| blob | 0d0ed6b20497dc9702abbb04b93f865840553874 |
1 diff --git lib/rubygems.rb lib/rubygems.rb
2 index 0685bcb3c6..a5a9202e56 100644
3 --- ruby-2.4.3/lib/rubygems.rb
4 +++ ruby-2.4.3/lib/rubygems.rb
5 @@ -10,7 +10,7 @@
6 require 'thread'
8 module Gem
9 - VERSION = "2.6.14"
10 + VERSION = "2.6.14.1"
11 end
13 # Must be first since it unloads the prelude from 1.9.2
14 diff --git lib/rubygems/commands/owner_command.rb lib/rubygems/commands/owner_command.rb
15 index 4b99434e87..2ee7f84462 100644
16 --- ruby-2.4.3/lib/rubygems/commands/owner_command.rb
17 +++ ruby-2.4.3/lib/rubygems/commands/owner_command.rb
18 @@ -62,7 +62,7 @@ def show_owners name
19 end
21 with_response response do |resp|
22 - owners = YAML.load resp.body
23 + owners = Gem::SafeYAML.load resp.body
25 say "Owners for gem: #{name}"
26 owners.each do |owner|
27 diff --git lib/rubygems/package.rb lib/rubygems/package.rb
28 index 77811ed5ec..b5a5fe2a26 100644
29 --- ruby-2.4.3/lib/rubygems/package.rb
30 +++ ruby-2.4.3/lib/rubygems/package.rb
31 @@ -378,7 +378,7 @@ def extract_tar_gz io, destination_dir, pattern = "*" # :nodoc:
32 File.dirname destination
33 end
35 - FileUtils.mkdir_p mkdir, mkdir_options
36 + mkdir_p_safe mkdir, mkdir_options, destination_dir, entry.full_name
38 open destination, 'wb' do |out|
39 out.write entry.read
40 @@ -416,20 +416,35 @@ def install_location filename, destination_dir # :nodoc:
41 raise Gem::Package::PathError.new(filename, destination_dir) if
42 filename.start_with? '/'
44 - destination_dir = File.realpath destination_dir if
45 - File.respond_to? :realpath
46 + destination_dir = realpath destination_dir
47 destination_dir = File.expand_path destination_dir
49 destination = File.join destination_dir, filename
50 destination = File.expand_path destination
52 raise Gem::Package::PathError.new(destination, destination_dir) unless
53 - destination.start_with? destination_dir
54 + destination.start_with? destination_dir + '/'
56 destination.untaint
57 destination
58 end
60 + def mkdir_p_safe mkdir, mkdir_options, destination_dir, file_name
61 + destination_dir = realpath File.expand_path(destination_dir)
62 + parts = mkdir.split(File::SEPARATOR)
63 + parts.reduce do |path, basename|
64 + path = realpath path unless path == ""
65 + path = File.expand_path(path + File::SEPARATOR + basename)
66 + lstat = File.lstat path rescue nil
67 + if !lstat || !lstat.directory?
68 + unless path.start_with? destination_dir and (FileUtils.mkdir path, mkdir_options rescue false)
69 + raise Gem::Package::PathError.new(file_name, destination_dir)
70 + end
71 + end
72 + path
73 + end
74 + end
75 +
76 ##
77 # Loads a Gem::Specification from the TarEntry +entry+
79 @@ -603,6 +618,10 @@ def verify_files gem
80 raise Gem::Package::FormatError.new \
81 'package content (data.tar.gz) is missing', @gem
82 end
83 +
84 + if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any?
85 + raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})"
86 + end
87 end
89 ##
90 @@ -616,6 +635,16 @@ def verify_gz entry # :nodoc:
91 raise Gem::Package::FormatError.new(e.message, entry.full_name)
92 end
94 + if File.respond_to? :realpath
95 + def realpath file
96 + File.realpath file
97 + end
98 + else
99 + def realpath file
100 + file
101 + end
102 + end
103 +
104 end
106 require 'rubygems/package/digest_io'
107 diff --git lib/rubygems/package/tar_header.rb lib/rubygems/package/tar_header.rb
108 index c54bd14d57..d557357114 100644
109 --- ruby-2.4.3/lib/rubygems/package/tar_header.rb
110 +++ ruby-2.4.3/lib/rubygems/package/tar_header.rb
111 @@ -104,25 +104,30 @@ def self.from(stream)
112 fields = header.unpack UNPACK_FORMAT
114 new :name => fields.shift,
115 - :mode => fields.shift.oct,
116 - :uid => fields.shift.oct,
117 - :gid => fields.shift.oct,
118 - :size => fields.shift.oct,
119 - :mtime => fields.shift.oct,
120 - :checksum => fields.shift.oct,
121 + :mode => strict_oct(fields.shift),
122 + :uid => strict_oct(fields.shift),
123 + :gid => strict_oct(fields.shift),
124 + :size => strict_oct(fields.shift),
125 + :mtime => strict_oct(fields.shift),
126 + :checksum => strict_oct(fields.shift),
127 :typeflag => fields.shift,
128 :linkname => fields.shift,
129 :magic => fields.shift,
130 - :version => fields.shift.oct,
131 + :version => strict_oct(fields.shift),
132 :uname => fields.shift,
133 :gname => fields.shift,
134 - :devmajor => fields.shift.oct,
135 - :devminor => fields.shift.oct,
136 + :devmajor => strict_oct(fields.shift),
137 + :devminor => strict_oct(fields.shift),
138 :prefix => fields.shift,
140 :empty => empty
141 end
143 + def self.strict_oct(str)
144 + return str.oct if str =~ /\A[0-7]*\z/
145 + raise ArgumentError, "#{str.inspect} is not an octal string"
146 + end
147 +
148 ##
149 # Creates a new TarHeader using +vals+
151 diff --git lib/rubygems/package/tar_writer.rb lib/rubygems/package/tar_writer.rb
152 index f68b8d4c5e..390f7851a3 100644
153 --- ruby-2.4.3/lib/rubygems/package/tar_writer.rb
154 +++ ruby-2.4.3/lib/rubygems/package/tar_writer.rb
155 @@ -196,6 +196,8 @@ def add_file_signed name, mode, signer
156 digest_name == signer.digest_name
157 end
159 + raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest
160 +
161 if signer.key then
162 signature = signer.sign signature_digest.digest
164 diff --git lib/rubygems/server.rb lib/rubygems/server.rb
165 index df4eb566d3..a7b5243ba0 100644
166 --- ruby-2.4.3/lib/rubygems/server.rb
167 +++ ruby-2.4.3/lib/rubygems/server.rb
168 @@ -631,6 +631,18 @@ def root(req, res)
169 executables = nil if executables.empty?
170 executables.last["is_last"] = true if executables
172 + # Pre-process spec homepage for safety reasons
173 + begin
174 + homepage_uri = URI.parse(spec.homepage)
175 + if [URI::HTTP, URI::HTTPS].member? homepage_uri.class
176 + homepage_uri = spec.homepage
177 + else
178 + homepage_uri = "."
179 + end
180 + rescue URI::InvalidURIError
181 + homepage_uri = "."
182 + end
183 +
184 specs << {
185 "authors" => spec.authors.sort.join(", "),
186 "date" => spec.date.to_s,
187 @@ -640,7 +652,7 @@ def root(req, res)
188 "only_one_executable" => (executables && executables.size == 1),
189 "full_name" => spec.full_name,
190 "has_deps" => !deps.empty?,
191 - "homepage" => spec.homepage,
192 + "homepage" => homepage_uri,
193 "name" => spec.name,
194 "rdoc_installed" => Gem::RDoc.new(spec).rdoc_installed?,
195 "ri_installed" => Gem::RDoc.new(spec).ri_installed?,
196 diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb
197 index 40e3a70d47..0a154b9001 100644
198 --- ruby-2.4.3/lib/rubygems/specification.rb
199 +++ ruby-2.4.3/lib/rubygems/specification.rb
200 @@ -15,6 +15,7 @@
201 require 'rubygems/stub_specification'
202 require 'rubygems/util/list'
203 require 'stringio'
204 +require 'uri'
206 ##
207 # The Specification class contains the information for a Gem. Typically
208 @@ -2813,10 +2814,16 @@ def validate packaging = true
209 raise Gem::InvalidSpecificationException, "#{lazy} is not a summary"
210 end
212 - if homepage and not homepage.empty? and
213 - homepage !~ /\A[a-z][a-z\d+.-]*:/i then
214 - raise Gem::InvalidSpecificationException,
215 - "\"#{homepage}\" is not a URI"
216 + # Make sure a homepage is valid HTTP/HTTPS URI
217 + if homepage and not homepage.empty?
218 + begin
219 + homepage_uri = URI.parse(homepage)
220 + unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
221 + raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
222 + end
223 + rescue URI::InvalidURIError
224 + raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
225 + end
226 end
228 # Warnings
229 diff --git test/rubygems/test_gem_commands_owner_command.rb test/rubygems/test_gem_commands_owner_command.rb
230 index 44652c1093..53cac4ce87 100644
231 --- ruby-2.4.3/test/rubygems/test_gem_commands_owner_command.rb
232 +++ ruby-2.4.3/test/rubygems/test_gem_commands_owner_command.rb
233 @@ -43,6 +43,31 @@ def test_show_owners
234 assert_match %r{- 4}, @ui.output
235 end
237 + def test_show_owners_dont_load_objects
238 + skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass)
239 +
240 + response = <<EOF
241 +---
242 +- email: !ruby/object:Object {}
243 + id: 1
244 + handle: user1
245 +- email: user2@example.com
246 +- id: 3
247 + handle: user3
248 +- id: 4
249 +EOF
250 +
251 + @fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
252 +
253 + assert_raises Psych::DisallowedClass do
254 + use_ui @ui do
255 + @cmd.show_owners("freewill")
256 + end
257 + end
258 +
259 + end
260 +
261 +
262 def test_show_owners_setting_up_host_through_env_var
263 response = "- email: user1@example.com\n"
264 host = "http://rubygems.example"
265 diff --git test/rubygems/test_gem_package.rb test/rubygems/test_gem_package.rb
266 index 9d47f0dea4..5b93475314 100644
267 --- ruby-2.4.3/test/rubygems/test_gem_package.rb
268 +++ ruby-2.4.3/test/rubygems/test_gem_package.rb
269 @@ -455,6 +455,31 @@ def test_extract_tar_gz_symlink_relative_path
270 File.read(extracted)
271 end
273 + def test_extract_symlink_parent
274 + skip 'symlink not supported' if Gem.win_platform?
275 +
276 + package = Gem::Package.new @gem
277 +
278 + tgz_io = util_tar_gz do |tar|
279 + tar.mkdir 'lib', 0755
280 + tar.add_symlink 'lib/link', '../..', 0644
281 + tar.add_file 'lib/link/outside.txt', 0644 do |io| io.write 'hi' end
282 + end
283 +
284 + # Extract into a subdirectory of @destination; if this test fails it writes
285 + # a file outside destination_subdir, but we want the file to remain inside
286 + # @destination so it will be cleaned up.
287 + destination_subdir = File.join @destination, 'subdir'
288 + FileUtils.mkdir_p destination_subdir
289 +
290 + e = assert_raises Gem::Package::PathError do
291 + package.extract_tar_gz tgz_io, destination_subdir
292 + end
293 +
294 + assert_equal("installing into parent path lib/link/outside.txt of " +
295 + "#{destination_subdir} is not allowed", e.message)
296 + end
297 +
298 def test_extract_tar_gz_directory
299 package = Gem::Package.new @gem
301 @@ -566,6 +591,21 @@ def test_install_location_relative
302 "#{@destination} is not allowed", e.message)
303 end
305 + def test_install_location_suffix
306 + package = Gem::Package.new @gem
307 +
308 + filename = "../#{File.basename(@destination)}suffix.rb"
309 +
310 + e = assert_raises Gem::Package::PathError do
311 + package.install_location filename, @destination
312 + end
313 +
314 + parent = File.expand_path File.join @destination, filename
315 +
316 + assert_equal("installing into parent path #{parent} of " +
317 + "#{@destination} is not allowed", e.message)
318 + end
319 +
320 def test_load_spec
321 entry = StringIO.new Gem.gzip @spec.to_yaml
322 def entry.full_name() 'metadata.gz' end
323 @@ -723,6 +763,32 @@ def test_verify_nonexistent
324 assert_match %r%nonexistent.gem$%, e.message
325 end
327 + def test_verify_duplicate_file
328 + FileUtils.mkdir_p 'lib'
329 + FileUtils.touch 'lib/code.rb'
330 +
331 + build = Gem::Package.new @gem
332 + build.spec = @spec
333 + build.setup_signer
334 + open @gem, 'wb' do |gem_io|
335 + Gem::Package::TarWriter.new gem_io do |gem|
336 + build.add_metadata gem
337 + build.add_contents gem
338 +
339 + gem.add_file_simple 'a.sig', 0444, 0
340 + gem.add_file_simple 'a.sig', 0444, 0
341 + end
342 + end
343 +
344 + package = Gem::Package.new @gem
345 +
346 + e = assert_raises Gem::Security::Exception do
347 + package.verify
348 + end
349 +
350 + assert_equal 'duplicate files in the package: ("a.sig")', e.message
351 + end
352 +
353 def test_verify_security_policy
354 skip 'openssl is missing' unless defined?(OpenSSL::SSL)
356 @@ -780,7 +846,13 @@ def test_verify_security_policy_checksum_missing
358 # write bogus data.tar.gz to foil signature
359 bogus_data = Gem.gzip 'hello'
360 - gem.add_file_simple 'data.tar.gz', 0444, bogus_data.length do |io|
361 + fake_signer = Class.new do
362 + def digest_name; 'SHA512'; end
363 + def digest_algorithm; Digest(:SHA512); end
364 + def key; 'key'; end
365 + def sign(*); 'fake_sig'; end
366 + end
367 + gem.add_file_signed 'data2.tar.gz', 0444, fake_signer.new do |io|
368 io.write bogus_data
369 end
371 diff --git test/rubygems/test_gem_package_tar_header.rb test/rubygems/test_gem_package_tar_header.rb
372 index d33877057d..43f508df45 100644
373 --- ruby-2.4.3/test/rubygems/test_gem_package_tar_header.rb
374 +++ ruby-2.4.3/test/rubygems/test_gem_package_tar_header.rb
375 @@ -143,5 +143,26 @@ def test_update_checksum
376 assert_equal '012467', @tar_header.checksum
377 end
379 + def test_from_bad_octal
380 + test_cases = [
381 + "00000006,44\000", # bogus character
382 + "00000006789\000", # non-octal digit
383 + "+0000001234\000", # positive sign
384 + "-0000001000\000", # negative sign
385 + "0x000123abc\000", # radix prefix
386 + ]
387 +
388 + test_cases.each do |val|
389 + header_s = @tar_header.to_s
390 + # overwrite the size field
391 + header_s[124, 12] = val
392 + io = TempIO.new header_s
393 + assert_raises ArgumentError do
394 + new_header = Gem::Package::TarHeader.from io
395 + end
396 + io.close! if io.respond_to? :close!
397 + end
398 + end
399 +
400 end
402 diff --git test/rubygems/test_gem_server.rb test/rubygems/test_gem_server.rb
403 index 4873fac5b6..96ed9194e9 100644
404 --- ruby-2.4.3/test/rubygems/test_gem_server.rb
405 +++ ruby-2.4.3/test/rubygems/test_gem_server.rb
406 @@ -336,6 +336,171 @@ def test_root_gemdirs
407 assert_match 'z 9', @res.body
408 end
410 +
411 + def test_xss_homepage_fix_289313
412 + data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
413 + dir = "#{@gemhome}2"
414 +
415 + spec = util_spec 'xsshomepagegem', 1
416 + spec.homepage = "javascript:confirm(document.domain)"
417 +
418 + specs_dir = File.join dir, 'specifications'
419 + FileUtils.mkdir_p specs_dir
420 +
421 + open File.join(specs_dir, spec.spec_name), 'w' do |io|
422 + io.write spec.to_ruby
423 + end
424 +
425 + server = Gem::Server.new dir, process_based_port, false
426 +
427 + @req.parse data
428 +
429 + server.root @req, @res
430 +
431 + assert_equal 200, @res.status
432 + assert_match 'xsshomepagegem 1', @res.body
433 +
434 + # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a
435 + # valid HTTP/HTTPS URL and could be unsafe in an HTML context. We would prefer to throw an exception here,
436 + # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be
437 + # validated in future versions of Gem::Specification.
438 + #
439 + # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
440 + #
441 + # Variant #1 - rdoc not installed
442 + #
443 + # <b>xsshomepagegem 1</b>
444 + #
445 + #
446 + # <span title="rdoc not installed">[rdoc]</span>
447 + #
448 + #
449 + #
450 + # <a href="." title=".">[www]</a>
451 + #
452 + # Variant #2 - rdoc installed
453 + #
454 + # <b>xsshomepagegem 1</b>
455 + #
456 + #
457 + # <a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>
458 + #
459 + #
460 + #
461 + # <a href="." title=".">[www]</a>
462 + regex_match = /xsshomepagegem 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="\." title="\.">\[www\]<\/a>/
463 + assert_match regex_match, @res.body
464 + end
465 +
466 + def test_invalid_homepage
467 + data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
468 + dir = "#{@gemhome}2"
469 +
470 + spec = util_spec 'invalidhomepagegem', 1
471 + spec.homepage = "notavalidhomepageurl"
472 +
473 + specs_dir = File.join dir, 'specifications'
474 + FileUtils.mkdir_p specs_dir
475 +
476 + open File.join(specs_dir, spec.spec_name), 'w' do |io|
477 + io.write spec.to_ruby
478 + end
479 +
480 + server = Gem::Server.new dir, process_based_port, false
481 +
482 + @req.parse data
483 +
484 + server.root @req, @res
485 +
486 + assert_equal 200, @res.status
487 + assert_match 'invalidhomepagegem 1', @res.body
488 +
489 + # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a
490 + # valid HTTP/HTTPS URL and could be unsafe in an HTML context. We would prefer to throw an exception here,
491 + # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be
492 + # validated in future versions of Gem::Specification.
493 + #
494 + # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
495 + #
496 + # Variant #1 - rdoc not installed
497 + #
498 + # <b>invalidhomepagegem 1</b>
499 + #
500 + #
501 + # <span title="rdoc not installed">[rdoc]</span>
502 + #
503 + #
504 + #
505 + # <a href="." title=".">[www]</a>
506 + #
507 + # Variant #2 - rdoc installed
508 + #
509 + # <b>invalidhomepagegem 1</b>
510 + #
511 + #
512 + # <a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>
513 + #
514 + #
515 + #
516 + # <a href="." title=".">[www]</a>
517 + regex_match = /invalidhomepagegem 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="\." title="\.">\[www\]<\/a>/
518 + assert_match regex_match, @res.body
519 + end
520 +
521 + def test_valid_homepage_http
522 + data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
523 + dir = "#{@gemhome}2"
524 +
525 + spec = util_spec 'validhomepagegemhttp', 1
526 + spec.homepage = "http://rubygems.org"
527 +
528 + specs_dir = File.join dir, 'specifications'
529 + FileUtils.mkdir_p specs_dir
530 +
531 + open File.join(specs_dir, spec.spec_name), 'w' do |io|
532 + io.write spec.to_ruby
533 + end
534 +
535 + server = Gem::Server.new dir, process_based_port, false
536 +
537 + @req.parse data
538 +
539 + server.root @req, @res
540 +
541 + assert_equal 200, @res.status
542 + assert_match 'validhomepagegemhttp 1', @res.body
543 +
544 + regex_match = /validhomepagegemhttp 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttp-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="http:\/\/rubygems\.org" title="http:\/\/rubygems\.org">\[www\]<\/a>/
545 + assert_match regex_match, @res.body
546 + end
547 +
548 + def test_valid_homepage_https
549 + data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
550 + dir = "#{@gemhome}2"
551 +
552 + spec = util_spec 'validhomepagegemhttps', 1
553 + spec.homepage = "https://rubygems.org"
554 +
555 + specs_dir = File.join dir, 'specifications'
556 + FileUtils.mkdir_p specs_dir
557 +
558 + open File.join(specs_dir, spec.spec_name), 'w' do |io|
559 + io.write spec.to_ruby
560 + end
561 +
562 + server = Gem::Server.new dir, process_based_port, false
563 +
564 + @req.parse data
565 +
566 + server.root @req, @res
567 +
568 + assert_equal 200, @res.status
569 + assert_match 'validhomepagegemhttps 1', @res.body
570 +
571 + regex_match = /validhomepagegemhttps 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttps-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="https:\/\/rubygems\.org" title="https:\/\/rubygems\.org">\[www\]<\/a>/
572 + assert_match regex_match, @res.body
573 + end
574 +
575 def test_specs
576 data = StringIO.new "GET /specs.#{Gem.marshal_version} HTTP/1.0\r\n\r\n"
577 @req.parse data
578 diff --git test/rubygems/test_gem_specification.rb test/rubygems/test_gem_specification.rb
579 index 0fcc11e78f..1c68826fb3 100644
580 --- ruby-2.4.3/test/rubygems/test_gem_specification.rb
581 +++ ruby-2.4.3/test/rubygems/test_gem_specification.rb
582 @@ -2890,7 +2890,22 @@ def test_validate_homepage
583 @a1.validate
584 end
586 - assert_equal '"over at my cool site" is not a URI', e.message
587 + assert_equal '"over at my cool site" is not a valid HTTP URI', e.message
588 +
589 + @a1.homepage = 'ftp://rubygems.org'
590 +
591 + e = assert_raises Gem::InvalidSpecificationException do
592 + @a1.validate
593 + end
594 +
595 + assert_equal '"ftp://rubygems.org" is not a valid HTTP URI', e.message
596 +
597 + @a1.homepage = 'http://rubygems.org'
598 + assert_equal true, @a1.validate
599 +
600 + @a1.homepage = 'https://rubygems.org'
601 + assert_equal true, @a1.validate
602 +
603 end
604 end