summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorhsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2019-03-05 03:32:58 +0000
committerhsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2019-03-05 03:32:58 +0000
commit08f8cfe14e0f8937e3bcf8a22becdc5ce60b920e ()
tree30977064b5f93f9ac5b01b2a676f6d6ffdcec652 /lib
parent593505ac6f802d2b5bff469425b7c76b65cc9b10 (diff)
Merge RubyGems upstream: 56c0bbb69e4506bda7ef7f447dfec5db820df20b
It fixed the multiple vulnerabilities. https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@67168 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--lib/rubygems/command_manager.rb16
-rw-r--r--lib/rubygems/commands/install_command.rb62
-rw-r--r--lib/rubygems/commands/owner_command.rb13
-rw-r--r--lib/rubygems/commands/push_command.rb8
-rw-r--r--lib/rubygems/commands/update_command.rb24
-rw-r--r--lib/rubygems/commands/yank_command.rb9
-rw-r--r--lib/rubygems/dependency_list.rb2
-rw-r--r--lib/rubygems/gemcutter_utilities.rb43
-rw-r--r--lib/rubygems/installer.rb31
-rw-r--r--lib/rubygems/installer_test_case.rb4
-rw-r--r--lib/rubygems/package.rb10
-rw-r--r--lib/rubygems/requirement.rb12
-rw-r--r--lib/rubygems/resolver/activation_request.rb15
-rw-r--r--lib/rubygems/test_case.rb6
-rw-r--r--lib/rubygems/test_utilities.rb15
-rw-r--r--lib/rubygems/user_interaction.rb5
16 files changed, 147 insertions, 128 deletions
@@ -7,6 +7,7 @@
require 'rubygems/command'
require 'rubygems/user_interaction'
##
# The command manager registers and installs all the individual sub-commands
@@ -32,6 +33,7 @@ require 'rubygems/user_interaction'
class Gem::CommandManager
include Gem::UserInteraction
BUILTIN_COMMANDS = [ # :nodoc:
@@ -145,12 +147,12 @@ class Gem::CommandManager
def run(args, build_args=nil)
process_args(args, build_args)
rescue StandardError, Timeout::Error => ex
- alert_error "While executing gem ... (#{ex.class})\n #{ex}"
ui.backtrace ex
terminate_interaction(1)
rescue Interrupt
- alert_error "Interrupted"
terminate_interaction(1)
end
@@ -167,8 +169,14 @@ class Gem::CommandManager
when '-v', '--version' then
say Gem::VERSION
terminate_interaction 0
when /^-/ then
- alert_error "Invalid option: #{args.first}. See 'gem --help'."
terminate_interaction 1
else
cmd_name = args.shift.downcase
@@ -224,7 +232,7 @@ class Gem::CommandManager
rescue Exception => e
e = load_error if load_error
- alert_error "Loading command: #{command_name} (#{e.class})\n\t#{e}"
ui.backtrace e
end
end
@@ -194,65 +194,21 @@ You can use `i` command instead of `install`.
req = Gem::Requirement.create(version)
- if options[:ignore_dependencies]
- install_gem_without_dependencies name, req
- else
- inst = Gem::DependencyInstaller.new options
- request_set = inst.resolve_dependencies name, req
-
- if options[:explain]
- say "Gems to install:"
-
- request_set.sorted_requests.each do |s|
- # shows platform specific gems if used
- say (plat = s.spec.platform) == Gem::Platform::RUBY ?
- " #{s.full_name}" :
- " #{s.full_name}-#{plat}"
- end
-
- return
- else
- @installed_specs.concat request_set.install options
- end
- show_install_errors inst.errors
- end
- end
- def install_gem_without_dependencies(name, req) # :nodoc:
- gem = nil
- if local?
- if name =~ /\.gem$/ and File.file? name
- source = Gem::Source::SpecificFile.new name
- spec = source.spec
- else
- source = Gem::Source::Local.new
- spec = source.find_gem name, req
end
- gem = source.download spec if spec
- end
-
- if remote? and not gem
- dependency = Gem::Dependency.new name, req
- dependency.prerelease = options[:prerelease]
-
- fetcher = Gem::RemoteFetcher.fetcher
- gem = fetcher.download_to_cache dependency
end
- inst = Gem::Installer.at gem, options
- inst.install
-
- require 'rubygems/dependency_installer'
- dinst = Gem::DependencyInstaller.new options
- dinst.installed_gems.replace [inst.spec]
-
- Gem.done_installing_hooks.each do |hook|
- hook.call dinst, [inst.spec]
- end unless Gem.done_installing_hooks.empty?
-
- @installed_specs.push(inst.spec)
end
def install_gems # :nodoc:
@@ -2,9 +2,11 @@
require 'rubygems/command'
require 'rubygems/local_remote_options'
require 'rubygems/gemcutter_utilities'
class Gem::Commands::OwnerCommand < Gem::Command
include Gem::LocalRemoteOptions
include Gem::GemcutterUtilities
@@ -68,7 +70,7 @@ permission to.
end
with_response response do |resp|
- owners = Gem::SafeYAML.load resp.body
say "Owners for gem: #{name}"
owners.each do |owner|
@@ -89,11 +91,6 @@ permission to.
owners.each do |owner|
begin
response = send_owner_request(method, name, owner)
-
- if need_otp? response
- response = send_owner_request(method, name, owner, true)
- end
-
action = method == :delete ? "Removing" : "Adding"
with_response response, "#{action} #{owner}"
@@ -105,11 +102,11 @@ permission to.
private
- def send_owner_request(method, name, owner, use_otp = false)
rubygems_api_request method, "api/v1/gems/#{name}/owners" do |request|
request.set_form_data 'email' => owner
request.add_field "Authorization", api_key
- request.add_field "OTP", options[:otp] if use_otp
end
end
@@ -119,22 +119,18 @@ You can upgrade or downgrade to the latest release version with:
response = send_push_request(name, args)
- if need_otp? response
- response = send_push_request(name, args, true)
- end
-
with_response response
end
private
- def send_push_request(name, args, use_otp = false)
rubygems_api_request(*args) do |request|
request.body = Gem.read_binary name
request.add_field "Content-Length", request.body.size
request.add_field "Content-Type", "application/octet-stream"
request.add_field "Authorization", api_key
- request.add_field "OTP", options[:otp] if use_otp
end
end
@@ -97,8 +97,8 @@ command to remove old versions.
if options[:explain]
say "Gems to update:"
- gems_to_update.each do |(name, version)|
- say " #{name}-#{version}"
end
return
@@ -146,18 +146,18 @@ command to remove old versions.
hig
end
- def highest_remote_version(spec) # :nodoc:
spec_tuples = fetch_remote_gems spec
matching_gems = spec_tuples.select do |g,_|
g.name == spec.name and g.match_platform?
end
- highest_remote_gem = matching_gems.max_by { |g,_| g.version }
highest_remote_gem ||= [Gem::NameTuple.null]
- highest_remote_gem.first.version
end
def install_rubygems(version) # :nodoc:
@@ -194,7 +194,7 @@ command to remove old versions.
}
gems_to_update = which_to_update hig, options[:args], :system
- _, up_ver = gems_to_update.first
target = if update_latest
up_ver
@@ -226,8 +226,8 @@ command to remove old versions.
end
def update_gems(gems_to_update)
- gems_to_update.uniq.sort.each do |(name, version)|
- update_gem name, version
end
@updated
@@ -271,10 +271,12 @@ command to remove old versions.
next if not gem_names.empty? and
gem_names.none? { |name| name == l_spec.name }
- highest_remote_ver = highest_remote_version l_spec
- if system or (l_spec.version < highest_remote_ver)
- result << [l_spec.name, [l_spec.version, highest_remote_ver].max]
end
end
@@ -33,6 +33,7 @@ data you will need to change them immediately and yank your gem.
add_version_option("remove")
add_platform_option("remove")
add_option('--host HOST',
'Yank from another gemcutter-compatible host',
@@ -62,7 +63,10 @@ data you will need to change them immediately and yank your gem.
def yank_gem(version, platform)
say "Yanking gem from #{self.host}..."
- yank_api_request(:delete, version, platform, "api/v1/gems/yank")
end
private
@@ -71,6 +75,7 @@ data you will need to change them immediately and yank your gem.
name = get_one_gem_name
response = rubygems_api_request(method, api, host) do |request|
request.add_field("Authorization", api_key)
data = {
'gem_name' => name,
@@ -80,7 +85,7 @@ data you will need to change them immediately and yank your gem.
request.set_form_data data
end
- say response.body
end
def get_version_from_requirements(requirements)
@@ -135,7 +135,7 @@ class Gem::DependencyList
end
##
- # Is is ok to remove a gemspec from the dependency list?
#
# If removing the gemspec creates breaks a currently ok dependency, then it
# is NOT ok to remove the gemspec.
@@ -1,11 +1,14 @@
# frozen_string_literal: true
require 'rubygems/remote_fetcher'
##
# Utility methods for using the RubyGems API.
module Gem::GemcutterUtilities
# TODO: move to Gem::Command
OptionParser.accept Symbol do |value|
value.to_sym
@@ -94,8 +97,22 @@ module Gem::GemcutterUtilities
uri = URI.parse "#{self.host}/#{path}"
request_method = Net::HTTP.const_get method.to_s.capitalize
- Gem::RemoteFetcher.fetcher.request(uri, request_method, &block)
end
##
@@ -123,13 +140,7 @@ module Gem::GemcutterUtilities
response = rubygems_api_request(:get, "api/v1/api_key",
sign_in_host) do |request|
request.basic_auth email, password
- end
-
- if need_otp? response
- response = rubygems_api_request(:get, "api/v1/api_key", sign_in_host) do |request|
- request.basic_auth email, password
- request.add_field "OTP", options[:otp]
- end
end
with_response response do |resp|
@@ -164,30 +175,24 @@ module Gem::GemcutterUtilities
if block_given?
yield response
else
- say response.body
end
else
message = response.body
message = "#{error_prefix}: #{message}" if error_prefix
- say message
terminate_interaction 1 # TODO: question this
end
end
##
# Returns true when the user has enabled multifactor authentication from
- # +response+ text.
- def need_otp?(response)
- return unless response.kind_of?(Net::HTTPUnauthorized) &&
- response.body.start_with?('You have enabled multifactor authentication')
- return true if options[:otp]
- say 'You have enabled multi-factor authentication. Please enter OTP code.'
- options[:otp] = ask 'Code: '
- true
- end
def set_api_key(host, key)
if host == Gem::DEFAULT_HOST
@@ -729,9 +729,26 @@ class Gem::Installer
unpack or File.writable?(gem_home)
end
- def verify_spec_name
- return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
- raise Gem::InstallError, "#{spec} has an invalid name"
end
##
@@ -844,7 +861,7 @@ TEXT
# without the full gem installed.
def extract_bin
- @package.extract_files gem_dir, "bin/*"
end
##
@@ -880,9 +897,11 @@ TEXT
def pre_install_checks
verify_gem_home options[:unpack]
- ensure_loadable_spec
- verify_spec_name
if options[:install_as_default]
Gem.ensure_default_gem_subdirectories gem_home
@@ -120,9 +120,9 @@ class Gem::InstallerTestCase < Gem::TestCase
# The executable is also written to the bin dir in @tmpdir and the installed
# gem directory for +spec+.
- def util_make_exec(spec = @spec, shebang = "#!/usr/bin/ruby")
spec.executables = %w[executable]
- spec.files << 'bin/executable'
exec_path = spec.bin_file "executable"
write_file exec_path do |io|
@@ -459,6 +459,16 @@ EOM
raise Gem::Package::PathError.new(destination, destination_dir) unless
destination.start_with? destination_dir + '/'
destination.untaint
destination
end
@@ -130,7 +130,6 @@ class Gem::Requirement
@requirements = [DefaultRequirement]
else
@requirements = requirements.map! { |r| self.class.parse r }
- sort_requirements!
end
end
@@ -144,7 +143,6 @@ class Gem::Requirement
new = new.map { |r| self.class.parse r }
@requirements.concat new
- sort_requirements!
end
##
@@ -186,7 +184,7 @@ class Gem::Requirement
end
def hash # :nodoc:
- requirements.hash
end
def marshal_dump # :nodoc:
@@ -295,14 +293,6 @@ class Gem::Requirement
end
end
- def sort_requirements! # :nodoc:
- @requirements.sort! do |l, r|
- comp = l.last <=> r.last # first, sort by the requirement's version
- next comp unless comp == 0
- l.first <=> r.first # then, sort by the operator (for stability)
- end
- end
-
end
class Gem::Version
@@ -77,7 +77,7 @@ class Gem::Resolver::ActivationRequest
# The full name of the specification to be activated.
def full_name
- @spec.full_name
end
alias_method :to_s, :full_name
@@ -183,4 +183,17 @@ class Gem::Resolver::ActivationRequest
@spec.version
end
end
@@ -134,6 +134,12 @@ class Gem::TestCase < (defined?(Minitest::Test) ? Minitest::Test : MiniTest::Uni
assert File.exist?(path), msg
end
##
# Sets the ENABLE_SHARED entry in RbConfig::CONFIG to +value+ and restores
# the original value when the block ends
@@ -13,6 +13,13 @@ require 'rubygems/remote_fetcher'
# @fetcher.data['http://gems.example.com/yaml'] = source_index.to_yaml
# Gem::RemoteFetcher.fetcher = @fetcher
#
# # invoke RubyGems code
#
# paths = @fetcher.paths
@@ -32,7 +39,7 @@ class Gem::FakeFetcher
@paths = []
end
- def find_data(path)
return File.read path.path if URI === path and 'file' == path.scheme
if URI === path and "URI::#{path.scheme.upcase}" != path.class.name
@@ -48,7 +55,10 @@ class Gem::FakeFetcher
raise Gem::RemoteFetcher::FetchError.new("no data for #{path}", path)
end
- @data[path]
end
def fetch_path(path, mtime = nil, head = false)
@@ -60,7 +70,6 @@ class Gem::FakeFetcher
if path.to_s =~ /gz$/ and not data.nil? and not data.empty?
data = Gem::Util.gunzip data
end
-
data
end
end
@@ -7,6 +7,7 @@
require 'rubygems/util'
require 'rubygems/deprecate'
##
# Module that defines the default UserInteraction. Any class including this
@@ -14,6 +15,8 @@ require 'rubygems/deprecate'
module Gem::DefaultUserInteraction
##
# The default UI is a class variable of the singleton class for this
# module.
@@ -162,7 +165,7 @@ module Gem::UserInteraction
# is true.
def verbose(msg = nil)
- say(msg || yield) if Gem.configuration.really_verbose
end
end
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-24 20:50:32 +0000