Update Illuminate Database library for GHSA-3p32-j457-pg5x

[asmecher]

Issue Description

OJS, OMP, and OPS use the 3rd-party Illuminate/Database package for database interactions. Recently a potential vulnerability in this package was published: GHSA-3p32-j457-pg5x

Affected releases

PKP has not definitively confirmed whether its software can be attacked using this mechanism, but out of an abundance of caution recommends resolving it.

• OJS, OMP, and OPS 3.2.1-3 and newer are not affected.
• OJS, OMP, and OPS 3.2.0 (all builds), 3.2.1-0, 3.2.1-1, and 3.2.1-2 may be affected.
• All builds of OJS and OMP 3.1.1, and 3.1.2 may be affected.
• All builds of OJS 3.1.0 may be affected.
• OMP 3.1.0 and older are not affected. OJS 3.0.2 and older are not affected.

Correction Using Composer (recommended)

Depending on your version of OJS, OMP, or OPS, use one of the following patch URLs in the instructions below:

• OJS/OMP/OPS 3.2.1-x: https://github.com/pkp/pkp-lib/commit/339c2510a39fd288a0676a4edf98eebc74a7c739.diff
• OJS/OMP/OPS 3.2.0-x: https://github.com/pkp/pkp-lib/commit/54c57ad4410acf5306b9326f3bf8bf646b2753ea.diff
• OJS/OMP 3.1.2-x: https://github.com/pkp/pkp-lib/commit/1e6a456808133ae541720bbd0bdd41ad0aaca61e.diff
• OJS/OMP 3.1.1-x: https://github.com/pkp/pkp-lib/compare/983b2318d65b672e8da8baafc750a0707dca7a45...2f4c0a19e833e82da119349e3095ff3a74569526.diff
• OJS 3.1.0-x: https://github.com/pkp/pkp-lib/commit/c5fcab02cdf29b474d84c6b93cc9d0108131ce6d.diff

To use Composer to fix the issue, go into your OJS, OMP, or OPS installation directory, then:

cd lib/pkp
wget -q -O - "PATCH URL HERE" | patch -p1 --dry-run

This command only tests the patch application. A successful test application of the patch may look like:

checking file composer.json
checking file composer.lock
checking file lib/laravel-binding-6632.diff

Note that no errors are reported.

If the command appears to succeed, then run it again without the --dry-run option to actually apply the patch:

wget -q -O - "PATCH URL HERE" | patch -p1

Now use Composer to install the patch tool:

composer install

Now use Composer a second time to apply the patch:

composer install

WARNING: Watch for an indication that the laravel-binding-6632.diff patch was installed, e.g.:

Gathering patches for dependencies. This might take a minute.
  - Installing illuminate/database (v5.8.36): Loading from cache
  - Applying patches for illuminate/database
    lib/laravel-binding-6632.diff (Patch Laravel binding array issue)

If you see this, you are finished!

Correction By Patching Illuminate/Database Directly

Depending on your version of OJS, OMP, or OPS, use one of the following patch URLs in the instructions below:

• OJS/OMP/OPS 3.2.1-x: https://raw.githubusercontent.com/pkp/pkp-lib/stable-3_2_1/lib/laravel-binding-6632.diff
• OJS/OMP/OPS 3.2.0-x: https://raw.githubusercontent.com/pkp/pkp-lib/stable-3_2_0/lib/laravel-binding-6632.diff
• OJS/OMP 3.1.2-x: https://raw.githubusercontent.com/pkp/pkp-lib/stable-3_1_2/lib/laravel-binding-6632.diff
• OJS/OMP 3.1.1-x: https://raw.githubusercontent.com/pkp/pkp-lib/ojs-stable-3_1_1/lib/laravel-binding-6632.diff
  (use -p2 instead of -p4 when running the patch commands)
• OJS 3.1.0-x: https://raw.githubusercontent.com/pkp/pkp-lib/ojs-stable-3_1_0/lib/laravel-binding-6632.diff
  (use -p2 instead of -p4 when running the patch commands)

To directly patch the issue, go into your OJS, OMP, or OPS installation directory, then:

cd lib/pkp/lib/vendor/illuminate/database
wget -q -O - "PATCH URL HERE" | patch -p4 --dry-run

This command only tests the patch application. A successful test application of the patch may look like:

checking file Query/Builder.php
Hunk #1 succeeded at 658 (offset -40 lines).
Hunk #2 succeeded at 1050 (offset 7 lines).
Hunk #3 succeeded at 1118 (offset 7 lines).
Hunk #4 succeeded at 1159 (offset 7 lines).
Hunk #5 succeeded at 1200 (offset 7 lines).
Hunk #6 succeeded at 1245 (offset 7 lines).
Hunk #7 succeeded at 1290 (offset 7 lines).
Hunk #8 succeeded at 1598 (offset 5 lines).
Hunk #9 succeeded at 1731 (offset -11 lines).

Note that no errors are reported.

If the command appears to succeed, then run it again without the --dry-run option to actually apply the patch:

wget -q -O - "PATCH URL HERE" | patch -p4

If you see this, you are finished!

Note: This method involves modifying a dependency, and re-running Composer may cause the changes to be reverted. For this reason it's preferable to use the Composer-based update method documented above.

[asmecher]

Added details for back-porting to 3.1.2, 3.1.1, and 3.1.0. Adding the "Critical Issue" tag, though we don't yet know if an attack via this mechanism is viable with OJS, OMP, or OPS.