[前][次][番号順一覧][スレッド一覧]

ruby-changes:50324

From: usa <ko1@a...>
Date: Sat, 17 Feb 2018 01:21:50 +0900 (JST)
Subject: [ruby-changes:50324] usa:r62439 (ruby_2_3): merge revision(s) 58471, 58493, 62436: [Backport #13505]

usa	2018-02-17 01:21:44 +0900 (Sat, 17 Feb 2018)

  New Revision: 62439

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=62439

  Log:
    merge revision(s) 58471,58493,62436: [Backport #13505]
    
    load.c: backtrace of circular require
    
    * load.c (load_lock): print backtrace of circular require via
      `Warning.warn` [ruby-core:80850] [Bug #13505]
    
      Send the backtrace of the circular require warning as a single String to Warning.warn
    
    * load.c: send as a single string.
    * error.c: expose the string formatted by rb_warning as rb_warning_string().
    * test/ruby/test_exception.rb: update tests.
      [ruby-core:80850] [Bug #13505]
    
    fix regexp literal warning.
    
    * test/rubygems/test_gem_server.rb: eliminate duplicated character class warning.
      [Bug #14481]

  Modified files:
    branches/ruby_2_3/ChangeLog
    branches/ruby_2_3/lib/rubygems/commands/owner_command.rb
    branches/ruby_2_3/lib/rubygems/package/tar_header.rb
    branches/ruby_2_3/lib/rubygems/package/tar_writer.rb
    branches/ruby_2_3/lib/rubygems/package.rb
    branches/ruby_2_3/lib/rubygems/server.rb
    branches/ruby_2_3/lib/rubygems/specification.rb
    branches/ruby_2_3/lib/rubygems.rb
    branches/ruby_2_3/test/rubygems/test_gem_commands_owner_command.rb
    branches/ruby_2_3/test/rubygems/test_gem_package.rb
    branches/ruby_2_3/test/rubygems/test_gem_package_tar_header.rb
    branches/ruby_2_3/test/rubygems/test_gem_server.rb
    branches/ruby_2_3/test/rubygems/test_gem_specification.rb
    branches/ruby_2_3/version.h
Index: ruby_2_3/lib/rubygems.rb
===================================================================
--- ruby_2_3/lib/rubygems.rb	(revision 62438)
+++ ruby_2_3/lib/rubygems.rb	(revision 62439)
@@ -10,7 +10,7 @@ require 'rbconfig' https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems.rb#L10
 require 'thread'
 
 module Gem
-  VERSION = '2.5.2.2'
+  VERSION = '2.5.2.3'
 end
 
 # Must be first since it unloads the prelude from 1.9.2
Index: ruby_2_3/lib/rubygems/specification.rb
===================================================================
--- ruby_2_3/lib/rubygems/specification.rb	(revision 62438)
+++ ruby_2_3/lib/rubygems/specification.rb	(revision 62439)
@@ -15,6 +15,7 @@ require 'rubygems/basic_specification' https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/specification.rb#L15
 require 'rubygems/stub_specification'
 require 'rubygems/util/list'
 require 'stringio'
+require 'uri'
 
 ##
 # The Specification class contains the information for a Gem.  Typically
@@ -2807,10 +2808,16 @@ http://spdx.org/licenses or '#{Gem::Lice https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/specification.rb#L2808
       raise Gem::InvalidSpecificationException, "#{lazy} is not a summary"
     end
 
-    if homepage and not homepage.empty? and
-       homepage !~ /\A[a-z][a-z\d+.-]*:/i then
-      raise Gem::InvalidSpecificationException,
-            "\"#{homepage}\" is not a URI"
+    # Make sure a homepage is valid HTTP/HTTPS URI
+    if homepage and not homepage.empty?
+      begin
+        homepage_uri = URI.parse(homepage)
+        unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+          raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
+        end
+      rescue URI::InvalidURIError
+        raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
+      end
     end
 
     # Warnings
Index: ruby_2_3/lib/rubygems/package.rb
===================================================================
--- ruby_2_3/lib/rubygems/package.rb	(revision 62438)
+++ ruby_2_3/lib/rubygems/package.rb	(revision 62439)
@@ -376,7 +376,7 @@ EOM https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/package.rb#L376
             File.dirname destination
           end
 
-        FileUtils.mkdir_p mkdir, mkdir_options
+        mkdir_p_safe mkdir, mkdir_options, destination_dir, entry.full_name
 
         open destination, 'wb' do |out|
           out.write entry.read
@@ -414,20 +414,35 @@ EOM https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/package.rb#L414
     raise Gem::Package::PathError.new(filename, destination_dir) if
       filename.start_with? '/'
 
-    destination_dir = File.realpath destination_dir if
-      File.respond_to? :realpath
+    destination_dir = realpath destination_dir
     destination_dir = File.expand_path destination_dir
 
     destination = File.join destination_dir, filename
     destination = File.expand_path destination
 
     raise Gem::Package::PathError.new(destination, destination_dir) unless
-      destination.start_with? destination_dir
+      destination.start_with? destination_dir + '/'
 
     destination.untaint
     destination
   end
 
+  def mkdir_p_safe mkdir, mkdir_options, destination_dir, file_name
+    destination_dir = realpath File.expand_path(destination_dir)
+    parts = mkdir.split(File::SEPARATOR)
+    parts.reduce do |path, basename|
+      path = realpath path  unless path == ""
+      path = File.expand_path(path + File::SEPARATOR + basename)
+      lstat = File.lstat path rescue nil
+      if !lstat || !lstat.directory?
+        unless path.start_with? destination_dir and (FileUtils.mkdir path, mkdir_options rescue false)
+          raise Gem::Package::PathError.new(file_name, destination_dir)
+        end
+      end
+      path
+    end
+  end
+
   ##
   # Loads a Gem::Specification from the TarEntry +entry+
 
@@ -601,6 +616,10 @@ EOM https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/package.rb#L616
       raise Gem::Package::FormatError.new \
               'package content (data.tar.gz) is missing', @gem
     end
+
+    if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any?
+      raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})"
+    end
   end
 
   ##
@@ -614,6 +633,16 @@ EOM https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/package.rb#L633
     raise Gem::Package::FormatError.new(e.message, entry.full_name)
   end
 
+  if File.respond_to? :realpath
+    def realpath file
+      File.realpath file
+    end
+  else
+    def realpath file
+      file
+    end
+  end
+
 end
 
 require 'rubygems/package/digest_io'
Index: ruby_2_3/lib/rubygems/commands/owner_command.rb
===================================================================
--- ruby_2_3/lib/rubygems/commands/owner_command.rb	(revision 62438)
+++ ruby_2_3/lib/rubygems/commands/owner_command.rb	(revision 62439)
@@ -62,7 +62,7 @@ permission to. https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/commands/owner_command.rb#L62
     end
 
     with_response response do |resp|
-      owners = YAML.load resp.body
+      owners = Gem::SafeYAML.load resp.body
 
       say "Owners for gem: #{name}"
       owners.each do |owner|
Index: ruby_2_3/lib/rubygems/package/tar_writer.rb
===================================================================
--- ruby_2_3/lib/rubygems/package/tar_writer.rb	(revision 62438)
+++ ruby_2_3/lib/rubygems/package/tar_writer.rb	(revision 62439)
@@ -196,6 +196,8 @@ class Gem::Package::TarWriter https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/package/tar_writer.rb#L196
       digest_name == signer.digest_name
     end
 
+    raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest
+
     if signer.key then
       signature = signer.sign signature_digest.digest
 
Index: ruby_2_3/lib/rubygems/package/tar_header.rb
===================================================================
--- ruby_2_3/lib/rubygems/package/tar_header.rb	(revision 62438)
+++ ruby_2_3/lib/rubygems/package/tar_header.rb	(revision 62439)
@@ -104,25 +104,30 @@ class Gem::Package::TarHeader https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/package/tar_header.rb#L104
     fields = header.unpack UNPACK_FORMAT
 
     new :name     => fields.shift,
-        :mode     => fields.shift.oct,
-        :uid      => fields.shift.oct,
-        :gid      => fields.shift.oct,
-        :size     => fields.shift.oct,
-        :mtime    => fields.shift.oct,
-        :checksum => fields.shift.oct,
+        :mode     => strict_oct(fields.shift),
+        :uid      => strict_oct(fields.shift),
+        :gid      => strict_oct(fields.shift),
+        :size     => strict_oct(fields.shift),
+        :mtime    => strict_oct(fields.shift),
+        :checksum => strict_oct(fields.shift),
         :typeflag => fields.shift,
         :linkname => fields.shift,
         :magic    => fields.shift,
-        :version  => fields.shift.oct,
+        :version  => strict_oct(fields.shift),
         :uname    => fields.shift,
         :gname    => fields.shift,
-        :devmajor => fields.shift.oct,
-        :devminor => fields.shift.oct,
+        :devmajor => strict_oct(fields.shift),
+        :devminor => strict_oct(fields.shift),
         :prefix   => fields.shift,
 
         :empty => empty
   end
 
+  def self.strict_oct(str)
+    return str.oct if str =~ /\A[0-7]*\z/
+    raise ArgumentError, "#{str.inspect} is not an octal string"
+  end
+
   ##
   # Creates a new TarHeader using +vals+
 
Index: ruby_2_3/lib/rubygems/server.rb
===================================================================
--- ruby_2_3/lib/rubygems/server.rb	(revision 62438)
+++ ruby_2_3/lib/rubygems/server.rb	(revision 62439)
@@ -626,6 +626,18 @@ div.method-source-code pre { color: #ffd https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/server.rb#L626
       executables = nil if executables.empty?
       executables.last["is_last"] = true if executables
 
+      # Pre-process spec homepage for safety reasons
+      begin
+        homepage_uri = URI.parse(spec.homepage)
+        if [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+          homepage_uri = spec.homepage
+        else
+          homepage_uri = "."
+        end
+      rescue URI::InvalidURIError
+        homepage_uri = "."
+      end
+
       specs << {
         "authors"             => spec.authors.sort.join(", "),
         "date"                => spec.date.to_s,
@@ -635,7 +647,7 @@ div.method-source-code pre { color: #ffd https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/rubygems/server.rb#L647
         "only_one_executable" => (executables && executables.size == 1),
         "full_name"           => spec.full_name,
         "has_deps"            => !deps.empty?,
-        "homepage"            => spec.homepage,
+        "homepage"            => homepage_uri,
         "name"                => spec.name,
         "rdoc_installed"      => Gem::RDoc.new(spec).rdoc_installed?,
         "ri_installed"        => Gem::RDoc.new(spec).ri_installed?,
Index: ruby_2_3/ChangeLog
===================================================================
--- ruby_2_3/ChangeLog	(revision 62438)
+++ ruby_2_3/ChangeLog	(revision 62439)
@@ -1,3 +1,22 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_3/ChangeLog#L1
+Sat Feb 17 01:21:00 2018  SHIBATA Hiroshi  <hsbt@r...>
+
+	load.c: backtrace of circular require
+
+	* load.c (load_lock): print backtrace of circular require via
+	  `Warning.warn` [ruby-core:80850] [Bug #13505]
+
+	  Send the backtrace of the circular require warning as a single String to Warning.warn
+
+	* load.c: send as a single string.
+	* error.c: expose the string formatted by rb_warning as rb_warning_string().
+	* test/ruby/test_exception.rb: update tests.
+	  [ruby-core:80850] [Bug #13505]
+
+	fix regexp literal warning.
+
+	* test/rubygems/test_gem_server.rb: eliminate duplicated character class warning.
+	  [Bug #14481]
+
 Thu Feb  1 04:00:53 2018  NARUSE, Yui  <naruse@r...>
 
 	Remove debug print introduced in r52386
Index: ruby_2_3/test/rubygems/test_gem_server.rb
===================================================================
--- ruby_2_3/test/rubygems/test_gem_server.rb	(revision 62438)
+++ ruby_2_3/test/rubygems/test_gem_server.rb	(revision 62439)
@@ -336,6 +336,171 @@ class TestGemServer < Gem::TestCase https://github.com/ruby/ruby/blob/trunk/ruby_2_3/test/rubygems/test_gem_server.rb#L336
     assert_match 'z 9', @res.body
   end
 
+
+  def test_xss_homepage_fix_289313
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'xsshomepagegem', 1
+    spec.homepage = "javascript:confirm(document.domain)"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'xsshomepagegem 1', @res.body
+
+    # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a 
+    # valid HTTP/HTTPS URL and could be unsafe in an HTML context.  We would prefer to throw an exception here,
+    # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be 
+    # validated in future versions of Gem::Specification.
+    #
+    # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
+    #
+    # Variant #1 - rdoc not installed
+    #
+    #   <b>xsshomepagegem 1</b>
+    #
+    #
+    #  <span title="rdoc not installed">[rdoc]</span>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    #
+    # Variant #2 - rdoc installed
+    #
+    #   <b>xsshomepagegem 1</b>
+    #
+    #
+    #  <a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    regex_match = /xsshomepagegem 1<\/b>[\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>)[\s]+<a href="\." title="\.">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
+  def test_invalid_homepage
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'invalidhomepagegem', 1
+    spec.homepage = "notavalidhomepageurl"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'invalidhomepagegem 1', @res.body
+
+    # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a 
+    # valid HTTP/HTTPS URL and could be unsafe in an HTML context.  We would prefer to throw an exception here,
+    # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be 
+    # validated in future versions of Gem::Specification.
+    #
+    # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
+    #
+    # Variant #1 - rdoc not installed
+    #
+    #   <b>invalidhomepagegem 1</b>
+    #
+    #
+    #  <span title="rdoc not installed">[rdoc]</span>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    #
+    # Variant #2 - rdoc installed
+    #
+    #   <b>invalidhomepagegem 1</b>
+    #
+    #
+    #  <a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    regex_match = /invalidhomepagegem 1<\/b>[\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>)[\s]+<a href="\." title="\.">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
+  def test_valid_homepage_http
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'validhomepagegemhttp', 1
+    spec.homepage = "http://rubygems.org"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'validhomepagegemhttp 1', @res.body
+
+    regex_match = /validhomepagegemhttp 1<\/b>[\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttp-1\/">\[rdoc\]<\/a>)[\s]+<a href="http:\/\/rubygems\.org" title="http:\/\/rubygems\.org">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
+  def test_valid_homepage_https
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'validhomepagegemhttps', 1
+    spec.homepage = "https://rubygems.org"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'validhomepagegemhttps 1', @res.body
+
+    regex_match = /validhomepagegemhttps 1<\/b>[\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttps-1\/">\[rdoc\]<\/a>)[\s]+<a href="https:\/\/rubygems\.org" title="https:\/\/rubygems\.org">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
   def test_specs
     data = StringIO.new "GET /specs.#{Gem.marshal_version} HTTP/1.0\r\n\r\n"
     @req.parse data
Index: ruby_2_3/test/rubygems/test_gem_commands_owner_command.rb
===================================================================
--- ruby_2_3/test/rubygems/test_gem_commands_owner_command.rb	(revision 62438)
+++ ruby_2_3/test/rubygems/test_gem_commands_owner_command.rb	(revision 62439)
@@ -36,6 +36,31 @@ EOF https://github.com/ruby/ruby/blob/trunk/ruby_2_3/test/rubygems/test_gem_commands_owner_command.rb#L36
     assert_match %r{- user2@e...}, @ui.output
   end
 
+  def test_show_owners_dont_load_objects
+    skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass)
+
+    response = <<EOF
+---
+- email: !ruby/object:Object {}
+  id: 1
+  handle: user1
+- email: user2@e...
+- id: 3
+  handle: user3
+- id: 4
+EOF
+
+    @fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
+
+    assert_raises Psych::DisallowedClass do
+      use_ui @ui do
+        @cmd.show_owners("freewill")
+      end
+    end
+
+  end
+
+
   def test_show_owners_setting_up_host_through_env_var
     response = "- email: user1@e...\n"
     host = "http://rubygems.example"
Index: ruby_2_3/test/rubygems/test_gem_package_tar_header.rb
===================================================================
--- ruby_2_3/test/rubygems/test_gem_package_tar_header.rb	(revision 62438)
+++ ruby_2_3/test/rubygems/test_gem_package_tar_header.rb	(revision 62439)
@@ -143,5 +143,26 @@ group\000\000\000\000\000\000\000\000\00 https://github.com/ruby/ruby/blob/trunk/ruby_2_3/test/rubygems/test_gem_package_tar_header.rb#L143
     assert_equal '012467', @tar_header.checksum
   end
 
+  def test_from_bad_octal
+    test_cases = [
+      "00000006,44\000", # bogus character
+      "00000006789\000", # non-octal digit
+      "+0000001234\000", # positive sign
+      "-0000001000\000", # negative sign
+      "0x000123abc\000", # radix prefix
+    ]
+
+    test_cases.each do |val|
+      header_s = @tar_header.to_s
+      # overwrite the size field
+      header_s[124, 12] = val
+      io = TempIO.new header_s
+      assert_raises ArgumentError do
+        new_header = Gem::Package::TarHeader.from io
+      end
+      io.close! if io.respond_to? :close!
+    end
+  end
+
 end
 
Index: ruby_2_3/test/rubygems/test_gem_specification.rb
===================================================================
--- ruby_2_3/test/rubygems/test_gem_specification.rb	(revision 62438)
+++ ruby_2_3/test/rubygems/test_gem_specification.rb	(revision 62439)
@@ -2879,7 +2879,22 @@ duplicate dependency on c (>= 1.2.3, dev https://github.com/ruby/ruby/blob/trunk/ruby_2_3/test/rubygems/test_gem_specification.rb#L2879
         @a1.validate
       end
 
-      assert_equal '"over at my cool site" is not a URI', e.message
+      assert_equal '"over at my cool site" is not a valid HTTP URI', e.message
+
+      @a1.homepage = 'ftp://rubygems.org'
+
+      e = assert_raises Gem::InvalidSpecificationException do
+        @a1.validate
+      end
+
+      assert_equal '"ftp://rubygems.org" is not a valid HTTP URI', e.message
+
+      @a1.homepage = 'http://rubygems.org'
+      assert_equal true, @a1.validate
+
+      @a1.homepage = 'https://rubygems.org'
+      assert_equal true, @a1.validate
+
     end
   end
 
Index: ruby_2_3/test/rubygems/test_gem_package.rb
===================================================================
--- ruby_2_3/test/rubygems/test_gem_package.rb	(revision 62438)
+++ ruby_2_3/test/rubygems/test_gem_package.rb	(revision 62439)
@@ -449,6 +449,31 @@ class TestGemPackage < Gem::Package::Tar https://github.com/ruby/ruby/blob/trunk/ruby_2_3/test/rubygems/test_gem_package.rb#L449
                  File.read(extracted)
   end
 
+  def test_extract_symlink_parent
+   skip 'symlink not supported' if Gem.win_platform?
+
+   package = Gem: (... truncated)

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/

[前][次][番号順一覧][スレッド一覧]