Merge lp:~logan/ubuntu/raring/couchdb/1.2.0-5 into lp:ubuntu/raring/couchdb

[Logan Rosen]

[Jamie Strandboge (jdstrand)]

Thanks for your merge! ACK, though in the future you might also file a security bug and subscribe ubuntu-security-sponsors so a member of the security team could review it. Thanks again.

review: Approve

[Logan Rosen (logan)]

Noted. Thanks!

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2012-11-18 12:24:24 +0000
+++ .pc/applied-patches	2013-01-21 22:49:21 +0000
@@ -3,3 +3,6 @@
 logrotate_as_couchdb.patch
 couchdb_sighup.patch
 wait_for_couchdb_stop.patch
+improve_parsing_of_mochiweb_relative_paths.patch
+improve_script_url_validation.patch
+include_a_comment_before_jsonp_output.patch

=== modified file 'debian/changelog'
--- debian/changelog	2012-12-25 03:35:04 +0000
+++ debian/changelog	2013-01-21 22:49:21 +0000
@@ -1,3 +1,28 @@
+couchdb (1.2.0-5ubuntu1) raring; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - debian/rules, debian/control: Split couchdb and couchdb-bin.
+    - debian/postinst: Rename to couchdb-bin.postinst.
+    - debian/couchdb-bin.postrm: Don't try to delete couchdb system
+      user/group.
+
+ -- Logan Rosen <[e-mail]>  Mon, 21 Jan 2013 17:26:25 -0500
+
+couchdb (1.2.0-5) unstable; urgency=high
+
+  * Fix debian/patches/series for CVE-2012-5649 and CVE-2012-5650 fixes.
+
+ -- Laszlo Boszormenyi (GCS) <[e-mail]>  Fri, 18 Jan 2013 22:04:32 +0100
+
+couchdb (1.2.0-4) unstable; urgency=high
+
+  * Fix CVE-2012-5649 and CVE-2012-5650 with adding upstream fixes as patches:
+    improve_parsing_of_mochiweb_relative_paths.patch ,
+    improve_script_url_validation.patch and
+    include_a_comment_before_jsonp_output.patch (closes: #698439).
+
+ -- Laszlo Boszormenyi (GCS) <[e-mail]>  Fri, 18 Jan 2013 20:04:01 +0100
+
 couchdb (1.2.0-3ubuntu1) raring; urgency=low
 
   * Merge from Debian unstable. Remaining changes:

=== added file 'debian/patches/improve_parsing_of_mochiweb_relative_paths.patch'
--- debian/patches/improve_parsing_of_mochiweb_relative_paths.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/improve_parsing_of_mochiweb_relative_paths.patch	2013-01-21 22:49:21 +0000
@@ -0,0 +1,40 @@
+Description: improve parsing of mochiweb relative paths
+ Patch adapted from http://www.couchbase.com/issues/browse/MB-7390
+Author: Sriram Melkote <[e-mail]>
+Bug-Debian: http://bugs.debian.org/698439
+Last-Update: 2012-12-15
+
+---
+
+diff --git a/src/mochiweb/mochiweb_util.erl b/src/mochiweb/mochiweb_util.erl
+index 3b50fe7..6b88818 100644
+--- a/src/mochiweb/mochiweb_util.erl
++++ b/src/mochiweb/mochiweb_util.erl
+@@ -68,11 +68,17 @@ partition2(_S, _Sep) ->
+ %% @spec safe_relative_path(string()) -> string() | undefined
+ %% @doc Return the reduced version of a relative path or undefined if it
+ %%      is not safe. safe relative paths can be joined with an absolute path
+-%%      and will result in a subdirectory of the absolute path.
++%%      and will result in a subdirectory of the absolute path. Safe paths
++%%      never contain a backslash character.
+ safe_relative_path("/" ++ _) ->
+     undefined;
+ safe_relative_path(P) ->
+-    safe_relative_path(P, []).
++    case string:chr(P, $\\) of
++        0 ->
++           safe_relative_path(P, []);
++        _ ->
++           undefined
++    end.
+ 
+ safe_relative_path("", Acc) ->
+     case Acc of
+@@ -809,6 +815,7 @@ safe_relative_path_test() ->
+     undefined = safe_relative_path("../foo"),
+     undefined = safe_relative_path("foo/../.."),
+     undefined = safe_relative_path("foo//"),
++    undefined = safe_relative_path("foo\\bar"),
+     ok.
+ 
+ parse_qvalues_test() ->

=== added file 'debian/patches/improve_script_url_validation.patch'
--- debian/patches/improve_script_url_validation.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/improve_script_url_validation.patch	2013-01-21 22:49:21 +0000
@@ -0,0 +1,26 @@
+Description: Improve script url validation
+Author: Robert Newson <[e-mail]>
+Bug-Debian: http://bugs.debian.org/698439
+Last-Update: 2012-12-18
+
+---
+
+diff --git a/share/www/script/couch_test_runner.js b/share/www/script/couch_test_runner.js
+index c1e7a72..60ba11c 100644
+--- a/share/www/script/couch_test_runner.js
++++ b/share/www/script/couch_test_runner.js
+@@ -15,11 +15,9 @@
+ 
+ function loadScript(url) {
+   // disallow loading remote URLs
+-  if((url.substr(0, 7) == "http://")
+-    || (url.substr(0, 2) == "//")
+-    || (url.substr(0, 5) == "data:")
+-    || (url.substr(0, 11) == "javascript:")) {
+-        throw "Not loading remote test scripts";
++  var re = /^[a-z0-9_]+(\/[a-z0-9_]+)*\.js#?$/;
++  if (!re.test(url)) {
++      throw "Not loading remote test scripts";
+   }
+   if (typeof document != "undefined") document.write('<script src="'+url+'"></script>');
+ };

=== added file 'debian/patches/include_a_comment_before_jsonp_output.patch'
--- debian/patches/include_a_comment_before_jsonp_output.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/include_a_comment_before_jsonp_output.patch	2013-01-21 22:49:21 +0000
@@ -0,0 +1,20 @@
+Description: Include a comment before jsonp output
+Author: Robert Newson <[e-mail]>
+Bug-Debian: http://bugs.debian.org/698439
+Last-Update: 2012-12-19
+
+---
+
+diff --git a/src/couchdb/couch_httpd.erl b/src/couchdb/couch_httpd.erl
+index 0be7126..58f5ec6 100644
+--- a/src/couchdb/couch_httpd.erl
++++ b/src/couchdb/couch_httpd.erl
+@@ -746,7 +746,7 @@ start_jsonp() ->
+     case get(jsonp) of
+         no_jsonp -> [];
+         [] -> [];
+-        CallBack -> CallBack ++ "("
++        CallBack -> ["/* CouchDB */", CallBack, "("]
+     end.
+ 
+ end_jsonp() ->

=== modified file 'debian/patches/series'
--- debian/patches/series	2012-11-18 12:24:24 +0000
+++ debian/patches/series	2013-01-21 22:49:21 +0000
@@ -3,3 +3,6 @@
 logrotate_as_couchdb.patch
 couchdb_sighup.patch
 wait_for_couchdb_stop.patch
+improve_parsing_of_mochiweb_relative_paths.patch
+improve_script_url_validation.patch
+include_a_comment_before_jsonp_output.patch

=== modified file 'share/www/script/couch_test_runner.js'
--- share/www/script/couch_test_runner.js	2012-07-30 22:49:59 +0000
+++ share/www/script/couch_test_runner.js	2013-01-21 22:49:21 +0000
@@ -15,11 +15,9 @@
 
 function loadScript(url) {
   // disallow loading remote URLs
-  if((url.substr(0, 7) == "http://")
-    || (url.substr(0, 2) == "//")
-    || (url.substr(0, 5) == "data:")
-    || (url.substr(0, 11) == "javascript:")) {
-        throw "Not loading remote test scripts";
+  var re = /^[a-z0-9_]+(\/[a-z0-9_]+)*\.js#?$/;
+  if (!re.test(url)) {
+      throw "Not loading remote test scripts";
   }
   if (typeof document != "undefined") document.write('<script src="'+url+'"></script>');
 };

=== modified file 'src/couchdb/couch_httpd.erl'
--- src/couchdb/couch_httpd.erl	2012-07-30 22:49:59 +0000
+++ src/couchdb/couch_httpd.erl	2013-01-21 22:49:21 +0000
@@ -746,7 +746,7 @@
     case get(jsonp) of
         no_jsonp -> [];
         [] -> [];
-        CallBack -> CallBack ++ "("
+        CallBack -> ["/* CouchDB */", CallBack, "("]
     end.
 
 end_jsonp() ->

=== modified file 'src/mochiweb/mochiweb_util.erl'
--- src/mochiweb/mochiweb_util.erl	2012-07-30 22:49:54 +0000
+++ src/mochiweb/mochiweb_util.erl	2013-01-21 22:49:21 +0000
@@ -68,11 +68,17 @@
 %% @spec safe_relative_path(string()) -> string() | undefined
 %% @doc Return the reduced version of a relative path or undefined if it
 %%      is not safe. safe relative paths can be joined with an absolute path
-%%      and will result in a subdirectory of the absolute path.
+%%      and will result in a subdirectory of the absolute path. Safe paths
+%%      never contain a backslash character.
 safe_relative_path("/" ++ _) ->
     undefined;
 safe_relative_path(P) ->
-    safe_relative_path(P, []).
+    case string:chr(P, $\\) of
+        0 ->
+           safe_relative_path(P, []);
+        _ ->
+           undefined
+    end.
 
 safe_relative_path("", Acc) ->
     case Acc of
@@ -809,6 +815,7 @@
     undefined = safe_relative_path("../foo"),
     undefined = safe_relative_path("foo/../.."),
     undefined = safe_relative_path("foo//"),
+    undefined = safe_relative_path("foo\\bar"),
     ok.
 
 parse_qvalues_test() ->