Merge lp:click/devel into lp:click

[Colin Watson]

Click 0.4.41: Various build and test fixes; avoid a couple of corner cases that cause click itself to fail to install.

  * Fix spurious test_sync_without_user_db test failure.
  * Fix test failures under Python 2.
  * Take evasive action in case the conflicting "click" package has been
    installed locally from PyPI (LP: #1486841).
  * Drop use of apt_pkg from click.install, since it's no longer needed
    there (LP: #1510015).
  * Require specific Click version, to avoid gi warnings that fail
    test-suite (LP: #1522608).
  * Set Vcs-* fields to the actual development branch.

[lp:click/devel]

592. By Colin Watson on 2015-12-11

[r=cjwatson] Set Vcs-* fields to the actual development branch.

[Colin Watson (cjwatson)]

review: Approve

=== modified file 'bin/click'
--- bin/click	2014-03-03 23:03:01 +0000
+++ bin/click	2015-12-11 01:24:17 +0000
@@ -28,6 +28,30 @@
 # Support running from the build tree.
 sys.path.insert(0, os.path.join(sys.path[0], os.pardir))
 
+import gi
+gi.require_version('Click', '0.4')
+
+# There is an unfortunate name clash with
+# https://pypi.python.org/pypi/click; try to detect this and take evasive
+# action.
+import click
+if not getattr(click, "_CLICK_IS_A_PACKAGING_FORMAT_", None):
+    import site
+    wrong_click_mods = [
+        mod for mod in sys.modules if mod.split(".")[0] == "click"]
+    for mod in wrong_click_mods:
+        del sys.modules[mod]
+    try:
+        user_site_index = sys.path.index(site.getusersitepackages())
+    except ValueError:
+        print(
+            "Cannot start click due to a conflict with a different "
+            "locally-installed Python 'click' package.  Remove it using "
+            "Python packaging tools and try again.",
+            file=sys.stderr)
+        sys.exit(1)
+    del sys.path[user_site_index]
+
 from click import commands
 
 
 
=== modified file 'click/__init__.py'
--- click/__init__.py	2013-04-10 15:55:06 +0000
+++ click/__init__.py	2015-12-11 01:24:17 +0000
@@ -0,0 +1,3 @@
+# Marker to help resolve unfortunate name clash between this package and
+# https://pypi.python.org/pypi/click.
+_CLICK_IS_A_PACKAGING_FORMAT_ = 1
 
=== modified file 'click/chroot.py'
--- click/chroot.py	2015-10-05 11:35:41 +0000
+++ click/chroot.py	2015-12-11 01:24:17 +0000
@@ -27,8 +27,11 @@
     "ClickChrootDoesNotExistException",
     ]
 
-import urllib
-import urllib.request
+try:
+    from urllib.error import URLError
+    from urllib.request import urlopen
+except ImportError:
+    from urllib2 import URLError, urlopen
 import os
 import pwd
 import re
@@ -216,14 +219,14 @@
     if click_no_local_mirror == '1':
         return ""
     try:
-        with urllib.request.urlopen(GEOIP_SERVER) as f:
+        with urlopen(GEOIP_SERVER) as f:
             xml_data = f.read()
         et = ElementTree.fromstring(xml_data)
         cc = et.find("CountryCode")
         if not cc:
             return ""
         return cc.text.lower()+"."
-    except (ElementTree.ParseError, urllib.error.URLError):
+    except (ElementTree.ParseError, URLError):
         pass
     return ""
 
 
=== modified file 'click/install.py'
--- click/install.py	2015-09-17 19:20:07 +0000
+++ click/install.py	2015-12-11 01:24:17 +0000
@@ -42,7 +42,6 @@
 
 from contextlib import closing
 
-import apt_pkg
 from debian.debfile import DebFile as _DebFile
 from debian.debian_support import Version
 from gi.repository import Click
@@ -73,9 +72,6 @@
             self.data._DebPart__member.close()
 
 
-apt_pkg.init_system()
-
-
 class DebsigVerifyError(Exception):
     pass
 
@@ -276,6 +272,16 @@
                             'with system architecture "%s"' %
                             (architecture, dpkg_architecture))
 
+            # This isn't ideally quick, since it has to decompress the data
+            # part of the package, but dpkg's path filtering code assumes
+            # that all paths start with "./" so we must check it before
+            # passing the package to dpkg.
+            for data_name in package.data:
+                if data_name != "." and not data_name.startswith("./"):
+                    raise ClickInstallerAuditError(
+                        'File name "%s" in package does not start with "./"' %
+                        data_name)
+
             if slow:
                 temp_dir = tempfile.mkdtemp(prefix="click")
                 try:
 
=== modified file 'click/tests/test_database.py'
--- click/tests/test_database.py	2015-10-06 14:24:01 +0000
+++ click/tests/test_database.py	2015-12-11 01:24:17 +0000
@@ -32,6 +32,7 @@
 import unittest
 
 from gi.repository import Click, GLib
+from six import integer_types
 
 from click.json_helpers import json_array_to_python, json_object_to_python
 from click.tests.gimock_types import Passwd
@@ -55,7 +56,7 @@
             "bar", "1.0", "/path/to/foo/1.0", False)
 
     def test_hash(self):
-        self.assertIsInstance(self.foo.hash(), int)
+        self.assertIsInstance(self.foo.hash(), integer_types)
         self.assertEqual(self.foo.hash(), self.foo_clone.hash())
         self.assertNotEqual(self.foo.hash(), self.foo_different_version.hash())
         self.assertNotEqual(self.foo.hash(), self.foo_different_path.hash())
 
=== modified file 'click/tests/test_hooks.py'
--- click/tests/test_hooks.py	2014-07-11 17:20:51 +0000
+++ click/tests/test_hooks.py	2015-12-11 01:24:17 +0000
@@ -895,6 +895,7 @@
                 ) as (enter, preloads):
             enter()
             preloads["click_get_user_home"].return_value = "/home/test-user"
+            self._setup_hooks_dir(preloads)
             with mkfile(
                     os.path.join(self.temp_dir, "hooks", "test.hook")) as f:
                 print("User-Level: yes", file=f)
 
=== modified file 'click/tests/test_install.py'
--- click/tests/test_install.py	2014-12-03 12:42:21 +0000
+++ click/tests/test_install.py	2015-12-11 01:24:17 +0000
@@ -23,19 +23,24 @@
     ]
 
 
-from contextlib import contextmanager
+from contextlib import (
+    closing,
+    contextmanager,
+    )
 import hashlib
 import json
 import os
 import shutil
 import stat
 import subprocess
+import tarfile
 
 from unittest import skipUnless
 
 from debian.deb822 import Deb822
 from gi.repository import Click
 
+from click.arfile import ArFile
 from click.build import ClickBuilder
 from click.install import (
     ClickInstaller,
@@ -50,6 +55,7 @@
     TestCase,
     touch,
 )
+from click.versions import spec_version
 
 
 @contextmanager
@@ -104,6 +110,7 @@
                 script.write(contents)
         Click.ensuredir(data_dir)
         for name, path in data_files.items():
+            Click.ensuredir(os.path.dirname(os.path.join(data_dir, name)))
             if path is None:
                 touch(os.path.join(data_dir, name))
             elif os.path.isdir(path):
@@ -320,6 +327,46 @@
                     ])
             self.assertEqual(("test-package", "1.0"), installer.audit(path))
 
+    def test_audit_missing_dot_slash(self):
+        # Manually construct a package with data paths that do not start
+        # with "./", which could be used to bypass path filtering.
+        with self.run_in_subprocess(
+                "click_get_frameworks_dir") as (enter, preloads):
+            enter()
+            path = self.make_fake_package(
+                control_fields={"Click-Version": "0.2"},
+                manifest={
+                    "name": "test-package",
+                    "version": "1.0",
+                    "framework": "ubuntu-sdk-13.10",
+                },
+                control_scripts={"preinst": static_preinst},
+                data_files={".click/tmp.ci/manifest": None})
+            # Repack without the leading "./".
+            data_dir = os.path.join(self.temp_dir, "fake-package")
+            data_tar_path = os.path.join(self.temp_dir, "data.tar.gz")
+            control_tar_path = os.path.join(self.temp_dir, "control.tar.gz")
+            package_path = '%s.click' % data_dir
+            with closing(tarfile.TarFile.open(
+                    name=data_tar_path, mode="w:gz", format=tarfile.GNU_FORMAT
+                    )) as data_tar:
+                data_tar.add(
+                    os.path.join(data_dir, ".click"), arcname=".click")
+            with ArFile(name=package_path, mode="w") as package:
+                package.add_magic()
+                package.add_data("debian-binary", b"2.0\n")
+                package.add_data(
+                    "_click-binary", ("%s\n" % spec_version).encode("UTF-8"))
+                package.add_file("control.tar.gz", control_tar_path)
+                package.add_file("data.tar.gz", data_tar_path)
+            self._setup_frameworks(preloads, frameworks=["ubuntu-sdk-13.10"])
+            with mock_quiet_subprocess_call():
+                installer = ClickInstaller(self.db)
+                self.assertRaisesRegex(
+                    ClickInstallerAuditError,
+                    'File name ".click" in package does not start with "./"',
+                    installer.audit, path)
+
     def test_audit_broken_md5sums(self):
         with self.run_in_subprocess(
                 "click_get_frameworks_dir") as (enter, preloads):
 
=== modified file 'debian/changelog'
--- debian/changelog	2015-10-06 19:44:52 +0000
+++ debian/changelog	2015-12-11 01:24:17 +0000
@@ -1,3 +1,33 @@
+click (0.4.41) UNRELEASED; urgency=medium
+
+  [ Colin Watson ]
+  * Fix spurious test_sync_without_user_db test failure.
+  * Fix test failures under Python 2.
+  * Forbid installing packages with data tarball members whose names do not
+    start with "./" (LP: #1506467).
+  * Take evasive action in case the conflicting "click" package has been
+    installed locally from PyPI (LP: #1486841).
+  * Drop use of apt_pkg from click.install, since it's no longer needed
+    there (LP: #1510015).
+
+  [ Dimitri John Ledkov ]
+  * Require specific Click version, to avoid gi warnings that fail
+    test-suite (LP: #1522608).
+  * Set Vcs-* fields to the actual development branch.
+
+ -- Colin Watson <[e-mail]>  Thu, 15 Oct 2015 12:46:54 +0100
+
+click (0.4.40+15.10.20151006-0ubuntu1.1) wily; urgency=medium
+
+  * SECURITY UPDATE: fix privilege escalation via crafted data.tar.gz that
+    can be used to install alternate security policy than what is defined
+    - click/install.py: Forbid installing packages with data tarball members
+      whose names do not start with "./". Patch thanks to Colin Watson.
+    - CVE-2015-XXXX
+    - LP: #1506467
+
+ -- Jamie Strandboge <[e-mail]>  Thu, 15 Oct 2015 11:13:36 -0500
+
 click (0.4.40+15.10.20151006-0ubuntu1) wily; urgency=medium
 
   [ Michael Vogt ]
 
=== modified file 'debian/control'
--- debian/control	2015-07-02 08:54:29 +0000
+++ debian/control	2015-12-11 01:24:17 +0000
@@ -4,8 +4,8 @@
 Maintainer: Colin Watson <[e-mail]>
 Standards-Version: 3.9.5
 Build-Depends: debhelper (>= 9~), dh-autoreconf, intltool, python3:any (>= 3.2), python3-all:any, python3-setuptools, python3-apt, python3-debian, python3-gi, python3:any (>= 3.3) | python3-mock, pep8, python3-pep8, pyflakes, python3-sphinx, pkg-config, valac, gobject-introspection (>= 0.6.7), libgirepository1.0-dev (>= 0.6.7), libglib2.0-dev (>= 2.34), gir1.2-glib-2.0, libjson-glib-dev (>= 0.10), libgee-0.8-dev, libpackagekit-glib2-dev (>= 0.7.2), python3-coverage, python3-six, dh-systemd (>= 1.3)
-Vcs-Bzr: https://code.launchpad.net/~ubuntu-managed-branches/click/click
-Vcs-Browser: http://bazaar.launchpad.net/~ubuntu-managed-branches/click/click/files
+Vcs-Bzr: https://code.launchpad.net/~click-hackers/click/devel
+Vcs-Browser: http://bazaar.launchpad.net/~click-hackers/click/devel/files
 X-Python-Version: >= 2.7
 X-Python3-Version: >= 3.2
 XS-Testsuite: autopkgtest