[devscripts] 05/09: uscan: Follow tar's recommended security practices

[James McCoy]

This is an automated email from the git hooks/post-receive script.

jamessan pushed a commit to branch master
in repository devscripts.

commit 4b7e58ee6000cdefac0682601cec6ecce0137467
Author: James McCoy <jamessan at debian.org>
Date:   Wed Dec 18 22:09:55 2013 -0500

    uscan: Follow tar's recommended security practices
    
    Signed-off-by: James McCoy <jamessan at debian.org>
---
 debian/changelog |  4 ++++
 scripts/uscan.pl | 12 +++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/debian/changelog b/debian/changelog
index d5805a3..b08d913 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -10,6 +10,10 @@ devscripts (2.13.9) UNRELEASED; urgency=low
       allowing arbitrary code execution.  Fixes CVE-2013-6888.
     + Use find's -exec to call rm directly instead of piping to xargs.
       (Closes: #732006, CVE-2013-7085)
+    + Follow tar's recommended security practices
+      - Use --keep-old-files --no-overwrite-dir
+      - Ensure parent directory of directory used for repacking archive isn't
+        accessible to other users.
 
  -- Martin Pitt <mpitt at debian.org>  Thu, 12 Dec 2013 11:08:27 +0100
 
diff --git a/scripts/uscan.pl b/scripts/uscan.pl
index 953783c..a8cc7ad 100755
--- a/scripts/uscan.pl
+++ b/scripts/uscan.pl
@@ -1466,7 +1466,10 @@ EOF
 	  or uscan_die("unzip binary not found. You need to install the package unzip to be able to repack .zip upstream archives.\n");
 
 	my $newfile_base_gz = "$1.tar.gz";
-	my $tempdir = tempdir ( "uscanXXXX", TMPDIR => 1, CLEANUP => 1 );
+	my $tempdir = tempdir ("uscanXXXX", TMPDIR => 1, CLEANUP => 1);
+	# Parent of the target directory should be under our control
+	$tempdir .= '/repack';
+	mkdir $tempdir or uscan_die("Unable to mkdir($tempdir): $!\n");
 	my $absdestdir = abs_path($destdir);
 	system('unzip', '-q', '-a', '-d', $tempdir, "$destdir/$newfile_base") == 0
 	    or uscan_die("Repacking from zip or jar to tar.gz failed (could not unzip)\n");
@@ -1512,10 +1515,13 @@ EOF
 	  undef $data;
 	};
 	if ($data && $data->{'format'} =~ m{^$okformat/?$} && $data->{'files-excluded'} ) {
-	    my $tempdir = tempdir ( "uscanXXXX", TMPDIR => 1, CLEANUP => 1 );
+	    my $tempdir = tempdir ("uscanXXXX", TMPDIR => 1, CLEANUP => 1);
+	    # Parent of the target directory should be under our control
+	    $tempdir .= '/repack';
+	    mkdir $tempdir or uscan_die("Unable to mkdir($tempdir): $!\n");
 	    my $absdestdir = abs_path($destdir);
 	    eval {
-		spawn(exec => ['tar', '-xa', '-C', $tempdir, '-f', "$absdestdir/$newfile_base"],
+		spawn(exec => ['tar', '-xa', '-k', '--no-overwrite-dir', '-C', $tempdir, '-f', "$absdestdir/$newfile_base"],
 		      wait_child => 1);
 	    };
 	    if ($@) {

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/collab-maint/devscripts.git