ruby-changes:54975
From: naruse <ko1@a...>
Date: Wed, 6 Mar 2019 18:01:55 +0900 (JST)
Subject: [ruby-changes:54975] naruse:r67182 (ruby_2_6): Backport RubyGems 3.0.3: [Backport #15637]
naruse 2019-03-06 18:01:48 +0900 (Wed, 06 Mar 2019) New Revision: 67182 https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=67182 Log: Backport RubyGems 3.0.3: [Backport #15637] * Fixed following vulnerabilities: * CVE-2019-8320: Delete directory using symlink when decompressing tar * CVE-2019-8321: Escape sequence injection vulnerability in verbose * CVE-2019-8322: Escape sequence injection vulnerability in gem owner * CVE-2019-8323: Escape sequence injection vulnerability in API response handling * CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution * CVE-2019-8325: Escape sequence injection vulnerability in errors * see also https://blog.rubygems.org/2019/03/05/3.0.3-released.html Modified files: branches/ruby_2_6/lib/rubygems/command_manager.rb branches/ruby_2_6/lib/rubygems/commands/owner_command.rb branches/ruby_2_6/lib/rubygems/gemcutter_utilities.rb branches/ruby_2_6/lib/rubygems/install_update_options.rb branches/ruby_2_6/lib/rubygems/installer.rb branches/ruby_2_6/lib/rubygems/package.rb branches/ruby_2_6/lib/rubygems/requirement.rb branches/ruby_2_6/lib/rubygems/test_case.rb branches/ruby_2_6/lib/rubygems/user_interaction.rb branches/ruby_2_6/lib/rubygems.rb branches/ruby_2_6/test/rubygems/test_gem.rb branches/ruby_2_6/test/rubygems/test_gem_installer.rb branches/ruby_2_6/test/rubygems/test_gem_package.rb branches/ruby_2_6/test/rubygems/test_gem_package_tar_writer.rb branches/ruby_2_6/test/rubygems/test_gem_requirement.rb branches/ruby_2_6/test/rubygems/test_gem_specification.rb branches/ruby_2_6/test/rubygems/test_gem_text.rb Index: ruby_2_6/test/rubygems/test_gem_package_tar_writer.rb =================================================================== --- ruby_2_6/test/rubygems/test_gem_package_tar_writer.rb (revision 67181) +++ ruby_2_6/test/rubygems/test_gem_package_tar_writer.rb (revision 67182) @@ -11,9 +11,12 @@ class TestGemPackageTarWriter < Gem::Pac https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_package_tar_writer.rb#L11 @data = 'abcde12345' @io = TempIO.new @tar_writer = Gem::Package::TarWriter.new @io + @epoch = ENV["SOURCE_DATE_EPOCH"] + ENV["SOURCE_DATE_EPOCH"] = nil end def teardown + ENV["SOURCE_DATE_EPOCH"] = @epoch @tar_writer.close unless @tar_writer.closed? @io.close! Index: ruby_2_6/test/rubygems/test_gem_requirement.rb =================================================================== --- ruby_2_6/test/rubygems/test_gem_requirement.rb (revision 67181) +++ ruby_2_6/test/rubygems/test_gem_requirement.rb (revision 67182) @@ -20,6 +20,12 @@ class TestGemRequirement < Gem::TestCase https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_requirement.rb#L20 refute_requirement_equal "= 1.2", "= 1.3" refute_requirement_equal "= 1.3", "= 1.2" + refute_requirement_equal "~> 1.3", "~> 1.3.0" + refute_requirement_equal "~> 1.3.0", "~> 1.3" + + assert_requirement_equal ["> 2", "~> 1.3"], ["> 2.0", "~> 1.3"] + assert_requirement_equal ["> 2.0", "~> 1.3"], ["> 2", "~> 1.3"] + refute_equal Object.new, req("= 1.2") refute_equal req("= 1.2"), Object.new end Index: ruby_2_6/test/rubygems/test_gem_installer.rb =================================================================== --- ruby_2_6/test/rubygems/test_gem_installer.rb (revision 67181) +++ ruby_2_6/test/rubygems/test_gem_installer.rb (revision 67182) @@ -1446,6 +1446,114 @@ gem 'other', version https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_installer.rb#L1446 end end + def test_pre_install_checks_malicious_name_before_eval + spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message + end + refute defined?(::Object::FROM_EVAL) + end + + def test_pre_install_checks_malicious_require_paths_before_eval + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.require_paths = ["malicious\n``"] + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message + end + end + + def test_pre_install_checks_malicious_extensions_before_eval + skip "mswin environment disallow to create file contained the carriage return code." if Gem.win_platform? + + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.extensions = ["malicious\n``"] + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message + end + end + + def test_pre_install_checks_malicious_specification_version_before_eval + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.specification_version = "malicious\n``" + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message + end + end + + def test_pre_install_checks_malicious_dependencies_before_eval + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.add_dependency "b\nfoo", '> 5' + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + @installer.ignore_dependencies = true + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message + end + end + def test_shebang util_make_exec @spec, "#!/usr/bin/ruby" Index: ruby_2_6/test/rubygems/test_gem_specification.rb =================================================================== --- ruby_2_6/test/rubygems/test_gem_specification.rb (revision 67181) +++ ruby_2_6/test/rubygems/test_gem_specification.rb (revision 67182) @@ -1719,8 +1719,11 @@ dependencies: [] https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_specification.rb#L1719 end def test_date_use_env_source_date_epoch + epoch = ENV["SOURCE_DATE_EPOCH"] ENV["SOURCE_DATE_EPOCH"] = "123456789" assert_equal Time.utc(1973,11,29,0,0,0), @a1.date + ensure + ENV["SOURCE_DATE_EPOCH"] = epoch end def test_dependencies Index: ruby_2_6/test/rubygems/test_gem_text.rb =================================================================== --- ruby_2_6/test/rubygems/test_gem_text.rb (revision 67181) +++ ruby_2_6/test/rubygems/test_gem_text.rb (revision 67182) @@ -89,4 +89,9 @@ Without the wrapping, the text might not https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_text.rb#L89 s = "ab" * 500_001 assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000) end + + def test_clean_text + assert_equal ".]2;nyan.", clean_text("\e]2;nyan\a") + end + end Index: ruby_2_6/test/rubygems/test_gem_package.rb =================================================================== --- ruby_2_6/test/rubygems/test_gem_package.rb (revision 67181) +++ ruby_2_6/test/rubygems/test_gem_package.rb (revision 67182) @@ -105,6 +105,7 @@ class TestGemPackage < Gem::Package::Tar https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_package.rb#L105 end def test_build_time_source_date_epoch + epoch = ENV["SOURCE_DATE_EPOCH"] ENV["SOURCE_DATE_EPOCH"] = "123456789" spec = Gem::Specification.new 'build', '1' @@ -118,6 +119,8 @@ class TestGemPackage < Gem::Package::Tar https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_package.rb#L119 package = Gem::Package.new spec.file_name assert_equal Time.at(ENV["SOURCE_DATE_EPOCH"].to_i).utc, package.build_time + ensure + ENV["SOURCE_DATE_EPOCH"] = epoch end def test_add_files @@ -521,6 +524,40 @@ class TestGemPackage < Gem::Package::Tar https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem_package.rb#L524 "#{destination_subdir} is not allowed", e.message) elsif win_platform? skip "symlink - must be admin with no UAC on Windows" + else + raise e + end + end + + def test_extract_symlink_parent_doesnt_delete_user_dir + package = Gem::Package.new @gem + + # Extract into a subdirectory of @destination; if this test fails it writes + # a file outside destination_subdir, but we want the file to remain inside + # @destination so it will be cleaned up. + destination_subdir = File.join @destination, 'subdir' + FileUtils.mkdir_p destination_subdir + + destination_user_dir = File.join @destination, 'user' + destination_user_subdir = File.join destination_user_dir, 'dir' + FileUtils.mkdir_p destination_user_subdir + + tgz_io = util_tar_gz do |tar| + tar.add_symlink 'link', destination_user_dir, 16877 + tar.add_symlink 'link/dir', '.', 16877 + end + + e = assert_raises(Gem::Package::PathError, Errno::EACCES) do + package.extract_tar_gz tgz_io, destination_subdir + end + + assert_path_exists destination_user_subdir + + if Gem::Package::PathError === e + assert_equal("installing into parent path #{destination_user_subdir} of " + + "#{destination_subdir} is not allowed", e.message) + elsif win_platform? + skip "symlink - must be admin with no UAC on Windows" else raise e end Index: ruby_2_6/test/rubygems/test_gem.rb =================================================================== --- ruby_2_6/test/rubygems/test_gem.rb (revision 67181) +++ ruby_2_6/test/rubygems/test_gem.rb (revision 67182) @@ -150,6 +150,11 @@ class TestGem < Gem::TestCase https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem.rb#L150 File.umask(umask) end + def test_self_install_permissions_with_format_executable + @format_executable = true + assert_self_install_permissions + end + def assert_self_install_permissions mask = /mingw|mswin/ =~ RUBY_PLATFORM ? 0700 : 0777 options = { @@ -157,6 +162,7 @@ class TestGem < Gem::TestCase https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem.rb#L162 :prog_mode => 0510, :data_mode => 0640, :wrappers => true, + :format_executable => !!(@format_executable if defined?(@format_executable)) } Dir.chdir @tempdir do Dir.mkdir 'bin' @@ -182,8 +188,10 @@ class TestGem < Gem::TestCase https://github.com/ruby/ruby/blob/trunk/ruby_2_6/test/rubygems/test_gem.rb#L188 prog_mode = (options[:prog_mode] & mask).to_s(8) dir_mode = (options[:dir_mode] & mask).to_s(8) data_mode = (options[:data_mode] & mask).to_s(8) + prog_name = 'foo.cmd' + prog_name = RUBY_INSTALL_NAME.sub('ruby', 'foo.cmd') if options[:format_executable] expected = { - "bin/#{RUBY_INSTALL_NAME.sub('ruby', 'foo.cmd')}" => prog_mode, + "bin/#{prog_name}" => prog_mode, 'gems/foo-1' => dir_mode, 'gems/foo-1/bin' => dir_mode, 'gems/foo-1/data' => dir_mode, Index: ruby_2_6/lib/rubygems.rb =================================================================== --- ruby_2_6/lib/rubygems.rb (revision 67181) +++ ruby_2_6/lib/rubygems.rb (revision 67182) @@ -9,7 +9,7 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems.rb#L9 require 'rbconfig' module Gem - VERSION = "3.0.1".freeze + VERSION = "3.0.3".freeze end # Must be first since it unloads the prelude from 1.9.2 Index: ruby_2_6/lib/rubygems/package.rb =================================================================== --- ruby_2_6/lib/rubygems/package.rb (revision 67181) +++ ruby_2_6/lib/rubygems/package.rb (revision 67182) @@ -456,6 +456,16 @@ EOM https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/package.rb#L456 raise Gem::Package::PathError.new(destination, destination_dir) unless destination.start_with? destination_dir + '/' + begin + real_destination = File.expand_path(File.realpath(destination)) + rescue + # it's fine if the destination doesn't exist, because rm -rf'ing it can't cause any damage + nil + else + raise Gem::Package::PathError.new(real_destination, destination_dir) unless + real_destination.start_with? destination_dir + '/' + end + destination.untaint destination end Index: ruby_2_6/lib/rubygems/installer.rb =================================================================== --- ruby_2_6/lib/rubygems/installer.rb (revision 67181) +++ ruby_2_6/lib/rubygems/installer.rb (revision 67182) @@ -725,9 +725,26 @@ class Gem::Installer https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/installer.rb#L725 unpack or File.writable?(gem_home) end - def verify_spec_name - return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN - raise Gem::InstallError, "#{spec} has an invalid name" + def verify_spec + unless spec.name =~ Gem::Specification::VALID_NAME_PATTERN + raise Gem::InstallError, "#{spec} has an invalid name" + end + + if spec.raw_require_paths.any?{|path| path =~ /\R/ } + raise Gem::InstallError, "#{spec} has an invalid require_paths" + end + + if spec.extensions.any?{|ext| ext =~ /\R/ } + raise Gem::InstallError, "#{spec} has an invalid extensions" + end + + unless spec.specification_version.to_s =~ /\A\d+\z/ + raise Gem::InstallError, "#{spec} has an invalid specification_version" + end + + if spec.dependencies.any? {|dep| dep.type =~ /\R/ || dep.name =~ /\R/ } + raise Gem::InstallError, "#{spec} has an invalid dependencies" + end end ## @@ -876,9 +893,11 @@ TEXT https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/installer.rb#L893 def pre_install_checks verify_gem_home options[:unpack] - ensure_loadable_spec + # The name and require_paths must be verified first, since it could contain + # ruby code that would be eval'ed in #ensure_loadable_spec + verify_spec - verify_spec_name + ensure_loadable_spec if options[:install_as_default] Gem.ensure_default_gem_subdirectories gem_home Index: ruby_2_6/lib/rubygems/command_manager.rb =================================================================== --- ruby_2_6/lib/rubygems/command_manager.rb (revision 67181) +++ ruby_2_6/lib/rubygems/command_manager.rb (revision 67182) @@ -7,6 +7,7 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/command_manager.rb#L7 require 'rubygems/command' require 'rubygems/user_interaction' +require 'rubygems/text' ## # The command manager registers and installs all the individual sub-commands @@ -32,6 +33,7 @@ require 'rubygems/user_interaction' https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/command_manager.rb#L33 class Gem::CommandManager + include Gem::Text include Gem::UserInteraction BUILTIN_COMMANDS = [ # :nodoc: @@ -145,12 +147,12 @@ class Gem::CommandManager https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/command_manager.rb#L147 def run(args, build_args=nil) process_args(args, build_args) rescue StandardError, Timeout::Error => ex - alert_error "While executing gem ... (#{ex.class})\n #{ex}" + alert_error clean_text("While executing gem ... (#{ex.class})\n #{ex}") ui.backtrace ex terminate_interaction(1) rescue Interrupt - alert_error "Interrupted" + alert_error clean_text("Interrupted") terminate_interaction(1) end @@ -168,7 +170,7 @@ class Gem::CommandManager https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/command_manager.rb#L170 say Gem::VERSION terminate_interaction 0 when /^-/ then - alert_error "Invalid option: #{args.first}. See 'gem --help'." + alert_error clean_text("Invalid option: #{args.first}. See 'gem --help'.") terminate_interaction 1 else cmd_name = args.shift.downcase @@ -224,7 +226,7 @@ class Gem::CommandManager https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/command_manager.rb#L226 rescue Exception => e e = load_error if load_error - alert_error "Loading command: #{command_name} (#{e.class})\n\t#{e}" + alert_error clean_text("Loading command: #{command_name} (#{e.class})\n\t#{e}") ui.backtrace e end end Index: ruby_2_6/lib/rubygems/test_case.rb =================================================================== --- ruby_2_6/lib/rubygems/test_case.rb (revision 67181) +++ ruby_2_6/lib/rubygems/test_case.rb (revision 67182) @@ -254,6 +254,7 @@ class Gem::TestCase < (defined?(Minitest https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/test_case.rb#L254 @orig_gem_env_requirements = ENV.to_hash ENV['GEM_VENDOR'] = nil + ENV['SOURCE_DATE_EPOCH'] = nil @current_dir = Dir.pwd @fetcher = nil Index: ruby_2_6/lib/rubygems/gemcutter_utilities.rb =================================================================== --- ruby_2_6/lib/rubygems/gemcutter_utilities.rb (revision 67181) +++ ruby_2_6/lib/rubygems/gemcutter_utilities.rb (revision 67182) @@ -1,11 +1,14 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/gemcutter_utilities.rb#L1 # frozen_string_literal: true require 'rubygems/remote_fetcher' +require 'rubygems/text' ## # Utility methods for using the RubyGems API. module Gem::GemcutterUtilities + include Gem::Text + # TODO: move to Gem::Command OptionParser.accept Symbol do |value| value.to_sym @@ -162,13 +165,13 @@ module Gem::GemcutterUtilities https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/gemcutter_utilities.rb#L165 if block_given? yield response else - say response.body + say clean_text(response.body) end else message = response.body message = "#{error_prefix}: #{message}" if error_prefix - say message + say clean_text(message) terminate_interaction 1 # TODO: question this end end Index: ruby_2_6/lib/rubygems/commands/owner_command.rb =================================================================== --- ruby_2_6/lib/rubygems/commands/owner_command.rb (revision 67181) +++ ruby_2_6/lib/rubygems/commands/owner_command.rb (revision 67182) @@ -2,8 +2,11 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/commands/owner_command.rb#L2 require 'rubygems/command' require 'rubygems/local_remote_options' require 'rubygems/gemcutter_utilities' +require 'rubygems/text' class Gem::Commands::OwnerCommand < Gem::Command + + include Gem::Text include Gem::LocalRemoteOptions include Gem::GemcutterUtilities @@ -65,7 +68,7 @@ permission to. https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/commands/owner_command.rb#L68 end with_response response do |resp| - owners = Gem::SafeYAML.load resp.body + owners = Gem::SafeYAML.load clean_text(resp.body) say "Owners for gem: #{name}" owners.each do |owner| Index: ruby_2_6/lib/rubygems/requirement.rb =================================================================== --- ruby_2_6/lib/rubygems/requirement.rb (revision 67181) +++ ruby_2_6/lib/rubygems/requirement.rb (revision 67182) @@ -267,7 +267,22 @@ class Gem::Requirement https://github.com/ruby/ruby/blob/trunk/ruby_2_6/lib/rubygems/requirement.rb#L267 def ==(other) # :nodoc: return unless Gem::Requirement === other - requirements == other.requirements + + # An == check is always necessary + return false unless requirements == other.requirements + + # An == check is sufficient unless any requirements use ~> + return true unless _tilde_requirements.any? + + # If any requirements use ~> we use the stricter `#eql?` that also checks + # that version precision is the same + _tilde_requirements.eql?(other._tilde_requirements) + end + + protected + + def _tilde_requirements + requirements.select { |r| r.first == "~>" } end private Index: ruby_2_6/lib/rubygems/user_interaction.rb =================================================================== --- ruby_2_6/lib/rubygems/user_ (... truncated) -- ML: ruby-changes@q... Info: http://www.atdot.net/~ko1/quickml/