diff options
author | 2018-09-10 22:33:04 +0200 | |
---|---|---|
committer | 2018-09-10 22:38:03 +0200 | |
commit | 75a72fe24a730420ec692367e4e108d4a0a6d617 (patch) | |
tree | 0b1c610e84086837b95cc7c508fce91eb6e1167a /kde-apps/okular/files | |
parent | sys-cluster/neutron: 13.0.1 bump (diff) | |
download | gentoo-75a72fe24a730420ec692367e4e108d4a0a6d617.tar.gz gentoo-75a72fe24a730420ec692367e4e108d4a0a6d617.tar.bz2 gentoo-75a72fe24a730420ec692367e4e108d4a0a6d617.zip |
kde-apps/okular: Fix path traversal issue when extracting .okular file
With a specially crafted .okular files it was possible to trick okular
to create temporary files outside the temporary folder.
Bug: https://bugs.gentoo.org/665662
KDE-Bug: https://bugs.kde.org/show_bug.cgi?id=398096
See also: https://phabricator.kde.org/D15192
Package-Manager: Portage-2.3.49, Repoman-2.3.10
Diffstat (limited to 'kde-apps/okular/files')
-rw-r--r-- | kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch | 46 |
1 files changed, 46 insertions, 0 deletions
diff --git a/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch b/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch new file mode 100644 index 000000000000..216f235d8646 --- /dev/null +++ b/kde-apps/okular/files/okular-18.04.3-path-traversal-issue.patch @@ -0,0 +1,46 @@ +From 8ff7abc14d41906ad978b6bc67e69693863b9d47 Mon Sep 17 00:00:00 2001 +From: Albert Astals Cid <aacid@kde.org> +Date: Mon, 3 Sep 2018 21:14:30 +0200 +Subject: Fix path traversal issue when extracting an .okular file + +Summary: +With specially crafted .okular files you can trick okular to create temporary files outside the temporary folder + +We fix that by making sure the file doesn't have folders since the ones we create don't + +BUGS: 398096 + +Subscribers: okular-devel + +Tags: #okular + +Differential Revision: https://phabricator.kde.org/D15192 +--- + core/document.cpp | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/core/document.cpp b/core/document.cpp +index 5e3c169..7d46173 100644 +--- a/core/document.cpp ++++ b/core/document.cpp +@@ -4819,6 +4819,18 @@ ArchiveData *DocumentPrivate::unpackDocumentArchive( const QString &archivePath + return nullptr; + + const KArchiveDirectory * mainDir = okularArchive.directory(); ++ ++ // Check the archive doesn't have folders, we don't create them when saving the archive ++ // and folders mean paths and paths mean path traversal issues ++ for ( const QString &entry : mainDir->entries() ) ++ { ++ if ( mainDir->entry( entry )->isDirectory() ) ++ { ++ qWarning() << "Warning: Found a directory inside" << archivePath << " - Okular does not create files like that so it is most probably forged."; ++ return nullptr; ++ } ++ } ++ + const KArchiveEntry * mainEntry = mainDir->entry( QStringLiteral("content.xml") ); + if ( !mainEntry || !mainEntry->isFile() ) + return nullptr; +-- +cgit v0.11.2 |