CVE-2021-38711 (Other, published 2021-08-16T04:15Z)
Description: value: In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-552 \u2014 Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
Repository: https://github.com/jgm/gitit
Files changed:
README.markdown
data/default.conf
data/templates/pagetools.st
gitit.cabal
src/Network/Gitit.hs
src/Network/Gitit/Cache.hs
src/Network/Gitit/Config.hs
src/Network/Gitit/ContentTransformer.hs
src/Network/Gitit/Handlers.hs
src/Network/Gitit/Layout.hs
src/Network/Gitit/Types.hs
Commit message: Remove the Export feature.

This feature is a security risk; it provided multiple
vectors by which contents of files could be exposed.

API change: remove Network.Gitit.Export.


Vulnerable code:
DocBook, or Emacs Org-mode markup can also be used. Pages can be exported in a
number of different formats, including LaTeX, RTF, OpenOffice ODT, and
MediaWiki markup.  Gitit can be configured to display TeX math (using
[texmath]) and highlighted source code (using [highlighting-kate]).
By default, rendered pages, highlighted source files, and exported PDFs
pdf-export: no
# if yes, PDF will appear in export options. PDF will be created using
# pdflatex, which must be installed and in the path. Note that PDF
# exports create significant additional server load.

# customizations. These can include a templates/ directory for custom
# templates for various export formats, an S5 directory for custom
# S5 styles, and a reference.odt for ODT exports. If no directory is
    $exportbox$
                     Network.Gitit.Export,
  , guardCommand "export" >> exportPage
  when exists $ liftIO $ do
    liftIO $ removeFile target
    expireCachedPDF target (defaultExtension cfg)

expireCachedPDF :: String -> String -> IO ()
expireCachedPDF file ext = 
  when (takeExtension file == "." ++ ext) $ do
    let pdfname = file ++ ".export.pdf"
    exists <- doesFileExist pdfname
    when exists $ removeFile pdfname
    expireCachedPDF target (defaultExtension cfg)
      cfPDFExport <- get cp "DEFAULT" "pdf-export"
        , pdfExport            = cfPDFExport
  , exportPage
  , exportPandoc
import Network.Gitit.Export (exportFormats)
exportPage :: Handler
exportPage = runPageTransformer exportViaPandoc

exportViaPandoc :: ContentTransformer Response
exportViaPandoc = rawContents >>=
                  maybe mzero return >>=
                  contentsToPage >>=
                  pageToWikiPandoc >>=
                  exportPandoc

exportPandoc :: Pandoc -> ContentTransformer Response
exportPandoc doc = do
  params <- getParams
  page <- getPageName
  cfg <- lift getConfig
  let format = pFormat params
  case lookup format (exportFormats cfg) of
       Nothing     -> error $ "Unknown export format: " ++ format
       Just writer -> lift (writer page doc)

{-# LANGUAGE OverloadedStrings #-}
{-# LANGUAGE FlexibleContexts #-}
{-
Copyright (C) 2009 John MacFarlane <jgm@berkeley.edu>

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-}

{- Functions for exporting wiki pages in various formats.
-}

module Network.Gitit.Export ( exportFormats ) where
import Control.Exception (throwIO)
import Text.Pandoc hiding (HTMLMathMethod(..), getDataFileName)
import qualified Text.Pandoc as Pandoc
import Text.Pandoc.PDF (makePDF)
import Text.Pandoc.SelfContained as SelfContained
import qualified Text.Pandoc.UTF8 as UTF8
import qualified Data.Map as M
import Network.Gitit.Server
import Network.Gitit.Framework (pathForPage)
import Network.Gitit.State (getConfig)
import Network.Gitit.Types
import Network.Gitit.Cache (cacheContents, lookupCache)
import Text.DocTemplates as DT
import Control.Monad.Trans (liftIO)
import Control.Monad (unless)
import Text.XHtml (noHtml)
import qualified Data.ByteString as B
import qualified Data.ByteString.Lazy as L
import System.FilePath ((</>), takeDirectory)
import System.Environment (setEnv)
import System.Directory (doesFileExist)
import Text.HTML.SanitizeXSS
import Data.ByteString.Lazy (fromStrict)
import Data.Text (Text)
import qualified Data.Text as T
import Data.Text.Encoding (encodeUtf8)
import Data.List (isPrefixOf)
import Skylighting (styleToCss, pygments)
import System.IO.Temp (withSystemTempDirectory)
import Paths_gitit (getDataFileName)

defaultRespOptions :: WriterOptions
defaultRespOptions = def { writerHighlightStyle = Just pygments }

respondX :: String -> String -> String
          -> (WriterOptions -> Pandoc -> PandocIO L.ByteString)
          -> WriterOptions -> String -> Pandoc -> Handler
respondX templ mimetype ext fn opts page doc = do
  cfg <- getConfig
  doc' <- if ext `elem` ["odt","pdf","beamer","epub","docx","rtf"]
             then fixURLs page doc
             else return doc
  doc'' <- liftIO $ runIO $ do
        setUserDataDir $ pandocUserData cfg
        compiledTemplate <- compileDefaultTemplate (T.pack templ)
        fn opts{ writerTemplate = Just compiledTemplate } doc'
  either (liftIO . throwIO)
         (ok . setContentType mimetype .
           (if null ext then id else setFilename (page ++ "." ++ ext)) .
            toResponseBS B.empty)
         doc''

respondS :: String -> String -> String -> (WriterOptions -> Pandoc -> PandocIO Text)
          -> WriterOptions -> String -> Pandoc -> Handler
respondS templ mimetype ext fn =
  respondX templ mimetype ext (\o d -> fromStrict . encodeUtf8 <$> fn o d)

respondSlides :: String -> (WriterOptions -> Pandoc -> PandocIO Text) -> String -> Pandoc -> Handler
respondSlides templ fn page doc = do
    cfg <- getConfig
    let math = case mathMethod cfg of
                   MathML       -> Pandoc.MathML
                   WebTeX u     -> Pandoc.WebTeX $ T.pack u
                   _            -> Pandoc.PlainMath
    let opts' = defaultRespOptions { writerIncremental = True
                                   , writerHTMLMathMethod = math}
    -- We sanitize the body only, to protect against XSS attacks.
    -- (Sanitizing the whole HTML page would strip out javascript
    -- needed for the slides.)  We then pass the body into the
    -- slide template using the 'body' variable.
    Pandoc meta blocks <- fixURLs page doc
    docOrError <- liftIO $ runIO $ do
          setUserDataDir $ pandocUserData cfg
          body' <- writeHtml5String opts' (Pandoc meta blocks) -- just body
          let body'' = T.unpack
                       $ (if xssSanitize cfg then sanitizeBalance else id)
                       $ body'
          let setVariable key val (DT.Context ctx) =
                DT.Context $ M.insert (T.pack key) (toVal (T.pack val)) ctx
          variables' <- if mathMethod cfg == MathML
                          then do
                              s <- readDataFile "MathMLinHTML.js"
                              return $ setVariable "mathml-script"
                                         (UTF8.toString s) mempty
                          else return mempty
          compiledTemplate <- compileDefaultTemplate (T.pack templ)
          dzcore <- if templ == "dzslides"
                      then do
                        dztempl <- readDataFile $ "dzslides" </> "template.html"
                        return $ unlines
                            $ dropWhile (not . isPrefixOf "<!-- {{{{ dzslides core")
                            $ lines $ UTF8.toString dztempl
                      else return ""
          let opts'' = opts'{
                             writerVariables =
                               setVariable "body" body'' $
                               setVariable "dzslides-core" dzcore $
                               setVariable "highlighting-css" pygmentsCss
                               $ variables'
                            ,writerTemplate = Just compiledTemplate }
          h <- fn opts'' (Pandoc meta [])
          makeSelfContained h
    either (liftIO . throwIO)
           (ok . setContentType "text/html;charset=UTF-8" .
             (setFilename (page ++ ".html")) .
             toResponseBS B.empty . L.fromStrict . UTF8.fromText)
           docOrError

respondLaTeX :: String -> Pandoc -> Handler
respondLaTeX = respondS "latex" "application/x-latex" "tex"
  writeLaTeX defaultRespOptions

respondConTeXt :: String -> Pandoc -> Handler
respondConTeXt = respondS "context" "application/x-context" "tex"
  writeConTeXt defaultRespOptions


respondRTF :: String -> Pandoc -> Handler
respondRTF = respondX "rtf" "application/rtf" "rtf"
  (\o d -> L.fromStrict . UTF8.fromText <$> writeRTF o d) defaultRespOptions

respondRST :: String -> Pandoc -> Handler
respondRST = respondS "rst" "text/plain; charset=utf-8" ""
  writeRST defaultRespOptions{writerReferenceLinks = True}

respondMarkdown :: String -> Pandoc -> Handler
respondMarkdown = respondS "markdown" "text/plain; charset=utf-8" ""
  writeMarkdown defaultRespOptions{writerReferenceLinks = True}

respondCommonMark :: String -> Pandoc -> Handler
respondCommonMark = respondS "commonmark" "text/plain; charset=utf-8" ""
  writeCommonMark defaultRespOptions{writerReferenceLinks = True}

respondPlain :: String -> Pandoc -> Handler
respondPlain = respondS "plain" "text/plain; charset=utf-8" ""
  writePlain defaultRespOptions

respondMan :: String -> Pandoc -> Handler
respondMan = respondS "man" "text/plain; charset=utf-8" ""
  writeMan defaultRespOptions

respondTexinfo :: String -> Pandoc -> Handler
respondTexinfo = respondS "texinfo" "application/x-texinfo" "texi"
  writeTexinfo defaultRespOptions

respondDocbook :: String -> Pandoc -> Handler
respondDocbook = respondS "docbook" "application/docbook+xml" "xml"
  writeDocbook5 defaultRespOptions

respondOrg :: String -> Pandoc -> Handler
respondOrg = respondS "org" "text/plain; charset=utf-8" ""
  writeOrg defaultRespOptions

respondICML :: String -> Pandoc -> Handler
respondICML = respondX "icml" "application/xml; charset=utf-8" ""
              (\o d -> L.fromStrict . UTF8.fromText <$> writeICML o d)
                         defaultRespOptions

respondTextile :: String -> Pandoc -> Handler
respondTextile = respondS "textile" "text/plain; charset=utf-8" ""
  writeTextile defaultRespOptions

respondAsciiDoc :: String -> Pandoc -> Handler
respondAsciiDoc = respondS "asciidoc" "text/plain; charset=utf-8" ""
  writeAsciiDoc defaultRespOptions

respondMediaWiki :: String -> Pandoc -> Handler
respondMediaWiki = respondS "mediawiki" "text/plain; charset=utf-8" ""
  writeMediaWiki defaultRespOptions

respondODT :: String -> Pandoc -> Handler
respondODT = respondX "opendocument" "application/vnd.oasis.opendocument.text"
              "odt" writeODT defaultRespOptions

respondEPUB :: String -> Pandoc -> Handler
respondEPUB = respondX "html" "application/epub+zip" "epub" writeEPUB3
               defaultRespOptions

respondDocx :: String -> Pandoc -> Handler
respondDocx = respondX "native"
  "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
  "docx" writeDocx defaultRespOptions

respondPDF :: Bool -> String -> Pandoc -> Handler
respondPDF useBeamer page old_pndc = fixURLs page old_pndc >>= \pndc -> do
  cfg <- getConfig
  unless (pdfExport cfg) $ error "PDF export disabled"
  let cacheName = pathForPage page (defaultExtension cfg) ++ ".export.pdf"
  cached <- if useCache cfg
               then lookupCache cacheName
               else return Nothing
  pdf' <- case cached of
            Just (_modtime, bs) -> return $ Right $ L.fromChunks [bs]
            Nothing -> liftIO $
                withSystemTempDirectory "gitit" $ \tmpdir -> do
              let toc = tableOfContents cfg
              -- ensure that LaTeX \include commands can't include
              -- files outside the working directory, e.g. /etc/passwd:
              writeFile (tmpdir </> "texmf.cnf")
                "openout_any = p\nopenin_any = p\n"
              setEnv "TEXMFCNF" (tmpdir ++ ":")
              res <- runIO $ do
                setUserDataDir $ pandocUserData cfg
                setInputFiles [baseUrl cfg]
                let templ = if useBeamer then "beamer" else "latex"
                compiledTemplate <- compileDefaultTemplate templ
                makePDF "pdflatex" [] (if useBeamer then writeBeamer else writeLaTeX)
                  defaultRespOptions{ writerTemplate = Just compiledTemplate
                                    , writerTableOfContents = toc } pndc
              either (liftIO . throwIO) return res

  case pdf' of
       Left logOutput' -> simpleErrorHandler ("PDF creation failed:\n"
                           ++ UTF8.toStringLazy logOutput')
       Right pdfBS -> do
              case cached of
                Nothing ->
                     cacheContents cacheName $ B.concat . L.toChunks $ pdfBS
                _ -> return ()
              ok $ setContentType "application/pdf" $ setFilename (page ++ ".pdf") $
                        (toResponse noHtml) {rsBody = pdfBS}

fixURLs :: String -> Pandoc -> GititServerPart Pandoc
fixURLs page pndc = do
    cfg <- getConfig
    defaultStatic <- liftIO $ getDataFileName $ "data" </> "static"

    let static = staticDir cfg
    let repoPath = repositoryPath cfg

    let go (Image attr ils (url, title)) = do
           fixedURL <- fixURL $ T.unpack url
           return $ Image attr ils (T.pack fixedURL, title)
        go x                        = return x

        fixURL ('/':url) = resolve url
        fixURL url       = resolve $ takeDirectory page </> url

        resolve p = do
           sp <- doesFileExist $ static </> p
           dsp <- doesFileExist $ defaultStatic </> p
           return (if sp then static </> p
                   else (if dsp then defaultStatic </> p
                         else repoPath </> p))
    liftIO $ bottomUpM go pndc

exportFormats :: Config -> [(String, String -> Pandoc -> Handler)]
exportFormats cfg = if pdfExport cfg
                       then ("PDF", respondPDF False) :
                            ("Beamer", respondPDF True) :
                            rest
                       else rest
   where rest = [ ("LaTeX",     respondLaTeX)     -- (description, writer)
                , ("ConTeXt",   respondConTeXt)
                , ("Texinfo",   respondTexinfo)
                , ("reST",      respondRST)
                , ("Markdown",  respondMarkdown)
                , ("CommonMark",respondCommonMark)
                , ("Plain text",respondPlain)
                , ("MediaWiki", respondMediaWiki)
                , ("Org-mode",  respondOrg)
                , ("ICML",      respondICML)
                , ("Textile",   respondTextile)
                , ("AsciiDoc",  respondAsciiDoc)
                , ("Man page",  respondMan)
                , ("DocBook",   respondDocbook)
                , ("DZSlides",  respondSlides "dzslides" writeDZSlides)
                , ("Slidy",     respondSlides "slidy" writeSlidy)
                , ("S5",        respondSlides "s5" writeS5)
                , ("EPUB",      respondEPUB)
                , ("ODT",       respondODT)
                , ("DOCX",      respondDocx)
                , ("RTF",       respondRTF) ]

pygmentsCss :: String
pygmentsCss = styleToCss pygments
                      , exportPage
        exportPage, showHighlightedSource, preview, applyPreCommitPlugins)
import Network.Gitit.Export (exportFormats)
import Data.Maybe (isNothing, isJust, fromJust)
                   T.setAttribute "exportbox"
                       (renderHtmlFragment $  exportBox base' cfg page rev) .
exportBox :: String -> Config -> String -> Maybe String -> Html
exportBox base' cfg page rev | not (isSourceCode page) =
  gui (base' ++ urlForPage page) ! [identifier "exportbox"] <<
    ([ textfield "revision" ! [thestyle "display: none;",
         value (fromJust rev)] | isJust rev ] ++
     [ select ! [name "format"] <<
         map ((\f -> option ! [value f] << f) . fst) (exportFormats cfg)
     , primHtmlChar "nbsp"
     , submit "export" "Export" ])
exportBox _ _ _ _ = noHtml

  -- | Allow PDF export?
  pdfExport            :: Bool,
               where commandList = ["update", "cancel", "export"]

Fixed code:
DocBook, or Emacs Org-mode markup can also be used.  Gitit can
be configured to display TeX math (using [texmath]) and
highlighted source code (using [highlighting-kate]).
By default, rendered pages, and highlighted source files
# customizations.  If no directory is
  when exists $ liftIO $ liftIO $ removeFile target
        showHighlightedSource, preview, applyPreCommitPlugins)
import Data.Maybe (isNothing)
               where commandList = ["update", "cancel"]