diff options
| author | Hiroshi SHIBATA <[email protected]> | 2024-03-21 16:12:38 +0900 |
|---|---|---|
| committer | GitHub <[email protected]> | 2024-03-21 07:12:38 +0000 |
| commit | eb7cb164cffc86b63d2e2528c73e160c33b7a2e5 (patch) | |
| tree | 6b1212cc88dce1d9575bac66f0470b8e63f98b5e /lib/rdoc | |
| parent | f79b1d1ef1f7aa64d20f0eadbb3b0f8f7084deb3 (diff) | |
CVE-2024-27281 for Ruby 3.3 (#10316)
Merge RDoc-6.6.3.1
Diffstat (limited to 'lib/rdoc')
| -rw-r--r-- | lib/rdoc/store.rb | 45 | ||||
| -rw-r--r-- | lib/rdoc/version.rb | 2 |
2 files changed, 27 insertions, 20 deletions
diff --git a/lib/rdoc/store.rb b/lib/rdoc/store.rb index fe749edc1c..cd27d47dd1 100644 --- a/lib/rdoc/store.rb +++ b/lib/rdoc/store.rb @@ -559,9 +559,7 @@ class RDoc::Store def load_cache #orig_enc = @encoding - File.open cache_path, 'rb' do |io| - @cache = Marshal.load io - end + @cache = marshal_load(cache_path) load_enc = @cache[:encoding] @@ -618,9 +616,7 @@ class RDoc::Store def load_class_data klass_name file = class_file klass_name - File.open file, 'rb' do |io| - Marshal.load io - end + marshal_load(file) rescue Errno::ENOENT => e error = MissingFileError.new(self, file, klass_name) error.set_backtrace e.backtrace @@ -633,14 +629,10 @@ class RDoc::Store def load_method klass_name, method_name file = method_file klass_name, method_name - File.open file, 'rb' do |io| - obj = Marshal.load io - obj.store = self - obj.parent = - find_class_or_module(klass_name) || load_class(klass_name) unless - obj.parent - obj - end + obj = marshal_load(file) + obj.store = self + obj.parent ||= find_class_or_module(klass_name) || load_class(klass_name) + obj rescue Errno::ENOENT => e error = MissingFileError.new(self, file, klass_name + method_name) error.set_backtrace e.backtrace @@ -653,11 +645,9 @@ class RDoc::Store def load_page page_name file = page_file page_name - File.open file, 'rb' do |io| - obj = Marshal.load io - obj.store = self - obj - end + obj = marshal_load(file) + obj.store = self + obj rescue Errno::ENOENT => e error = MissingFileError.new(self, file, page_name) error.set_backtrace e.backtrace @@ -979,4 +969,21 @@ class RDoc::Store @unique_modules end + private + def marshal_load(file) + File.open(file, 'rb') {|io| Marshal.load(io, MarshalFilter)} + end + + MarshalFilter = proc do |obj| + case obj + when true, false, nil, Array, Class, Encoding, Hash, Integer, String, Symbol, RDoc::Text + else + unless obj.class.name.start_with?("RDoc::") + raise TypeError, "not permitted class: #{obj.class.name}" + end + end + obj + end + private_constant :MarshalFilter + end diff --git a/lib/rdoc/version.rb b/lib/rdoc/version.rb index 04dfaebf74..87842d9847 100644 --- a/lib/rdoc/version.rb +++ b/lib/rdoc/version.rb @@ -5,6 +5,6 @@ module RDoc ## # RDoc version you are using - VERSION = '6.6.2' + VERSION = '6.6.3.1' end |