Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Only attempt extraction if a known payload compressor is used. #15

Merged
merged 1 commit into from Sep 17, 2022
Merged

Only attempt extraction if a known payload compressor is used. #15

merged 1 commit into from Sep 17, 2022

Commits on Sep 17, 2022

  1. Only attempt extraction if a known payload compressor is used. 

    This change is to improve safety primarily to reject malicious rpms
with a custom PAYLOADCOMPRESSOR tag causing arr-pm to execute arbitrary
code.

The security issue was reported by Joern Schneeweisz.

An alternate implementation could be to do what rpm does in its rpmio
library which is to use the C implementations of various compressor
libraries. However, doing this in Ruby can cause problems because it's
not always possible to compile C Ruby extensions or even install Ruby's
FFI library.

Test coverage checks for accepting known payload compressors and also
rejecting unknown compressor values.

Context: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/97602
    @jordansissel
    jordansissel committed Sep 17, 2022
    Copy the full SHA
    6ceb0a7 View commit details
    Browse the repository at this point in the history