<pre style='margin:0'>
Zero King (l2dy) pushed a commit to branch master
in repository macports-ports.
</pre>
<p><a href="https://github.com/macports/macports-ports/commit/ced35b86a1115fb86f7ed62e0c9017433f3e6dbd">https://github.com/macports/macports-ports/commit/ced35b86a1115fb86f7ed62e0c9017433f3e6dbd</a></p>
<pre style="white-space: pre; background: #F8F8F8">The following commit(s) were added to refs/heads/master by this push:
<span style='display:block; white-space:pre;color:#404040;'> new ced35b8 ruby24: fix CVE-2017-0903
</span>ced35b8 is described below
<span style='display:block; white-space:pre;color:#808000;'>commit ced35b86a1115fb86f7ed62e0c9017433f3e6dbd
</span>Author: Zero King <l2dy@macports.org>
AuthorDate: Tue Oct 10 04:23:08 2017 +0000
<span style='display:block; white-space:pre;color:#404040;'> ruby24: fix CVE-2017-0903
</span>---
lang/ruby24/Portfile | 4 +-
lang/ruby24/files/patch-CVE-2017-0903.diff | 151 +++++++++++++++++++++++++++++
2 files changed, 154 insertions(+), 1 deletion(-)
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/lang/ruby24/Portfile b/lang/ruby24/Portfile
</span><span style='display:block; white-space:pre;color:#808080;'>index 1cd7318..6b32509 100644
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/lang/ruby24/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/lang/ruby24/Portfile
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -5,7 +5,7 @@ PortGroup select 1.0
</span>
name ruby24
version 2.4.2
<span style='display:block; white-space:pre;background:#ffe0e0;'>-revision 1
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+revision 2
</span>
categories lang ruby
maintainers kimuraw openmaintainer
<span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -31,6 +31,8 @@ dist_subdir ruby24
</span> # https://bugs.ruby-lang.org/issues/13899
patchfiles patch-configure.diff
<span style='display:block; white-space:pre;background:#e0ffe0;'>+patchfiles-append patch-CVE-2017-0903.diff
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span> checksums md5 5ff3ad6ec816bcce8806a55090936ab6 \
rmd160 0e44cf9b76d01be568049a634eba8a0959a69ff2 \
sha1 a8a50a9297ff656e5230bf0f945acd69cc02a097 \
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/lang/ruby24/files/patch-CVE-2017-0903.diff b/lang/ruby24/files/patch-CVE-2017-0903.diff
</span>new file mode 100644
<span style='display:block; white-space:pre;color:#808080;'>index 0000000..65f96cc
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>--- /dev/null
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/lang/ruby24/files/patch-CVE-2017-0903.diff
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -0,0 +1,151 @@
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+From 4e206183021b2463e25b2495d3986e9ccc3fb08e Mon Sep 17 00:00:00 2001
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+From: Aaron Patterson <aaron.patterson@gmail.com>
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+Date: Fri, 6 Oct 2017 11:11:40 -0700
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+Subject: [PATCH] Whitelist classes and symbols that are in Gem spec YAML
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+This patch adds a method for loading YAML specs from a gem and
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+whitelists classes and symbols that are allowed in the spec. Then it
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+changes calls to YAML.load to call the whitelisted "safe" loader
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+instead.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+[CVE-2017-0903]
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+---
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ lib/rubygems.rb | 3 ++-
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ lib/rubygems/config_file.rb | 2 +-
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ lib/rubygems/package.rb | 2 +-
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ lib/rubygems/package/old.rb | 2 +-
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ lib/rubygems/safe_yaml.rb | 48 +++++++++++++++++++++++++++++++++++++++++++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ lib/rubygems/specification.rb | 2 +-
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ 6 files changed, 54 insertions(+), 5 deletions(-)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ create mode 100644 lib/rubygems/safe_yaml.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+diff --git a/lib/rubygems.rb b/lib/rubygems.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+index d819bdee..ab004e8e 100644
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- lib/rubygems.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ lib/rubygems.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -690,7 +690,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ unless test_syck
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ begin
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+- gem 'psych', '>= 1.2.1'
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ gem 'psych', '>= 2.0.0'
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ rescue Gem::LoadError
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # It's OK if the user does not have the psych gem installed. We will
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # attempt to require the stdlib version
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -714,6 +714,7 @@ An Array (#{env.inspect}) was passed in from #{caller[3]}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ require 'yaml'
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ require 'rubygems/safe_yaml'
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # If we're supposed to be using syck, then we may have to force
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # activate it via the YAML::ENGINE API.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+diff --git a/lib/rubygems/config_file.rb b/lib/rubygems/config_file.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+index b98d30cc..a4efed0f 100644
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- lib/rubygems/config_file.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ lib/rubygems/config_file.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -354,7 +354,7 @@ if you believe they were disclosed to a third party.
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ return {} unless filename and File.exist? filename
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ begin
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+- content = YAML.load(File.read(filename))
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ content = Gem::SafeYAML.load(File.read(filename))
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ unless content.kind_of? Hash
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ warn "Failed to load #{filename} because it doesn't contain valid YAML hash"
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ return {}
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+index c36e71d8..77811ed5 100644
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- lib/rubygems/package.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ lib/rubygems/package.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -468,7 +468,7 @@ EOM
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ @checksums = gem.seek 'checksums.yaml.gz' do |entry|
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ Zlib::GzipReader.wrap entry do |gz_io|
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+- YAML.load gz_io.read
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::SafeYAML.safe_load gz_io.read
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+diff --git a/lib/rubygems/package/old.rb b/lib/rubygems/package/old.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+index 88193b98..f6e6e67c 100644
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- lib/rubygems/package/old.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ lib/rubygems/package/old.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -101,7 +101,7 @@ class Gem::Package::Old < Gem::Package
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ header << line
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+- YAML.load header
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::SafeYAML.safe_load header
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ ##
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+diff --git a/lib/rubygems/safe_yaml.rb b/lib/rubygems/safe_yaml.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+new file mode 100644
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+index 00000000..b98cfaa5
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- /dev/null
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ lib/rubygems/safe_yaml.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -0,0 +1,48 @@
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++module Gem
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ ###
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ # This module is used for safely loading YAML specs from a gem. The
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ # `safe_load` method defined on this module is specifically designed for
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ # loading Gem specifications. For loading other YAML safely, please see
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ # Psych.safe_load
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ module SafeYAML
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ WHITELISTED_CLASSES = %w(
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Symbol
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Time
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Date
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::Dependency
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::Platform
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::Requirement
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::Specification
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::Version
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Gem::Version::Requirement
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ YAML::Syck::DefaultKey
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ Syck::DefaultKey
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ )
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ WHITELISTED_SYMBOLS = %w(
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ development
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ runtime
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ )
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ if ::YAML.respond_to? :safe_load
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ def self.safe_load input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ ::YAML.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true)
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ def self.load input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ ::YAML.safe_load(input, [::Symbol])
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ else
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ warn "YAML safe loading is not available. Please upgrade psych to a version that supports safe loading (>= 2.0)."
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ def self.safe_load input, *args
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ ::YAML.load input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ def self.load input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ ::YAML.load input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++end
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+index a23ffa22..2d71d184 100644
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--- lib/rubygems/specification.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++++ lib/rubygems/specification.rb
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+@@ -1124,7 +1124,7 @@ class Gem::Specification < Gem::BasicSpecification
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ Gem.load_yaml
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ input = normalize_yaml_input input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+- spec = YAML.load input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>++ spec = Gem::SafeYAML.safe_load input
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if spec && spec.class == FalseClass then
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ raise Gem::EndOfYAMLException
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+--
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+2.11.0
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+
</span></pre><pre style='margin:0'>
</pre>