Fix CVE-2023-38037

CVE-2023-38037.patch

@@ -0,0 +1,59 @@
+From c85cc667ebfd3c270df37c7575d580ea6462e12f Mon Sep 17 00:00:00 2001
+From: Aaron Patterson <aaron@rubyonrails.org>
+Date: Tue, 22 Aug 2023 09:58:43 -0700
+Subject: [PATCH] Use a temporary file for storing unencrypted files while
+ editing
+
+Origin: https://github.com/rails/rails/commit/c85cc667ebfd3c270df37c7575d580ea6462e12f
+
+When we're editing the contents of encrypted files, we should use the
+`Tempfile` class because it creates temporary files with restrictive
+permissions.  This prevents other users on the same system from reading
+the contents of those files while the user is editing them.
+
+[CVE-2023-38037]
+---
+ .../lib/active_support/encrypted_file.rb       | 17 ++++++++---------
+ activesupport/test/encrypted_file_test.rb      |  8 ++++++++
+ railties/lib/rails/secrets.rb                  | 18 ++++++++++--------
+ 3 files changed, 26 insertions(+), 17 deletions(-)
+
+diff --git a/railties/lib/rails/secrets.rb b/railties/lib/rails/secrets.rb
+index 54ba53c03b981..913d5e57c1bfb 100644
+--- a/railties/lib/rails/secrets.rb
++++ b/railties/lib/rails/secrets.rb
+@@ -1,6 +1,7 @@
+ # frozen_string_literal: true
+ 
+ require "yaml"
++require "tempfile"
+ require "active_support/message_encryptor"
+ 
+ module Rails
+@@ -87,17 +88,18 @@ def preprocess(path)
+         end
+ 
+         def writing(contents)
+-          tmp_file = "#{File.basename(path)}.#{Process.pid}"
+-          tmp_path = File.join(Dir.tmpdir, tmp_file)
+-          IO.binwrite(tmp_path, contents)
++          file_name = "#{File.basename(path)}.#{Process.pid}"
+ 
+-          yield tmp_path
++          Tempfile.create(["", "-" + file_name]) do |tmp_file|
++            tmp_path = Pathname.new(tmp_file)
++            tmp_path.binwrite contents
+ 
+-          updated_contents = IO.binread(tmp_path)
++            yield tmp_path
+ 
+-          write(updated_contents) if updated_contents != contents
+-        ensure
+-          FileUtils.rm(tmp_path) if File.exist?(tmp_path)
++            updated_contents = tmp_path.binread
++
++            write(updated_contents) if updated_contents != contents
++          end
+         end
+ 
+         def encryptor

rubygem-railties.spec

@@ -4,7 +4,7 @@
 
 Name:                rubygem-%{gem_name}
 Version:             6.1.4.1
-Release:             1
+Release:             2
 Summary:             Tools for creating, working with, and running Rails applications
 License:             MIT
 URL:                 http://rubyonrails.org
@@ -18,6 +18,7 @@ Source1:             %{gem_name}-%{version}-tests.txz
 # git clone http://github.com/rails/rails.git --no-checkout
 # cd rails && git archive -v -o rails-6.1.4.1-tools.txz v6.1.4.1 tools/
 Source2:             rails-%{version}-tools.txz
+Patch0:              CVE-2023-38037.patch
 
 Recommends: ruby(irb)
 Suggests:            %{_bindir}/sqlite3
@@ -52,6 +53,7 @@ Documentation for %{name}.
 
 %prep
 %setup -q -n %{gem_name}-%{version} -b1 -b2
+%patch0 -p2
 
 %build
 gem build ../%{gem_name}-%{version}.gemspec
@@ -191,6 +193,9 @@ popd
 %doc %{gem_instdir}/README.rdoc
 
 %changelog
+* Mon Sep 11 2023 wangkai <13474090681@163.com> - 6.1.4.1-2
+- Fix CVE-2023-38037
+
 * Fri Mar 04 2022 jiangxinyu <jiangxinyu@kylinos.cn> - 6.1.4.1-1
 - update to 6.1.4.1