Skip to content

Commit 1729e75

Browse files
CBL-Mariner-Botxorduxjslobodzianrikenm1
authored
[AUTO-CHERRYPICK] Patch Reaper for multiple CVEs - branch main (#10735)
Co-authored-by: Rohit Rawat <[email protected]> Co-authored-by: jslobodzian <[email protected]> Co-authored-by: Riken Maharjan <[email protected]>
1 parent b958bee commit 1729e75

File tree

6 files changed

+398
-3
lines changed

6 files changed

+398
-3
lines changed

SPECS/reaper/CVE-2024-43799.patch

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
From 6309d1f68103ef27c565cf58ab03f9ed32ff631c Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Thu, 10 Oct 2024 13:44:09 +0000
4+
Subject: [PATCH] CVE-2024-43799
5+
6+
from: https://github.com/pillarjs/send/commit/ae4f2989491b392ae2ef3b0015a019770ae65d35
7+
---
8+
send/index.js | 3 +--
9+
1 file changed, 1 insertion(+), 2 deletions(-)
10+
11+
diff --git a/src/ui/node_modules/send/index.js b/src/ui/node_modules/send/index.js
12+
index 89afd7e5..768f8ca6 100644
13+
--- a/src/ui/node_modules/send/index.js
14+
+++ b/src/ui/node_modules/send/index.js
15+
@@ -482,8 +482,7 @@ SendStream.prototype.redirect = function redirect (path) {
16+
}
17+
18+
var loc = encodeUrl(collapseLeadingSlashes(this.path + '/'))
19+
- var doc = createHtmlDocument('Redirecting', 'Redirecting to <a href="' + escapeHtml(loc) + '">' +
20+
- escapeHtml(loc) + '</a>')
21+
+ var doc = createHtmlDocument('Redirecting', 'Redirecting to ' + escapeHtml(loc))
22+
23+
// redirect
24+
res.statusCode = 301
25+
--
26+
2.39.4
27+

SPECS/reaper/CVE-2024-43800.patch

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From cb67c9a152a1e2d8ffb3a74c504d4c9a845bf4dc Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Mon, 14 Oct 2024 07:18:16 +0000
4+
Subject: [PATCH] serve-static don't pass untrusted user input
5+
6+
---
7+
serve-static/index.js | 3 +--
8+
1 file changed, 1 insertion(+), 2 deletions(-)
9+
10+
diff --git a/src/ui/node_modules/serve-static/index.js b/src/ui/node_modules/serve-static/index.js
11+
index b7d3984c..3f3e64e9 100644
12+
--- a/src/ui/node_modules/serve-static/index.js
13+
+++ b/src/ui/node_modules/serve-static/index.js
14+
@@ -195,8 +195,7 @@ function createRedirectDirectoryListener () {
15+
16+
// reformat the URL
17+
var loc = encodeUrl(url.format(originalUrl))
18+
- var doc = createHtmlDocument('Redirecting', 'Redirecting to <a href="' + escapeHtml(loc) + '">' +
19+
- escapeHtml(loc) + '</a>')
20+
+ var doc = createHtmlDocument('Redirecting', 'Redirecting to ' + escapeHtml(loc))
21+
22+
// send redirect response
23+
res.statusCode = 301
24+
--
25+
2.39.4
26+

SPECS/reaper/CVE-2024-45296.patch

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,190 @@
1+
From 6f1351c1c631d01ced7d2461c5eeee4552865306 Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Thu, 10 Oct 2024 12:14:51 +0000
4+
Subject: [PATCH] Upgrade path-to-regexp from 0.1.7 to 0.1.11
5+
6+
CVE-2024-45296 was fixed in https://github.com/pillarjs/path-to-regexp/pull/320
7+
which was released in version 0.1.11
8+
---
9+
path-to-regexp/index.js | 103 ++++++++++++++++++++++++----------------
10+
1 file changed, 62 insertions(+), 41 deletions(-)
11+
12+
diff --git a/src/ui/node_modules/path-to-regexp/index.js b/src/ui/node_modules/path-to-regexp/index.js
13+
index 500d1dad..39b7caac 100644
14+
--- a/src/ui/node_modules/path-to-regexp/index.js
15+
+++ b/src/ui/node_modules/path-to-regexp/index.js
16+
@@ -1,13 +1,13 @@
17+
/**
18+
- * Expose `pathtoRegexp`.
19+
+ * Expose `pathToRegexp`.
20+
*/
21+
22+
-module.exports = pathtoRegexp;
23+
+module.exports = pathToRegexp;
24+
25+
/**
26+
* Match matching groups in a regular expression.
27+
*/
28+
-var MATCHING_GROUP_REGEXP = /\((?!\?)/g;
29+
+var MATCHING_GROUP_REGEXP = /\\.|\((?:\?<(.*?)>)?(?!\?)/g;
30+
31+
/**
32+
* Normalize the given path string,
33+
@@ -25,22 +25,27 @@ var MATCHING_GROUP_REGEXP = /\((?!\?)/g;
34+
* @api private
35+
*/
36+
37+
-function pathtoRegexp(path, keys, options) {
38+
+function pathToRegexp(path, keys, options) {
39+
options = options || {};
40+
keys = keys || [];
41+
var strict = options.strict;
42+
var end = options.end !== false;
43+
var flags = options.sensitive ? '' : 'i';
44+
+ var lookahead = options.lookahead !== false;
45+
var extraOffset = 0;
46+
var keysOffset = keys.length;
47+
var i = 0;
48+
var name = 0;
49+
+ var pos = 0;
50+
+ var backtrack = '';
51+
var m;
52+
53+
if (path instanceof RegExp) {
54+
while (m = MATCHING_GROUP_REGEXP.exec(path.source)) {
55+
+ if (m[0][0] === '\\') continue;
56+
+
57+
keys.push({
58+
- name: name++,
59+
+ name: m[1] || name++,
60+
optional: false,
61+
offset: m.index
62+
});
63+
@@ -54,20 +59,51 @@ function pathtoRegexp(path, keys, options) {
64+
// the same keys and options instance into every generation to get
65+
// consistent matching groups before we join the sources together.
66+
path = path.map(function (value) {
67+
- return pathtoRegexp(value, keys, options).source;
68+
+ return pathToRegexp(value, keys, options).source;
69+
});
70+
71+
- return new RegExp('(?:' + path.join('|') + ')', flags);
72+
+ return new RegExp(path.join('|'), flags);
73+
+ }
74+
+
75+
+ if (typeof path !== 'string') {
76+
+ throw new TypeError('path must be a string, array of strings, or regular expression');
77+
}
78+
79+
- path = ('^' + path + (strict ? '' : path[path.length - 1] === '/' ? '?' : '/?'))
80+
- .replace(/\/\(/g, '/(?:')
81+
- .replace(/([\/\.])/g, '\\$1')
82+
- .replace(/(\\\/)?(\\\.)?:(\w+)(\(.*?\))?(\*)?(\?)?/g, function (match, slash, format, key, capture, star, optional, offset) {
83+
+ path = path.replace(
84+
+ /\\.|(\/)?(\.)?:(\w+)(\(.*?\))?(\*)?(\?)?|[.*]|\/\(/g,
85+
+ function (match, slash, format, key, capture, star, optional, offset) {
86+
+ pos = offset + match.length;
87+
+
88+
+ if (match[0] === '\\') {
89+
+ backtrack += match;
90+
+ return match;
91+
+ }
92+
+
93+
+ if (match === '.') {
94+
+ backtrack += '\\.';
95+
+ extraOffset += 1;
96+
+ return '\\.';
97+
+ }
98+
+
99+
+ backtrack = slash || format ? '' : path.slice(pos, offset);
100+
+
101+
+ if (match === '*') {
102+
+ extraOffset += 3;
103+
+ return '(.*)';
104+
+ }
105+
+
106+
+ if (match === '/(') {
107+
+ backtrack += '/';
108+
+ extraOffset += 2;
109+
+ return '/(?:';
110+
+ }
111+
+
112+
slash = slash || '';
113+
- format = format || '';
114+
- capture = capture || '([^\\/' + format + ']+?)';
115+
+ format = format ? '\\.' : '';
116+
optional = optional || '';
117+
+ capture = capture ?
118+
+ capture.replace(/\\.|\*/, function (m) { return m === '*' ? '(.*)' : m; }) :
119+
+ (backtrack ? '((?:(?!/|' + backtrack + ').)+?)' : '([^/' + format + ']+?)');
120+
121+
keys.push({
122+
name: key,
123+
@@ -75,41 +111,20 @@ function pathtoRegexp(path, keys, options) {
124+
offset: offset + extraOffset
125+
});
126+
127+
- var result = ''
128+
- + (optional ? '' : slash)
129+
- + '(?:'
130+
- + format + (optional ? slash : '') + capture
131+
- + (star ? '((?:[\\/' + format + '].+?)?)' : '')
132+
+ var result = '(?:'
133+
+ + format + slash + capture
134+
+ + (star ? '((?:[/' + format + '].+?)?)' : '')
135+
+ ')'
136+
+ optional;
137+
138+
extraOffset += result.length - match.length;
139+
140+
return result;
141+
- })
142+
- .replace(/\*/g, function (star, index) {
143+
- var len = keys.length
144+
-
145+
- while (len-- > keysOffset && keys[len].offset > index) {
146+
- keys[len].offset += 3; // Replacement length minus asterisk length.
147+
- }
148+
-
149+
- return '(.*)';
150+
});
151+
152+
// This is a workaround for handling unnamed matching groups.
153+
while (m = MATCHING_GROUP_REGEXP.exec(path)) {
154+
- var escapeCount = 0;
155+
- var index = m.index;
156+
-
157+
- while (path.charAt(--index) === '\\') {
158+
- escapeCount++;
159+
- }
160+
-
161+
- // It's possible to escape the bracket.
162+
- if (escapeCount % 2 === 1) {
163+
- continue;
164+
- }
165+
+ if (m[0][0] === '\\') continue;
166+
167+
if (keysOffset + i === keys.length || keys[keysOffset + i].offset > m.index) {
168+
keys.splice(keysOffset + i, 0, {
169+
@@ -122,8 +137,14 @@ function pathtoRegexp(path, keys, options) {
170+
i++;
171+
}
172+
173+
+ path += strict ? '' : path[path.length - 1] === '/' ? '?' : '/?';
174+
+
175+
// If the path is non-ending, match until the end or a slash.
176+
- path += (end ? '$' : (path[path.length - 1] === '/' ? '' : '(?=\\/|$)'));
177+
+ if (end) {
178+
+ path += '$';
179+
+ } else if (path[path.length - 1] !== '/') {
180+
+ path += lookahead ? '(?=/|$)' : '(?:/|$)';
181+
+ }
182+
183+
- return new RegExp(path, flags);
184+
-};
185+
+ return new RegExp('^' + path, flags);
186+
+};
187+
\ No newline at end of file
188+
--
189+
2.39.4
190+

SPECS/reaper/CVE-2024-47764.patch

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
From 9ca5ddf291fcd82a34925e1584bb7356a554fbe3 Mon Sep 17 00:00:00 2001
2+
From: Rohit Rawat <[email protected]>
3+
Date: Mon, 14 Oct 2024 09:44:29 +0000
4+
Subject: [PATCH] narrow the validation cookies to match RFC6265
5+
6+
---
7+
cookie/index.js | 64 ++++++++++++++++++++++++++++++++++++++++++-------
8+
1 file changed, 55 insertions(+), 9 deletions(-)
9+
10+
diff --git a/src/ui/node_modules/cookie/index.js b/src/ui/node_modules/cookie/index.js
11+
index 03d4c386..5e8c805d 100644
12+
--- a/src/ui/node_modules/cookie/index.js
13+
+++ b/src/ui/node_modules/cookie/index.js
14+
@@ -23,14 +23,60 @@ exports.serialize = serialize;
15+
var __toString = Object.prototype.toString
16+
17+
/**
18+
- * RegExp to match field-content in RFC 7230 sec 3.2
19+
+ * RegExp to match cookie-name in RFC 6265 sec 4.1.1
20+
+ * This refers out to the obsoleted definition of token in RFC 2616 sec 2.2
21+
+ * which has been replaced by the token definition in RFC 7230 appendix B.
22+
*
23+
- * field-content = field-vchar [ 1*( SP / HTAB ) field-vchar ]
24+
- * field-vchar = VCHAR / obs-text
25+
- * obs-text = %x80-FF
26+
+ * cookie-name = token
27+
+ * token = 1*tchar
28+
+ * tchar = "!" / "#" / "$" / "%" / "&" / "'" /
29+
+ * "*" / "+" / "-" / "." / "^" / "_" /
30+
+ * "`" / "|" / "~" / DIGIT / ALPHA
31+
*/
32+
33+
-var fieldContentRegExp = /^[\u0009\u0020-\u007e\u0080-\u00ff]+$/;
34+
+var cookieNameRegExp = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
35+
+
36+
+/**
37+
+ * RegExp to match cookie-value in RFC 6265 sec 4.1.1
38+
+ *
39+
+ * cookie-value = *cookie-octet / ( DQUOTE *cookie-octet DQUOTE )
40+
+ * cookie-octet = %x21 / %x23-2B / %x2D-3A / %x3C-5B / %x5D-7E
41+
+ * ; US-ASCII characters excluding CTLs,
42+
+ * ; whitespace DQUOTE, comma, semicolon,
43+
+ * ; and backslash
44+
+ */
45+
+
46+
+var cookieValueRegExp = /^("?)[\u0021\u0023-\u002B\u002D-\u003A\u003C-\u005B\u005D-\u007E]*\1$/;
47+
+
48+
+/**
49+
+ * RegExp to match domain-value in RFC 6265 sec 4.1.1
50+
+ *
51+
+ * domain-value = <subdomain>
52+
+ * ; defined in [RFC1034], Section 3.5, as
53+
+ * ; enhanced by [RFC1123], Section 2.1
54+
+ * <subdomain> = <label> | <subdomain> "." <label>
55+
+ * <label> = <let-dig> [ [ <ldh-str> ] <let-dig> ]
56+
+ * Labels must be 63 characters or less.
57+
+ * 'let-dig' not 'letter' in the first char, per RFC1123
58+
+ * <ldh-str> = <let-dig-hyp> | <let-dig-hyp> <ldh-str>
59+
+ * <let-dig-hyp> = <let-dig> | "-"
60+
+ * <let-dig> = <letter> | <digit>
61+
+ * <letter> = any one of the 52 alphabetic characters A through Z in
62+
+ * upper case and a through z in lower case
63+
+ * <digit> = any one of the ten digits 0 through 9
64+
+ */
65+
+
66+
+var domainValueRegExp = /^([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
67+
+
68+
+/**
69+
+ * RegExp to match path-value in RFC 6265 sec 4.1.1
70+
+ *
71+
+ * path-value = <any CHAR except CTLs or ";">
72+
+ * CHAR = %x01-7F
73+
+ * ; defined in RFC 5234 appendix B.1
74+
+ */
75+
+
76+
+var pathValueRegExp = /^[\u0020-\u003A\u003D-\u007E]*$/;
77+
78+
/**
79+
* Parse a cookie header.
80+
@@ -116,13 +162,13 @@ function serialize(name, val, options) {
81+
throw new TypeError('option encode is invalid');
82+
}
83+
84+
- if (!fieldContentRegExp.test(name)) {
85+
+ if (!cookieNameRegExp.test(name)) {
86+
throw new TypeError('argument name is invalid');
87+
}
88+
89+
var value = enc(val);
90+
91+
- if (value && !fieldContentRegExp.test(value)) {
92+
+ if (value && !cookieValueRegExp.test(value)) {
93+
throw new TypeError('argument val is invalid');
94+
}
95+
96+
@@ -139,7 +185,7 @@ function serialize(name, val, options) {
97+
}
98+
99+
if (opt.domain) {
100+
- if (!fieldContentRegExp.test(opt.domain)) {
101+
+ if (!domainValueRegExp.test(opt.domain)) {
102+
throw new TypeError('option domain is invalid');
103+
}
104+
105+
@@ -147,7 +193,7 @@ function serialize(name, val, options) {
106+
}
107+
108+
if (opt.path) {
109+
- if (!fieldContentRegExp.test(opt.path)) {
110+
+ if (!pathValueRegExp.test(opt.path)) {
111+
throw new TypeError('option path is invalid');
112+
}
113+
114+
--
115+
2.39.4
116+

SPECS/reaper/CVE-2024-48949.patch

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
From 7ac5360118f74eb02da73bdf9f24fd0c72ff5281 Mon Sep 17 00:00:00 2001
2+
From: Markus-MS <[email protected]>
3+
Date: Tue, 16 Jul 2024 22:22:53 -0400
4+
Subject: [PATCH] Merge commit from fork
5+
6+
---
7+
lib/elliptic/eddsa/index.js | 3 +++
8+
1 file changed, 3 insertions(+)
9+
10+
diff --git a/src/ui/node_modules/elliptic/lib/elliptic/eddsa/index.js b/src/ui/node_modules/elliptic/lib/elliptic/eddsa/index.js
11+
index d777983..cb703a7 100644
12+
--- a/src/ui/node_modules/elliptic/lib/elliptic/eddsa/index.js
13+
+++ b/src/ui/node_modules/elliptic/lib/elliptic/eddsa/index.js
14+
@@ -52,6 +52,9 @@ EDDSA.prototype.sign = function sign(message, secret) {
15+
EDDSA.prototype.verify = function verify(message, sig, pub) {
16+
message = parseBytes(message);
17+
sig = this.makeSignature(sig);
18+
+ if (sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()) {
19+
+ return false;
20+
+ }
21+
var key = this.keyFromPublic(pub);
22+
var h = this.hashInt(sig.Rencoded(), key.pubBytes(), message);
23+
var SG = this.g.mul(sig.S());

0 commit comments

Comments
 (0)