Projects
openEuler:20.03:LTS:SP1
ruby
_service:tar_scm_kernel_repo:backport-CVE-2024-...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm_kernel_repo:backport-CVE-2024-27281-Filter-marshaled-objects.patch of Package ruby
From 32ff6ba0bebd8ea26f569da5fd23be2937f6a644 Mon Sep 17 00:00:00 2001 From: Hiroshi SHIBATA <hsbt@ruby-lang.org> Date: Tue, 20 Feb 2024 17:30:25 +0900 Subject: [PATCH] Filter marshaled objects Reference:https://github.com/ruby/rdoc/commit/32ff6ba0bebd8ea26f569da5fd23be2937f6a644 --- lib/rdoc/store.rb | 45 ++++++++++++++++++++++++++------------------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb index 999aa76..8851549 100644 --- a/lib/rdoc/store.rb +++ b/lib/rdoc/store.rb @@ -539,9 +539,7 @@ class RDoc::Store def load_cache #orig_enc = @encoding - open cache_path, 'rb' do |io| - @cache = Marshal.load io.read - end + @cache = marshal_load(cache_path) load_enc = @cache[:encoding] @@ -596,9 +594,7 @@ class RDoc::Store def load_class_data klass_name file = class_file klass_name - open file, 'rb' do |io| - Marshal.load io.read - end + marshal_load(file) rescue Errno::ENOENT => e error = MissingFileError.new(self, file, klass_name) error.set_backtrace e.backtrace @@ -611,14 +607,10 @@ class RDoc::Store def load_method klass_name, method_name file = method_file klass_name, method_name - open file, 'rb' do |io| - obj = Marshal.load io.read - obj.store = self - obj.parent = - find_class_or_module(klass_name) || load_class(klass_name) unless - obj.parent - obj - end + obj = marshal_load(file) + obj.store = self + obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name) + obj rescue Errno::ENOENT => e error = MissingFileError.new(self, file, klass_name + method_name) error.set_backtrace e.backtrace @@ -631,11 +623,9 @@ class RDoc::Store def load_page page_name file = page_file page_name - open file, 'rb' do |io| - obj = Marshal.load io.read - obj.store = self - obj - end + obj = marshal_load(file) + obj.store = self + obj rescue Errno::ENOENT => e error = MissingFileError.new(self, file, page_name) error.set_backtrace e.backtrace @@ -965,4 +955,21 @@ class RDoc::Store @unique_modules end + private + def marshal_load(file) + File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)} + end + + MarshalFilter = proc do |obj| + case obj + when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text + else + unless obj.class.name.start_with("RDoc::") + raise TypeError, "not permitted class: #{obj.class.name}" + end + end + obj + end + private_constant :MarshalFilter + end -- 2.33.0
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.