hsbt	2015-06-11 14:34:52 +0900 (Thu, 11 Jun 2015)

  New Revision: 50829

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=50829

  Log:
    * lib/rubygems.rb: bump version to 2.4.7 and 2.4.8. these versions fixed
      CVE-2015-3900.
    * lib/rubygems/remote_fetcher.rb: ditto.
    * test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900

  Modified files:
    trunk/ChangeLog
    trunk/lib/rubygems/remote_fetcher.rb
    trunk/lib/rubygems.rb
    trunk/test/rubygems/test_gem_remote_fetcher.rb
Index: ChangeLog
===================================================================
--- ChangeLog	(revision 50828)
+++ ChangeLog	(revision 50829)
@@ -1,3 +1,10 @@ https://github.com/ruby/ruby/blob/trunk/ChangeLog#L1
+Thu Jun 11 14:34:45 2015  SHIBATA Hiroshi  <hsbt@r...>
+
+	* lib/rubygems.rb: bump version to 2.4.7 and 2.4.8. these versions fixed
+	  CVE-2015-3900.
+	* lib/rubygems/remote_fetcher.rb: ditto.
+	* test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900
+
 Thu Jun 11 14:18:51 2015  SHIBATA Hiroshi  <hsbt@r...>
 
 	* lib/rubygems.rb: bump version to 2.4.6. It's missing change at r49774.
Index: lib/rubygems/remote_fetcher.rb
===================================================================
--- lib/rubygems/remote_fetcher.rb	(revision 50828)
+++ lib/rubygems/remote_fetcher.rb	(revision 50829)
@@ -94,7 +94,13 @@ class Gem::RemoteFetcher https://github.com/ruby/ruby/blob/trunk/lib/rubygems/remote_fetcher.rb#L94
     rescue Resolv::ResolvError
       uri
     else
-      URI.parse "#{uri.scheme}://#{res.target}#{uri.path}"
+      target = res.target.to_s.strip
+
+      if /\.#{Regexp.quote(host)}\z/ =~ target
+        return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
+      end
+
+      uri
     end
   end
 
Index: lib/rubygems.rb
===================================================================
--- lib/rubygems.rb	(revision 50828)
+++ lib/rubygems.rb	(revision 50829)
@@ -9,7 +9,7 @@ require 'rbconfig' https://github.com/ruby/ruby/blob/trunk/lib/rubygems.rb#L9
 require 'thread'
 
 module Gem
-  VERSION = '2.4.6'
+  VERSION = '2.4.8'
 end
 
 # Must be first since it unloads the prelude from 1.9.2
Index: test/rubygems/test_gem_remote_fetcher.rb
===================================================================
--- test/rubygems/test_gem_remote_fetcher.rb	(revision 50828)
+++ test/rubygems/test_gem_remote_fetcher.rb	(revision 50829)
@@ -167,6 +167,21 @@ gems: https://github.com/ruby/ruby/blob/trunk/test/rubygems/test_gem_remote_fetcher.rb#L167
   end
 
   def test_api_endpoint
+    uri = URI.parse "http://example.com/foo"
+    target = MiniTest::Mock.new
+    target.expect :target, "gems.example.com"
+
+    dns = MiniTest::Mock.new
+    dns.expect :getresource, target, [String, Object]
+
+    fetch = Gem::RemoteFetcher.new nil, dns
+    assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri)
+
+    target.verify
+    dns.verify
+  end
+
+  def test_api_endpoint_ignores_trans_domain_values
     uri = URI.parse "http://gems.example.com/foo"
     target = MiniTest::Mock.new
     target.expect :target, "blah.com"
@@ -175,8 +190,37 @@ gems: https://github.com/ruby/ruby/blob/trunk/test/rubygems/test_gem_remote_fetcher.rb#L190
     dns.expect :getresource, target, [String, Object]
 
     fetch = Gem::RemoteFetcher.new nil, dns
-    @fetcher = fetcher
-    assert_equal URI.parse("http://blah.com/foo"), fetch.api_endpoint(uri)
+    assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri)
+
+    target.verify
+    dns.verify
+  end
+
+  def test_api_endpoint_ignores_trans_domain_values_that_starts_with_original
+    uri = URI.parse "http://example.com/foo"
+    target = MiniTest::Mock.new
+    target.expect :target, "example.combadguy.com"
+
+    dns = MiniTest::Mock.new
+    dns.expect :getresource, target, [String, Object]
+
+    fetch = Gem::RemoteFetcher.new nil, dns
+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+
+    target.verify
+    dns.verify
+  end
+
+  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original
+    uri = URI.parse "http://example.com/foo"
+    target = MiniTest::Mock.new
+    target.expect :target, "badexample.com"
+
+    dns = MiniTest::Mock.new
+    dns.expect :getresource, target, [String, Object]
+
+    fetch = Gem::RemoteFetcher.new nil, dns
+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
 
     target.verify
     dns.verify

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/