Skip Menu |

This queue is for tickets about the Archive-Zip CPAN distribution.

Report information
The Basics
Id: 126905
Status: open
Priority: 0/
Queue: Archive-Zip
People
Owner: Nobody in particular
Requestors: SREZIC [...] cpan.org
Cc:
AdminCc:
Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)

History Show all quoted text
  Mon Aug 20 01:29:15 2018 SREZIC [...] cpan.org - Ticket created
Subject: t/25_traversal.t fails on FreeBSD systems (1.62)
On my FreeBSD smokers the test suite fails: ... # Failed test 'Tree extraction aborted' # at t/25_traversal.t line 54. # got: '0' # expected: '2' # Failed test 'A file was not created in a symlinked directory' # at t/25_traversal.t line 57. # Failed test 'link-dir removed' # at t/25_traversal.t line 60. # Failed test 'A symlink to a directory created' # at t/25_traversal.t line 65. # Failed test 'Member extraction without a local name aborted' # at t/25_traversal.t line 69. # got: '0' # expected: '2' # Failed test 'A symlink to a directory removed' # at t/25_traversal.t line 82. # Failed test 'Tree extraction aborted' # at t/25_traversal.t line 141. # got: '0' # expected: '2' # Looks like you failed 7 tests of 41. t/25_traversal.t .............. Dubious, test returned 7 (wstat 1792, 0x700) Failed 7/41 subtests (less 1 skipped subtest: 33 okay) ... Looking at http://matrix.cpantesters.org/?dist=Archive-Zip%201.62 it seems that also other BSD systems (dragonfly, netbsd ...) are affected.
  Mon Aug 20 17:56:49 2018 devans [...] macports.org - Correspondence added
On Mon Aug 20 01:29:15 2018, SREZIC wrote: Show quoted text
> On my FreeBSD smokers the test suite fails: > > ... > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 54. > # got: '0' > # expected: '2' > > # Failed test 'A file was not created in a symlinked directory' > # at t/25_traversal.t line 57. > > # Failed test 'link-dir removed' > # at t/25_traversal.t line 60. > > # Failed test 'A symlink to a directory created' > # at t/25_traversal.t line 65. > > # Failed test 'Member extraction without a local name aborted' > # at t/25_traversal.t line 69. > # got: '0' > # expected: '2' > > # Failed test 'A symlink to a directory removed' > # at t/25_traversal.t line 82. > > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 141. > # got: '0' > # expected: '2' > # Looks like you failed 7 tests of 41. > t/25_traversal.t .............. > Dubious, test returned 7 (wstat 1792, 0x700) > Failed 7/41 subtests > (less 1 skipped subtest: 33 okay) > ... > > > Looking at http://matrix.cpantesters.org/?dist=Archive-Zip%201.62 it > seems that also other BSD systems (dragonfly, netbsd ...) are > affected.
Same results observed on darwin: macOS HighSierra version 10.13.6 (17G65) Xcode 9.4.1 Build 9F2000 Apple LLVM version 9.1.0 (clang-902.0.39.2)
  Mon Aug 20 17:56:50 2018 The RT System itself - Status changed from 'new' to 'open'
  Tue Aug 21 15:28:06 2018 jkeenan [...] cpan.org - Correspondence added
On Mon Aug 20 01:29:15 2018, SREZIC wrote: Show quoted text
> On my FreeBSD smokers the test suite fails: > > ... > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 54. > # got: '0' > # expected: '2' > > # Failed test 'A file was not created in a symlinked directory' > # at t/25_traversal.t line 57. > > # Failed test 'link-dir removed' > # at t/25_traversal.t line 60. > > # Failed test 'A symlink to a directory created' > # at t/25_traversal.t line 65. > > # Failed test 'Member extraction without a local name aborted' > # at t/25_traversal.t line 69. > # got: '0' > # expected: '2' > > # Failed test 'A symlink to a directory removed' > # at t/25_traversal.t line 82. > > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 141. > # got: '0' > # expected: '2' > # Looks like you failed 7 tests of 41. > t/25_traversal.t .............. > Dubious, test returned 7 (wstat 1792, 0x700) > Failed 7/41 subtests > (less 1 skipped subtest: 33 okay) > ... > > > Looking at http://matrix.cpantesters.org/?dist=Archive-Zip%201.62 it > seems that also other BSD systems (dragonfly, netbsd ...) are > affected.
Same results on FreeBSD-11.1: ##### [analysis] $ ~/bin/perl/dumpjson PHRED.Archive-Zip-1.62.log.json { author => "PHRED", dist => "Archive-Zip", distname => "Archive-Zip-1.62", distversion => 1.62, grade => "FAIL", prereqs => undef, test_output => [ "Building and testing Archive-Zip-1.62", "cp lib/Archive/Zip/ZipFileMember.pm blib/lib/Archive/Zip/ZipFileMember.pm", "cp lib/Archive/Zip/Tree.pm blib/lib/Archive/Zip/Tree.pm", "cp lib/Archive/Zip/Member.pm blib/lib/Archive/Zip/Member.pm", "cp lib/Archive/Zip/MockFileHandle.pm blib/lib/Archive/Zip/MockFileHandle.pm", "cp lib/Archive/Zip/FAQ.pod blib/lib/Archive/Zip/FAQ.pod", "cp lib/Archive/Zip/Archive.pm blib/lib/Archive/Zip/Archive.pm", "cp lib/Archive/Zip/NewFileMember.pm blib/lib/Archive/Zip/NewFileMember.pm", "cp lib/Archive/Zip/StringMember.pm blib/lib/Archive/Zip/StringMember.pm", "cp lib/Archive/Zip/BufferedFileHandle.pm blib/lib/Archive/Zip/BufferedFileHandle.pm", "cp lib/Archive/Zip/DirectoryMember.pm blib/lib/Archive/Zip/DirectoryMember.pm", "cp lib/Archive/Zip/MemberRead.pm blib/lib/Archive/Zip/MemberRead.pm", "cp lib/Archive/Zip.pm blib/lib/Archive/Zip.pm", "cp lib/Archive/Zip/FileMember.pm blib/lib/Archive/Zip/FileMember.pm", "cp script/crc32 blib/script/crc32", "\"/usr/home/jkeenan/var/tad/testing/perl-5.29.2/bin/perl\" -MExtUtils::MY -e 'MY->fixin(shift)' -- blib/script/crc32", "PERL_DL_NONLAZY=1 \"/usr/home/jkeenan/var/tad/testing/perl-5.29.2/bin/perl\" \"-MExtUtils::Command::MM\" \"-MTest::Harness\" \"-e\" \"undef *Test::Harness::Switches; test_harness(0, 'blib/lib', 'blib/arch')\" t/*.t", "t/01_compile.t ................ ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/02_main.t ................... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "Invalid option(s): untaint_pat at /home/jkeenan/var/tad/testing/perl-5.29.2/lib/5.29.2/File/Find.pm line 735.", "t/03_ex.t ..................... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/04_readmember.t ............. ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "Invalid option(s): untaint_pat at /home/jkeenan/var/tad/testing/perl-5.29.2/lib/5.29.2/File/Find.pm line 735.", "Invalid option(s): untaint_pat at /home/jkeenan/var/tad/testing/perl-5.29.2/lib/5.29.2/File/Find.pm line 735.", "Invalid option(s): untaint_pat at /home/jkeenan/var/tad/testing/perl-5.29.2/lib/5.29.2/File/Find.pm line 735.", "t/05_tree.t ................... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/06_update.t ................. ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "Invalid option(s): untaint_pat at /home/jkeenan/var/tad/testing/perl-5.29.2/lib/5.29.2/File/Find.pm line 735.", "t/07_filenames_of_0.t ......... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/08_readmember_record_sep.t .. ok", "t/09_output_record_sep.t ...... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/10_chmod.t .................. ok", "t/11_explorer.t ............... ok", "t/12_bug_47223.t .............. skipped: Only required on Win32.", "t/13_bug_46303.t .............. ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/14_leading_separator.t ...... ok", "t/15_decrypt.t ................ ok", "t/16_decrypt.t ................ ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/17_101092.t ................. ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/18_bug_92205.t .............. ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/19_bug_101240.t ............. ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/20_bug_github11.t ........... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/21_zip64.t .................. ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "t/22_deflated_dir.t ........... ok", "t/23_closed_handle.t .......... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "Invalid option(s): untaint_pat at /home/jkeenan/var/tad/testing/perl-5.29.2/lib/5.29.2/File/Find.pm line 735.", "t/24_unicode_win32.t .......... ok", "warning: unzip -t doesn't seem to work, may skip some tests at t/common.pm line 223.", "", "# Failed test 'Tree extraction aborted'", "# at t/25_traversal.t line 54.", "# got: '0'", "# expected: '2'", "", "# Failed test 'A file was not created in a symlinked directory'", "# at t/25_traversal.t line 57.", "", "# Failed test 'link-dir removed'", "# at t/25_traversal.t line 60.", "", "# Failed test 'A symlink to a directory created'", "# at t/25_traversal.t line 65.", "", "# Failed test 'Member extraction without a local name aborted'", "# at t/25_traversal.t line 69.", "# got: '0'", "# expected: '2'", "", "# Failed test 'A symlink to a directory removed'", "# at t/25_traversal.t line 82.", "", "# Failed test 'Tree extraction aborted'", "# at t/25_traversal.t line 141.", "# got: '0'", "# expected: '2'", "# Looks like you failed 7 tests of 41.", "t/25_traversal.t .............. ", "Dubious, test returned 7 (wstat 1792, 0x700)", "Failed 7/41 subtests ", "\t(less 1 skipped subtest: 33 okay)", "", "Test Summary Report", "-------------------", "t/25_traversal.t (Wstat: 1792 Tests: 41 Failed: 7)", " Failed tests: 4-8, 13, 26", " Non-zero exit status: 7", "Files=25, Tests=345, 5 wallclock secs ( 0.07 usr 0.06 sys + 3.60 cusr 1.29 csys = 5.02 CPU)", "Result: FAIL", ], via => "App::cpanminus::reporter 0.17 (1.7044)", } #####
  Tue Aug 21 16:50:40 2018 jkeenan [...] cpan.org - Correspondence added
On Mon Aug 20 01:29:15 2018, SREZIC wrote: Show quoted text
> On my FreeBSD smokers the test suite fails: > > ... > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 54. > # got: '0' > # expected: '2' > > # Failed test 'A file was not created in a symlinked directory' > # at t/25_traversal.t line 57. > > # Failed test 'link-dir removed' > # at t/25_traversal.t line 60. > > # Failed test 'A symlink to a directory created' > # at t/25_traversal.t line 65. > > # Failed test 'Member extraction without a local name aborted' > # at t/25_traversal.t line 69. > # got: '0' > # expected: '2' > > # Failed test 'A symlink to a directory removed' > # at t/25_traversal.t line 82. > > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 141. > # got: '0' > # expected: '2' > # Looks like you failed 7 tests of 41. > t/25_traversal.t .............. > Dubious, test returned 7 (wstat 1792, 0x700) > Failed 7/41 subtests > (less 1 skipped subtest: 33 okay) > ... > > > Looking at http://matrix.cpantesters.org/?dist=Archive-Zip%201.62 it > seems that also other BSD systems (dragonfly, netbsd ...) are > affected.
The file experiencing failures was added relatively recently and apparently in response to a security problem: ##### commit 5c79b9faae0f1dd67cc8288964c72c12e03884f8 (HEAD) Author: Petr P<C3><AD>sa<C5><99> <ppisar@redhat.com> AuthorDate: Fri Jun 15 12:49:47 2018 Commit: Petr P<C3><AD>sa<C5><99> <ppisar@redhat.com> CommitDate: Thu Jun 28 10:40:18 2018 Prevent from traversing symlinks and parent directories when extracting If an attacker-supplied archive contains symbolic links and files that referes to the symbolic links in their path components, the user can be tricked into overwriting any arbitrary file. The same issue is with archives whose members refer to a parent directory (..) in their path components. This patch fixes it by aborting an extraction (extractTree(), extractMember(), extractMemberWithoutPaths()) in those cases by not traversing the dangerous paths and returning AZ_ERORR instead. However, if a user supplies a local file name, the security checks are not performed. This is based on the assumption that a user knows what's on his local file system. CVE-2018-10860 https://bugzilla.redhat.com/show_bug.cgi?id=1591449 ##### I get test failures on FreeBSD-11.1 at that commit point. Since the contributor is the RedHat maintainer for Perl, I assume the file is absolutely appropriate for Linux -- but perhaps it's not quite right for non-Linux Unixes and other OSes. Thank you very much. Jim Keenan
  Tue Aug 21 17:45:06 2018 SREZIC [...] cpan.org - Correspondence added
On 2018-08-20 01:29:15, SREZIC wrote: Show quoted text
> On my FreeBSD smokers the test suite fails: > > ... > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 54. > # got: '0' > # expected: '2' > > # Failed test 'A file was not created in a symlinked directory' > # at t/25_traversal.t line 57. > > # Failed test 'link-dir removed' > # at t/25_traversal.t line 60. > > # Failed test 'A symlink to a directory created' > # at t/25_traversal.t line 65. > > # Failed test 'Member extraction without a local name aborted' > # at t/25_traversal.t line 69. > # got: '0' > # expected: '2' > > # Failed test 'A symlink to a directory removed' > # at t/25_traversal.t line 82. > > # Failed test 'Tree extraction aborted' > # at t/25_traversal.t line 141. > # got: '0' > # expected: '2' > # Looks like you failed 7 tests of 41. > t/25_traversal.t .............. > Dubious, test returned 7 (wstat 1792, 0x700) > Failed 7/41 subtests > (less 1 skipped subtest: 33 okay) > ... > > > Looking at http://matrix.cpantesters.org/?dist=Archive-Zip%201.62 it > seems that also other BSD systems (dragonfly, netbsd ...) are > affected.
Tests pass on freebsd if the following patch is applied --- but of course a lot of OSes are missing here. Maybe do it the other way and create a negative list, i.e. list MSWin32 and maybe cygwin? diff --git a/lib/Archive/Zip/Member.pm b/lib/Archive/Zip/Member.pm index 599e6f2..e9fe8c4 100644 --- a/lib/Archive/Zip/Member.pm +++ b/lib/Archive/Zip/Member.pm @@ -1090,7 +1090,7 @@ sub _writeData { # If symbolic link, just create one if the operating system is Linux, Unix, BSD or VMS # TODO: Add checks for other operating systems - if ($self->{'isSymbolicLink'} == 1 && $^O eq 'linux') { + if ($self->{'isSymbolicLink'} == 1 && $^O =~ /^(linux|freebsd)$/) { my $chunkSize = $Archive::Zip::ChunkSize; my ($outRef, $status) = $self->readChunk($chunkSize); symlink $$outRef, $self->{'newName'};
  Tue Aug 21 22:20:09 2018 jkeenan [...] cpan.org - Correspondence added
On Tue Aug 21 16:50:40 2018, JKEENAN wrote: Show quoted text
> On Mon Aug 20 01:29:15 2018, SREZIC wrote:
> > On my FreeBSD smokers the test suite fails: > > > > ... > > # Failed test 'Tree extraction aborted' > > # at t/25_traversal.t line 54. > > # got: '0' > > # expected: '2' > > > > # Failed test 'A file was not created in a symlinked directory' > > # at t/25_traversal.t line 57. > > > > # Failed test 'link-dir removed' > > # at t/25_traversal.t line 60. > > > > # Failed test 'A symlink to a directory created' > > # at t/25_traversal.t line 65. > > > > # Failed test 'Member extraction without a local name aborted' > > # at t/25_traversal.t line 69. > > # got: '0' > > # expected: '2' > > > > # Failed test 'A symlink to a directory removed' > > # at t/25_traversal.t line 82. > > > > # Failed test 'Tree extraction aborted' > > # at t/25_traversal.t line 141. > > # got: '0' > > # expected: '2' > > # Looks like you failed 7 tests of 41. > > t/25_traversal.t .............. > > Dubious, test returned 7 (wstat 1792, 0x700) > > Failed 7/41 subtests > > (less 1 skipped subtest: 33 okay) > > ... > > > > > > Looking at http://matrix.cpantesters.org/?dist=Archive-Zip%201.62 it > > seems that also other BSD systems (dragonfly, netbsd ...) are > > affected.
> > The file experiencing failures was added relatively recently and > apparently in response to a security problem: > > ##### > commit 5c79b9faae0f1dd67cc8288964c72c12e03884f8 (HEAD) > Author: Petr P<C3><AD>sa<C5><99> <ppisar@redhat.com> > AuthorDate: Fri Jun 15 12:49:47 2018 > Commit: Petr P<C3><AD>sa<C5><99> <ppisar@redhat.com> > CommitDate: Thu Jun 28 10:40:18 2018 > > Prevent from traversing symlinks and parent directories when > extracting > > If an attacker-supplied archive contains symbolic links and files that > referes to the symbolic links in their path components, the user can > be tricked into overwriting any arbitrary file. > > The same issue is with archives whose members refer to a parent > directory (..) in their path components. > > This patch fixes it by aborting an extraction (extractTree(), > extractMember(), extractMemberWithoutPaths()) in those cases by not > traversing the dangerous paths and returning AZ_ERORR instead. > > However, if a user supplies a local file name, the security checks are > not performed. This is based on the assumption that a user knows > what's on his local file system. > > CVE-2018-10860 > https://bugzilla.redhat.com/show_bug.cgi?id=1591449 > ##### > > I get test failures on FreeBSD-11.1 at that commit point. > > Since the contributor is the RedHat maintainer for Perl, I assume the > file is absolutely appropriate for Linux -- but perhaps it's not quite > right for non-Linux Unixes and other OSes. > > Thank you very much. > Jim Keenan
I tried the pull request submitted by haarg here: https://github.com/redhotpenguin/perl-Archive-Zip/pull/38 It worked in both of the FreeBSD-11 environments where I was experiencing failures in t/25_traversal.t. Thank you very much. Jim Keenan