CVE-2017-17405

static VALUE
rb_f_open(int argc, VALUE *argv)
{
    ID to_open = 0;
    int redirect = FALSE;

    if (argc >= 1) {
		CONST_ID(to_open, "to_open");
		if (rb_respond_to(argv[0], to_open)) {
		    redirect = TRUE;
		}
		else {
		    VALUE tmp = argv[0];
		    FilePathValue(tmp);
		    if (NIL_P(tmp)) {
				redirect = TRUE;
		    }
		    else {
	                VALUE cmd = check_pipe_command(tmp);
	                if (!NIL_P(cmd)) {
					    argv[0] = cmd;
					    return rb_io_s_popen(argc, argv, rb_cIO);
					}
		    }
		}
    }
    if (redirect) {
		VALUE io = rb_funcallv(argv[0], to_open, argc-1, argv+1);
	
		if (rb_block_given_p()) {
		    return rb_ensure(rb_yield, io, io_close, io);
		}
		return io;
    }
    return rb_io_s_open(argc, argv, rb_cFile);
}

# s.rb
require 'socket'

class Session
  USERS = { 'demo' => '123456' }

  def initialize(sock, root)
    @ctrl = sock
    @root = root
    @cwd  = '/'
    @user = nil
    @authed = false
    @data_server = nil
  end

  def reply(code, msg)
    @ctrl.write("#{code} #{msg}\r\n")
  end

  # 虚拟路径 -> 真实路径。expand_path 会把 ".." 限制在 "/" 内,防止越权
  def resolve(path)
    virtual = path.to_s.start_with?('/') ? path : File.join(@cwd, path.to_s)
    virtual = File.expand_path(virtual, '/')
    [virtual, File.join(@root, virtual)]
  end

  def run
    reply 220, 'Mini Ruby FTP ready'
    while (line = @ctrl.gets)
      cmd, arg = line.strip.split(' ', 2)
      cmd = cmd.to_s.upcase

      unless @authed || %w[USER PASS QUIT].include?(cmd)
        reply 530, 'Please login first'
        next
      end

      case cmd
      when 'USER' then @user = arg; reply 331, 'Password required'
      when 'PASS'
        if @user == 'anonymous' || USERS[@user] && USERS[@user] == arg
          @authed = true
          reply 230, 'Login successful'
        else
          reply 530, 'Login incorrect'
        end
      when 'SYST' then reply 215, 'UNIX Type: L8'
      when 'TYPE' then reply 200, 'Type set'
      when 'PWD'  then reply 257, "\"#{@cwd}\" is current directory"
      when 'CWD'
        virtual, real = resolve(arg)
        if File.directory?(real)
          @cwd = virtual
          reply 250, 'Directory changed'
        else
          reply 550, 'No such directory'
        end
      when 'CDUP'
        @cwd = File.expand_path('..', @cwd)
        reply 250, 'Directory changed'
      when 'PASV' then pasv
      when 'LIST', 'NLST' then list(cmd, arg)
      when 'SIZE'
        _, real = resolve(arg)
        File.file?(real) ? reply(213, File.size(real)) : reply(550, 'No such file')
      when 'RETR' then retr(arg)
      when 'STOR' then stor(arg)
      when 'DELE'
        _, real = resolve(arg)
        File.file?(real) ? (File.delete(real); reply(250, 'Deleted')) : reply(550, 'No such file')
      when 'MKD'
        virtual, real = resolve(arg)
        Dir.mkdir(real) rescue (reply(550, 'Failed') and next)
        reply 257, "\"#{virtual}\" created"
      when 'QUIT' then reply 221, 'Goodbye'; break
      else reply 502, 'Command not implemented'
      end
    end
  rescue => e
    warn "session error: #{e.message}"
  ensure
    @data_server&.close
    @ctrl.close
  end

  private

  def pasv
    @data_server&.close
    @data_server = TCPServer.new('0.0.0.0', 0)        # 0 = 系统分配空闲端口
    port = @data_server.addr[1]
    ip   = @ctrl.local_address.ip_address.tr('.', ',')
    reply 227, "Entering Passive Mode (#{ip},#{port / 256},#{port % 256})"
  end

  # 建立数据连接并执行传输块
  def with_data
    return reply(425, 'Use PASV first') unless @data_server
    reply 150, 'Opening data connection'
    conn = @data_server.accept
    yield conn
    reply 226, 'Transfer complete'
  ensure
    conn&.close
    @data_server&.close
    @data_server = nil
  end

  def list(cmd, arg)
    arg = nil if arg.to_s.start_with?('-')            # 忽略 "-a" 之类的选项
    _, real = resolve(arg)
    return reply(550, 'No such directory') unless File.directory?(real)

    with_data do |conn|
      Dir.entries(real).reject { |n| n == '.' || n == '..' }.sort.each do |name|
        if cmd == 'NLST'
          conn.write("#{name}\r\n")
        else
          st = File.stat(File.join(real, name))
          type = st.directory? ? 'd' : '-'
          conn.write("#{type}rw-r--r-- 1 ftp ftp #{st.size} " \
                     "#{st.mtime.strftime('%b %e %H:%M')} #{name}\r\n")
        end
      end
    end
  end

  def retr(arg)
    _, real = resolve(arg)
    return reply(550, 'No such file') unless File.file?(real)
    with_data do |conn|
      File.open(real, 'rb') { |f| IO.copy_stream(f, conn) }
    end
  end

  def stor(arg)
    _, real = resolve(arg)
    with_data do |conn|
      File.open(real, 'wb') { |f| IO.copy_stream(conn, f) }
    end
  end
end

root = File.realpath(ARGV[0] || './ftp_root')
Dir.mkdir(root) unless Dir.exist?(root)
server = TCPServer.new('0.0.0.0', 2121)
puts "FTP server listening on 2121, root=#{root}"

loop do
  Thread.new(server.accept) { |sock| Session.new(sock, root).run }
end

--- ruby-2.4.2/ruby-2.4.2/lib/net/ftp.rb	2016-11-29 16:44:21.000000000 +0800
+++ ruby-2.4.3/ruby-2.4.3/lib/net/ftp.rb	2017-12-14 21:51:34.000000000 +0800
@@ -754,10 +754,10 @@
       if localfile
         if @resume
           rest_offset = File.size?(localfile)
-          f = open(localfile, "a")
+          f = File.open(localfile, "a")
         else
           rest_offset = nil
-          f = open(localfile, "w")
+          f = File.open(localfile, "w")
         end
       elsif !block_given?
         result = String.new
@@ -787,7 +787,7 @@
       f = nil
       result = nil
       if localfile
-        f = open(localfile, "w")
+        f = File.open(localfile, "w")
       elsif !block_given?
         result = String.new
       end
@@ -833,7 +833,7 @@
       else
         rest_offset = nil
       end
-      f = open(localfile)
+      f = File.open(localfile)
       begin
         f.binmode
         if rest_offset
@@ -852,7 +852,7 @@
     # passing in the transmitted data one line at a time.
     #
     def puttextfile(localfile, remotefile = File.basename(localfile), &block) # :yield: line
-      f = open(localfile)
+      f = File.open(localfile)
       begin
         storlines("STOR #{remotefile}", f, &block)
       ensure