ManageIQ
/
manageiq
/
48410
61%
master: 63%
master: 63%
|
Ran
|
Jobs
5
|
Files
3350
|
Run time
26min
|
Badge
Embed ▾
README BADGES
|
push
travis-ci
FryguyMerge branch '5.6.z/fix/miq-expression-regexp-vulnerability' into '5.6.z' Sanitize regex expressions from /s and #{}s Both REGULAR EXPRESSION MATCHES and REGULAR EXPRESSION DOES NOT MATCH have a vulnerability whereby a regular expression can be terminated in the first part of the string that gets eval'd, allowing any arbitrary Ruby code to be run. They are also vulnerable to interpolation, wherein any arbitrary Ruby code can get executed. Unfortunately it is not possible to run these values through the existing `MiqExpression.re_escape` method, since it also escapes special characters which are essential to the user's forming real regular expressions through the UI. Because we are currently supporting values with or without the actual bona fide delimiters present, and also regular expressions with one option (e.g. `/abc/i`), we have to code several paths to ensure that we escape only unescaped forward slashes that are not part of the bona fide regular expression literal syntax. Addresses CVE-2016-7040 https://bugzilla.redhat.com/show_bug.cgi?id=1376878 See merge request !1045 (cherry picked from commit 92d5b5e8e)
96460 of 261494 relevant lines covered (36.89%)
161.23 hits per line
Jobs
| ID | Job ID | Ran | Files | Coverage | |
|---|---|---|---|---|---|
| 1 | 48410.1 (2.3.1, TEST_SUITE=vmdb PARALLEL=true) | 0 |
60.67 |
Travis Job 48410.1 | |
| 2 | 48410.2 (2.3.1, TEST_SUITE=automation) | 0 |
8.37 |
Travis Job 48410.2 | |
| 3 | 48410.3 (2.3.1, TEST_SUITE=migrations) | 0 |
2.13 |
Travis Job 48410.3 | |
| 5 | 48410.5 (2.3.1, TEST_SUITE=replication) | 0 |
3.44 |
Travis Job 48410.5 | |
| 6 | 48410.6 (2.3.1, GEM=pending) | 0 |
60.65 |
Travis Job 48410.6 |
Source Files on build 48410
Detailed source file information is not available for this build.