18n("Could not load the archive because it contains ill-formed entries and might be a malicious archive."), QString());
++        onFinished(false);
++        return;
++    }
++
+     emit newEntry(entry);
+ }
+ 
+-- 
+GitLab
+