Version in base suite: 1.3.0-1

Base version: grunt_1.3.0-1
Target version: grunt_1.3.0-1+deb11u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/g/grunt/grunt_1.3.0-1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/g/grunt/grunt_1.3.0-1+deb11u1.dsc

 changelog                   |    7 +++
 patches/CVE-2022-0436.patch |   81 ++++++++++++++++++++++++++++++++++++++++++++
 patches/series              |    1 
 3 files changed, 89 insertions(+)

diff -Nru grunt-1.3.0/debian/changelog grunt-1.3.0/debian/changelog
--- grunt-1.3.0/debian/changelog	2020-09-06 21:31:45.000000000 +0000
+++ grunt-1.3.0/debian/changelog	2022-04-26 14:38:52.000000000 +0000
@@ -1,3 +1,10 @@
+grunt (1.3.0-1+deb11u1) bullseye; urgency=medium
+
+  * Team upload
+  * Fix path traversal (Closes: #1009676, CVE-2022-0436)
+
+ -- Yadd <yadd@debian.org>  Tue, 26 Apr 2022 16:38:52 +0200
+
 grunt (1.3.0-1) unstable; urgency=medium
 
   * Team upload
diff -Nru grunt-1.3.0/debian/patches/CVE-2022-0436.patch grunt-1.3.0/debian/patches/CVE-2022-0436.patch
--- grunt-1.3.0/debian/patches/CVE-2022-0436.patch	1970-01-01 00:00:00.000000000 +0000
+++ grunt-1.3.0/debian/patches/CVE-2022-0436.patch	2022-04-26 14:38:52.000000000 +0000
@@ -0,0 +1,81 @@
+Description: Handles symlinks by coping them as files or directories
+ This fixes "Path Traversal in GitHub repository gruntjs/grunt"
+Author: Vlad Filippov <vlad.filippov@gmail.com>
+Origin: upstream, https://github.com/gruntjs/grunt/commit/aad3d452
+Bug: https://huntr.dev/bounties/f55315e9-9f6d-4dbb-8c40-bae50c1ae92b
+Bug-Debian: https://bugs.debian.org/1009676
+Forwarded: not-needed
+Reviewed-By: Yadd <yadd@debian.org>
+Last-Update: 2022-04-26
+
+--- a/lib/grunt/file.js
++++ b/lib/grunt/file.js
+@@ -292,8 +292,11 @@
+ // Read a file, optionally processing its content, then write the output.
+ // Or read a directory, recursively creating directories, reading files,
+ // processing content, writing output.
++// Handles symlinks by coping them as files or directories.
+ file.copy = function copy(srcpath, destpath, options) {
+-  if (file.isDir(srcpath)) {
++  if (file._isSymbolicLink(srcpath)) {
++    file._copySymbolicLink(srcpath, destpath);
++  } else if (file.isDir(srcpath)) {
+     // Copy a directory, recursively.
+     // Explicitly create new dest directory.
+     file.mkdir(destpath);
+@@ -449,6 +452,24 @@
+   }
+ };
+ 
++file._isSymbolicLink = function() {
++  var filepath = path.join.apply(path, arguments);
++  return fs.lstatSync(filepath).isSymbolicLink();
++};
++
++file._copySymbolicLink = function(srcpath, destpath) {
++  var destdir = path.join(destpath, '..');
++  var fileBase = path.basename(srcpath);
++  // Use the correct relative path for the symlink
++  if (!grunt.file.isPathAbsolute(srcpath)) {
++    srcpath = path.relative(destdir, srcpath) || '.';
++  }
++  file.mkdir(destdir);
++  var mode = grunt.file.isDir(srcpath) ? 'dir' : 'file';
++  var destpath = path.join(destpath, fileBase);
++  return fs.symlinkSync(srcpath, destpath, mode);
++};
++
+ // Test to see if a filepath is contained within the CWD.
+ file.isPathInCwd = function() {
+   var filepath = path.join.apply(path, arguments);
+--- a/test/grunt/file_test.js
++++ b/test/grunt/file_test.js
+@@ -893,5 +893,28 @@
+       test.ok(grunt.file.isPathInCwd(path.resolve('deep')), 'subdirectory is in cwd');
+       test.done();
+     },
++    'symbolicLinkCopy': function(test) {
++      test.expect(4);
++      var srcfile = new Tempdir();
++      fs.symlinkSync(path.resolve('test/fixtures/octocat.png'), path.join(srcfile.path, 'octocat.png'), 'file');
++      // test symlink copy for files
++      var destdir = new Tempdir();
++      grunt.file.copy(path.join(srcfile.path, 'octocat.png'), destdir.path);
++      test.ok(fs.lstatSync(path.join(srcfile.path, 'octocat.png')).isSymbolicLink());
++      test.ok(fs.lstatSync(path.join(destdir.path, 'octocat.png')).isSymbolicLink());
++
++      // test symlink copy for directories
++      var srcdir = new Tempdir();
++      var destdir = new Tempdir();
++      var fixtures = path.resolve('test/fixtures');
++      var symlinkSource = path.join(srcdir.path, path.basename(fixtures));
++      console.log('symlinkSource', symlinkSource);
++      fs.symlinkSync(fixtures, symlinkSource, 'dir');
++
++      grunt.file.copy(symlinkSource, destdir.path);
++      test.ok(fs.lstatSync(symlinkSource).isSymbolicLink());
++      test.ok(fs.lstatSync(path.join(destdir.path, path.basename(fixtures))).isSymbolicLink());
++      test.done();
++    },
+   }
+ };
diff -Nru grunt-1.3.0/debian/patches/series grunt-1.3.0/debian/patches/series
--- grunt-1.3.0/debian/patches/series	2020-09-06 21:30:35.000000000 +0000
+++ grunt-1.3.0/debian/patches/series	2022-04-26 14:38:52.000000000 +0000
@@ -1,3 +1,4 @@
 add-root-variable.patch
 fix-for-coffescript.diff
 adapt-gruntfile.patch
+CVE-2022-0436.patch