Add patch for bug 390719

(Portage version: 2.2.14_rc1/cvs/Linux x86_64, signed Manifest commit with key EBE6A336BE19039C!)

4 files changed, 71 insertions, 2 deletions

diff --git a/perl-core/File-Temp/ChangeLog b/perl-core/File-Temp/ChangeLog
index 65127d02578b..a28d85668fbd 100644
--- a/perl-core/File-Temp/ChangeLog
+++ b/perl-core/File-Temp/ChangeLog
@@ -1,6 +1,15 @@
 # ChangeLog for perl-core/File-Temp
 # Copyright 1999-2014 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/perl-core/File-Temp/ChangeLog,v 1.68 2014/08/05 17:48:21 zlogene Exp $
+# $Header: /var/cvsroot/gentoo-x86/perl-core/File-Temp/ChangeLog,v 1.69 2014/10/15 21:54:13 dilfridge Exp $
+
+*File-Temp-0.230.400-r1 (15 Oct 2014)
+*File-Temp-0.230.0 (15 Oct 2014)
+
+  15 Oct 2014; Andreas K. Huettel <dilfridge@gentoo.org>
+  +File-Temp-0.230.0.ebuild, -File-Temp-0.230.400.ebuild,
+  +File-Temp-0.230.400-r1.ebuild,
+  +files/File-Temp-0.230.0-symlink-safety.patch:
+  Add patch for bug 390719
 
   05 Aug 2014; Mikle Kolyada <zlogene@gentoo.org> File-Temp-0.220.0-r1.ebuild,
   File-Temp-0.230.400.ebuild:
diff --git a/perl-core/File-Temp/File-Temp-0.230.0.ebuild b/perl-core/File-Temp/File-Temp-0.230.0.ebuild
new file mode 100644
index 000000000000..d4349cbc6647
--- /dev/null
+++ b/perl-core/File-Temp/File-Temp-0.230.0.ebuild
@@ -0,0 +1,20 @@
+# Copyright 1999-2014 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/perl-core/File-Temp/File-Temp-0.230.0.ebuild,v 1.1 2014/10/15 21:54:13 dilfridge Exp $
+
+EAPI=5
+
+MODULE_AUTHOR=TJENNESS
+MODULE_VERSION=0.23
+inherit perl-module
+
+DESCRIPTION="File::Temp can be used to create and open temporary files in a safe way"
+
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x64-freebsd ~amd64-linux ~x86-linux ~ppc-macos ~x86-macos ~sparc-solaris ~x86-solaris"
+IUSE=""
+
+# bug 390719
+PATCHES=( "${FILESDIR}/${PN}-0.230.0-symlink-safety.patch" )
+
+SRC_TEST="do"
diff --git a/perl-core/File-Temp/File-Temp-0.230.400.ebuild b/perl-core/File-Temp/File-Temp-0.230.400-r1.ebuild
index 96829ed45511..94e0d78deab0 100644
--- a/perl-core/File-Temp/File-Temp-0.230.400.ebuild
+++ b/perl-core/File-Temp/File-Temp-0.230.400-r1.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2014 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/perl-core/File-Temp/File-Temp-0.230.400.ebuild,v 1.8 2014/08/05 17:48:21 zlogene Exp $
+# $Header: /var/cvsroot/gentoo-x86/perl-core/File-Temp/File-Temp-0.230.400-r1.ebuild,v 1.1 2014/10/15 21:54:13 dilfridge Exp $
 
 EAPI=5
 
@@ -14,4 +14,7 @@ SLOT="0"
 KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~m68k ~mips ~ppc ~ppc64 ~s390 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~x64-freebsd ~x86-freebsd ~x86-interix ~amd64-linux ~arm-linux ~ia64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~m68k-mint ~sparc-solaris ~sparc64-solaris ~x64-solaris ~x86-solaris"
 IUSE=""
 
+# bug 390719
+PATCHES=( "${FILESDIR}/${PN}-0.230.0-symlink-safety.patch" )
+
 SRC_TEST="do"
diff --git a/perl-core/File-Temp/files/File-Temp-0.230.0-symlink-safety.patch b/perl-core/File-Temp/files/File-Temp-0.230.0-symlink-safety.patch
new file mode 100644
index 000000000000..d6a3a717c702
--- /dev/null
+++ b/perl-core/File-Temp/files/File-Temp-0.230.0-symlink-safety.patch
@@ -0,0 +1,37 @@
+From: John Lightsey <jd@cpanel.net>
+Date: Mon, 27 Jun 2011 13:07:44 -0500
+Subject: [PATCH] symlink safety
+
+Add check for unsafe symbolic links to _is_safe() directory check.
+
+
+diff -ruN File-Temp-0.23.orig/lib/File/Temp.pm File-Temp-0.23/lib/File/Temp.pm
+--- File-Temp-0.23.orig/lib/File/Temp.pm	2013-03-14 22:56:59.000000000 +0100
++++ File-Temp-0.23/lib/File/Temp.pm	2014-10-15 23:46:29.894611586 +0200
+@@ -672,7 +672,25 @@
+   my $err_ref = shift;
+ 
+   # Stat path
+-  my @info = stat($path);
++  my @info = lstat($path);
++  my $symlink_test_path = $path;
++  my $symlink_loop_count = 0;
++  while (-l _) {
++    if (++$symlink_loop_count >= 50) {
++      $$err_ref = "50 levels of symlinks encountered at $path";
++      return 0;
++    }
++    if ( $info[4] <= File::Temp->top_system_uid() || $info[4] == $>) {
++      # safe to traverse
++      $symlink_test_path = readlink($symlink_test_path);
++      @info = lstat($symlink_test_path);
++    }
++    else {
++      $$err_ref = "Unsafe symlink at $path";
++      return 0;
++    }
++  }
++
+   unless (scalar(@info)) {
+     $$err_ref = "stat(path) returned no values";
+     return 0;