Blame SOURCES/BZ-1600618-reposync-prevent-path-traversal.patch

085af2
diff -up yum-utils-1.1.31/docs/reposync.1.orig yum-utils-1.1.31/docs/reposync.1
085af2
--- yum-utils-1.1.31/docs/reposync.1.orig	2018-07-20 11:01:16.789747160 +0200
085af2
+++ yum-utils-1.1.31/docs/reposync.1	2018-07-20 11:01:21.765700655 +0200
085af2
@@ -47,6 +47,16 @@ Download all the non-default metadata.
085af2
 Download only newest packages per-repo.
085af2
 .IP "\fB\-q, \-\-quiet\fP"
085af2
 Output as little information as possible.
085af2
+.IP "\fB\-\-allow-path-traversal\fP"
085af2
+Allow packages stored outside their repo directory to be synced.
085af2
+These are packages that are referenced in metadata by using absolute paths or
085af2
+up-level ".." symbols, and are normally skipped by \fBreposync\fR for security
085af2
+reasons.
085af2
+
085af2
+\fBCAUTION:\fR Using this option has potential security implications since, by
085af2
+providing malicious repodata, an attacker could make \fBreposync\fR write to
085af2
+arbitrary locations on the file system that are accessible by the user running
085af2
+it.
085af2
 .SH "EXAMPLES"
085af2
 .IP "Sync all packages from the 'updates' repo to the current directory:"
085af2
 \fB reposync \-\-repoid=updates\fP
085af2
diff -up yum-utils-1.1.31/reposync.py.orig yum-utils-1.1.31/reposync.py
085af2
--- yum-utils-1.1.31/reposync.py.orig	2018-07-20 11:01:16.752747506 +0200
085af2
+++ yum-utils-1.1.31/reposync.py	2018-07-20 11:01:54.717392693 +0200
085af2
@@ -84,6 +84,12 @@ def localpkgs(directory):
085af2
             cache[name] = { 'path': fn, 'size': st.st_size, 'device': st.st_dev }
085af2
     return cache
085af2
 
085af2
+def is_subpath(path, root):
085af2
+    root = os.path.realpath(root)
085af2
+    path = os.path.realpath(os.path.join(root, path))
085af2
+    # join() is used below to ensure root ends with a slash
085af2
+    return path.startswith(os.path.join(root, ''))
085af2
+
085af2
 def parseArgs():
085af2
     usage = """
085af2
     Reposync is used to synchronize a remote yum repository to a local 
085af2
@@ -126,6 +132,10 @@ def parseArgs():
085af2
     parser.add_option("","--download-metadata", dest="downloadmd", 
085af2
         default=False, action="store_true", 
085af2
         help="download all the non-default metadata")
085af2
+    parser.add_option("", "--allow-path-traversal", default=False,
085af2
+        action="store_true",
085af2
+        help="Allow packages stored outside their repo directory to be synced "
085af2
+             "(UNSAFE, USE WITH CAUTION!)")
085af2
     (opts, args) = parser.parse_args()
085af2
     return (opts, args)
085af2
 
085af2
@@ -226,13 +236,36 @@ def main():
085af2
         else:
085af2
             local_repo_path = opts.destdir + '/' + repo.id
085af2
 
085af2
+        # Ensure we don't traverse out of local_repo_path by dropping any
085af2
+        # packages whose remote_path is absolute or contains up-level
085af2
+        # references (unless explicitly allowed).
085af2
+        # See RHBZ#1600221 for details.
085af2
+        if not opts.allow_path_traversal:
085af2
+            newlist = []
085af2
+            skipped = False
085af2
+            for pkg in download_list:
085af2
+                if is_subpath(pkg.remote_path, local_repo_path):
085af2
+                    newlist.append(pkg)
085af2
+                    continue
085af2
+                my.logger.warning(
085af2
+                    'WARNING: skipping package %s: remote path "%s" not '
085af2
+                    'within repodir, unsafe to mirror locally'
085af2
+                    % (pkg, pkg.remote_path)
085af2
+                )
085af2
+                skipped = True
085af2
+            if skipped:
085af2
+                my.logger.info(
085af2
+                    'You can enable unsafe remote paths by using '
085af2
+                    '--allow-path-traversal (see reposync(1) for details)'
085af2
+                )
085af2
+            download_list = newlist
085af2
+
085af2
         if opts.delete and os.path.exists(local_repo_path):
085af2
             current_pkgs = localpkgs(local_repo_path)
085af2
 
085af2
             download_set = {}
085af2
             for pkg in download_list:
085af2
-                remote = pkg.returnSimple('relativepath')
085af2
-                rpmname = os.path.basename(remote)
085af2
+                rpmname = os.path.basename(pkg.remote_path)
085af2
                 download_set[rpmname] = 1
085af2
 
085af2
             for pkg in current_pkgs:
085af2
@@ -280,8 +313,7 @@ def main():
085af2
         local_size  = 0
085af2
         if not opts.urls:
085af2
             for pkg in download_list:
085af2
-                remote = pkg.returnSimple('relativepath')
085af2
-                local = local_repo_path + '/' + remote
085af2
+                local = os.path.join(local_repo_path, pkg.remote_path)
085af2
                 sz = int(pkg.returnSimple('packagesize'))
085af2
                 if os.path.exists(local) and os.path.getsize(local) == sz:
085af2
                     continue
085af2
@@ -293,10 +325,9 @@ def main():
085af2
         download_list.sort(sortPkgObj)
085af2
         if opts.urls:
085af2
             for pkg in download_list:
085af2
-                remote = pkg.returnSimple('relativepath')
085af2
-                local = os.path.join(local_repo_path, remote)
085af2
+                local = os.path.join(local_repo_path, pkg.remote_path)
085af2
                 if not (os.path.exists(local) and my.verifyPkg(local, pkg, False)):
085af2
-                    print urljoin(pkg.repo.urls[0], pkg.relativepath)
085af2
+                    print urljoin(pkg.repo.urls[0], pkg.remote_path)
085af2
             continue
085af2
 
085af2
         # create dest dir
085af2
@@ -305,8 +336,7 @@ def main():
085af2
 
085af2
         # set localpaths
085af2
         for pkg in download_list:
085af2
-            rpmfn = pkg.remote_path
085af2
-            pkg.localpath = os.path.join(local_repo_path, rpmfn)
085af2
+            pkg.localpath = os.path.join(local_repo_path, pkg.remote_path)
085af2
             pkg.repo.copy_local = True
085af2
             pkg.repo.cache = 0
085af2
             localdir = os.path.dirname(pkg.localpath)