https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
https://blog.rubygems.org/2018/02/15/2.7.6-released.html
Gbp-Pq: Name 0006-Rubygems-apply-upstream-patch-to-fix-multiple-vulner.patch
require 'thread'
module Gem
- VERSION = "2.7.3"
+ VERSION = "2.7.6"
end
# Must be first since it unloads the prelude from 1.9.2
# these are defined in Ruby 1.8.7, hence the need for this convoluted setup.
READ_BINARY_ERRORS = begin
- read_binary_errors = [Errno::EACCES, Errno::EROFS]
+ read_binary_errors = [Errno::EACCES, Errno::EROFS, Errno::ENOSYS]
read_binary_errors << Errno::ENOTSUP if Errno.const_defined?(:ENOTSUP)
read_binary_errors
end.freeze
# these are defined in Ruby 1.8.7.
WRITE_BINARY_ERRORS = begin
- write_binary_errors = []
+ write_binary_errors = [Errno::ENOSYS]
write_binary_errors << Errno::ENOTSUP if Errno.const_defined?(:ENOTSUP)
write_binary_errors
end.freeze
# Safely read a file in binary mode on all platforms.
def self.read_binary(path)
- open path, 'rb+' do |f|
+ File.open path, 'rb+' do |f|
f.flock(File::LOCK_EX)
f.read
end
rescue *READ_BINARY_ERRORS
- open path, 'rb' do |f|
+ File.open path, 'rb' do |f|
f.read
end
rescue Errno::ENOLCK # NFS
if Thread.main != Thread.current
raise
else
- open path, 'rb' do |f|
+ File.open path, 'rb' do |f|
f.read
end
end
if not File.exist?(options[:directory]) or
not File.directory?(options[:directory]) then
- alert_error "unknown directory name #{directory}."
+ alert_error "unknown directory name #{options[:directory]}."
terminate_interaction 1
else
indexer = Gem::Indexer.new options.delete(:directory), options
end
with_response response do |resp|
- owners = YAML.load resp.body
+ owners = Gem::SafeYAML.load resp.body
say "Owners for gem: #{name}"
owners.each do |owner|
def install_default_bundler_gem
return unless Gem::USE_BUNDLER_FOR_GEMDEPS
- mkdir_p Gem::Specification.default_specifications_dir
+ specs_dir = Gem::Specification.default_specifications_dir
+ File.join(options[:destdir], specs_dir) unless Gem.win_platform?
+ mkdir_p specs_dir
# Workaround for non-git environment.
gemspec = File.open('bundler/bundler.gemspec', 'rb'){|f| f.read.gsub(/`git ls-files -z`/, "''") }
bundler_spec = Gem::Specification.load("bundler/bundler.gemspec")
bundler_spec.files = Dir.chdir("bundler") { Dir["{*.md,{lib,exe,man}/**/*}"] }
bundler_spec.executables -= %w[bundler bundle_ruby]
- Dir.entries(Gem::Specification.default_specifications_dir).
+
+ # Remove bundler-*.gemspec in default specification directory.
+ Dir.entries(specs_dir).
select {|gs| gs.start_with?("bundler-") }.
- each {|gs| File.delete(File.join(Gem::Specification.default_specifications_dir, gs)) }
+ each {|gs| File.delete(File.join(specs_dir, gs)) }
- default_spec_path = File.join(Gem::Specification.default_specifications_dir, "#{bundler_spec.full_name}.gemspec")
+ default_spec_path = File.join(specs_dir, "#{bundler_spec.full_name}.gemspec")
Gem.write_binary(default_spec_path, bundler_spec.to_ruby)
bundler_spec = Gem::Specification.load(default_spec_path)
+ # Remove gemspec that was same version of vendored bundler.
+ normal_gemspec = File.join(Gem.default_dir, "specifications", "bundler-#{bundler_spec.version}.gemspec")
+ if File.file? normal_gemspec
+ File.delete normal_gemspec
+ end
+
+ # Remove gem files that were same version of vendored bundler.
if File.directory? bundler_spec.gems_dir
Dir.entries(bundler_spec.gems_dir).
- select {|default_gem| File.basename(default_gem).match(/^bundler-#{Gem::Version::VERSION_PATTERN}$/) }.
+ select {|default_gem| File.basename(default_gem) == "bundler-#{bundler_spec.version}" }.
each {|default_gem| rm_r File.join(bundler_spec.gems_dir, default_gem) }
end
- mkdir_p bundler_spec.bin_dir
- bundler_spec.executables.each {|e| cp File.join("bundler", bundler_spec.bindir, e), File.join(bundler_spec.bin_dir, e) }
+ bundler_bin_dir = File.join(Gem.default_dir, 'gems', bundler_spec.full_name, bundler_spec.bindir)
+ File.join(options[:destdir], bundler_bin_dir) unless Gem.win_platform?
+ mkdir_p bundler_bin_dir
+ bundler_spec.executables.each do |e|
+ cp File.join("bundler", bundler_spec.bindir, e), File.join(bundler_bin_dir, e)
+ end
if Gem.win_platform?
require 'rubygems/installer'
spec_file = File.basename spec.spec_file
- open spec_file, 'w' do |io|
+ File.open spec_file, 'w' do |io|
io.write metadata
end
else
metadata = nil
- open path, Gem.binary_mode do |io|
+ File.open path, Gem.binary_mode do |io|
tar = Gem::Package::TarReader.new io
tar.each_entry do |entry|
case entry.full_name
# Writes out this config file, replacing its source.
def write
- open config_file_name, 'w' do |io|
+ File.open config_file_name, 'w' do |io|
io.write to_yaml
end
end
FileUtils.mkdir_p @spec.extension_dir
- open destination, 'wb' do |io| io.puts output end
+ File.open destination, 'wb' do |io| io.puts output end
destination
end
require 'rubygems'
require 'rubygems/package'
require 'time'
+require 'tmpdir'
begin
gem 'builder'
@build_modern = options[:build_modern]
@dest_directory = directory
- @directory = File.join(Dir.tmpdir, "gem_generate_index_#{$$}")
+ @directory = Dir.mktmpdir 'gem_generate_index'
marshal_name = "Marshal.#{Gem.marshal_version}"
marshal_name = File.join @quick_marshal_dir, spec_file_name
marshal_zipped = Gem.deflate Marshal.dump(spec)
- open marshal_name, 'wb' do |io| io.write marshal_zipped end
+ File.open marshal_name, 'wb' do |io| io.write marshal_zipped end
files << marshal_name
zipped = Gem.deflate data
- open "#{filename}.#{extension}", 'wb' do |io|
+ File.open "#{filename}.#{extension}", 'wb' do |io|
io.write zipped
end
end
specs_index = compact_specs specs_index.uniq.sort
- open dest, 'wb' do |io|
+ File.open dest, 'wb' do |io|
Marshal.dump specs_index, io
end
end
ruby_executable = false
existing = nil
- open generated_bin, 'rb' do |io|
+ File.open generated_bin, 'rb' do |io|
next unless io.gets =~ /^#!/ # shebang
io.gets # blankline
# specifications directory.
def write_spec
- open spec_file, 'w' do |file|
+ File.open spec_file, 'w' do |file|
spec.installed_by_version = Gem.rubygems_version
file.puts spec.to_ruby_for_cache
def generate_bin # :nodoc:
return if spec.executables.nil? or spec.executables.empty?
- Dir.mkdir @bin_dir unless File.exist? @bin_dir
+ begin
+ Dir.mkdir @bin_dir
+ rescue SystemCallError
+ raise unless File.directory? @bin_dir
+ end
+
raise Gem::FilePermissionError.new(@bin_dir) unless File.writable? @bin_dir
spec.executables.each do |filename|
build_info_file = File.join build_info_dir, "#{spec.full_name}.info"
- open build_info_file, 'w' do |io|
+ File.open build_info_file, 'w' do |io|
@build_args.each do |arg|
io.puts arg
end
next unless stat.file?
tar.add_file_simple file, stat.mode, stat.size do |dst_io|
- open file, 'rb' do |src_io|
+ File.open file, 'rb' do |src_io|
dst_io.write src_io.read 16384 until src_io.eof?
end
end
File.dirname destination
end
- FileUtils.mkdir_p mkdir, mkdir_options
+ mkdir_p_safe mkdir, mkdir_options, destination_dir, entry.full_name
- open destination, 'wb' do |out|
+ File.open destination, 'wb' do |out|
out.write entry.read
FileUtils.chmod entry.header.mode, destination
end if entry.file?
raise Gem::Package::PathError.new(filename, destination_dir) if
filename.start_with? '/'
- destination_dir = File.realpath destination_dir if
- File.respond_to? :realpath
+ destination_dir = realpath destination_dir
destination_dir = File.expand_path destination_dir
destination = File.join destination_dir, filename
destination = File.expand_path destination
raise Gem::Package::PathError.new(destination, destination_dir) unless
- destination.start_with? destination_dir
+ destination.start_with? destination_dir + '/'
destination.untaint
destination
end
+ def mkdir_p_safe mkdir, mkdir_options, destination_dir, file_name
+ destination_dir = realpath File.expand_path(destination_dir)
+ parts = mkdir.split(File::SEPARATOR)
+ parts.reduce do |path, basename|
+ path = realpath path unless path == ""
+ path = File.expand_path(path + File::SEPARATOR + basename)
+ lstat = File.lstat path rescue nil
+ if !lstat || !lstat.directory?
+ unless path.start_with? destination_dir and (FileUtils.mkdir path, mkdir_options rescue false)
+ raise Gem::Package::PathError.new(file_name, destination_dir)
+ end
+ end
+ path
+ end
+ end
+
##
# Loads a Gem::Specification from the TarEntry +entry+
raise Gem::Package::FormatError.new \
'package content (data.tar.gz) is missing', @gem
end
+
+ if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any?
+ raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})"
+ end
end
##
raise Gem::Package::FormatError.new(e.message, entry.full_name)
end
+ if File.respond_to? :realpath
+ def realpath file
+ File.realpath file
+ end
+ else
+ def realpath file
+ file
+ end
+ end
+
end
require 'rubygems/package/digest_io'
end
def with_write_io &block
- open path, 'wb', &block
+ File.open path, 'wb', &block
end
def with_read_io &block
- open path, 'rb', &block
+ File.open path, 'rb', &block
end
end
FileUtils.mkdir_p File.dirname destination
- open destination, 'wb', entry['mode'] do |out|
+ File.open destination, 'wb', entry['mode'] do |out|
out.write file_data
end
fields = header.unpack UNPACK_FORMAT
new :name => fields.shift,
- :mode => fields.shift.oct,
- :uid => fields.shift.oct,
- :gid => fields.shift.oct,
- :size => fields.shift.oct,
- :mtime => fields.shift.oct,
- :checksum => fields.shift.oct,
+ :mode => strict_oct(fields.shift),
+ :uid => strict_oct(fields.shift),
+ :gid => strict_oct(fields.shift),
+ :size => strict_oct(fields.shift),
+ :mtime => strict_oct(fields.shift),
+ :checksum => strict_oct(fields.shift),
:typeflag => fields.shift,
:linkname => fields.shift,
:magic => fields.shift,
- :version => fields.shift.oct,
+ :version => strict_oct(fields.shift),
:uname => fields.shift,
:gname => fields.shift,
- :devmajor => fields.shift.oct,
- :devminor => fields.shift.oct,
+ :devmajor => strict_oct(fields.shift),
+ :devminor => strict_oct(fields.shift),
:prefix => fields.shift,
:empty => empty
end
+ def self.strict_oct(str)
+ return str.oct if str =~ /\A[0-7]*\z/
+ raise ArgumentError, "#{str.inspect} is not an octal string"
+ end
+
##
# Creates a new TarHeader using +vals+
digest_name == signer.digest_name
end
+ raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest
+
if signer.key then
signature = signer.sign signature_digest.digest
def write
content = to_s
- open "#{@gem_deps_file}.lock", 'w' do |io|
+ File.open "#{@gem_deps_file}.lock", 'w' do |io|
io.write content
end
end
def self.write pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER
path = File.expand_path path
- open path, 'wb', permissions do |io|
+ File.open path, 'wb', permissions do |io|
if passphrase and cipher
io.write pemmable.to_pem cipher, passphrase
else
destination = cert_path certificate
- open destination, 'wb', @permissions[:trusted_cert] do |io|
+ File.open destination, 'wb', @permissions[:trusted_cert] do |io|
io.write certificate.to_pem
end
end
executables = nil if executables.empty?
executables.last["is_last"] = true if executables
+ # Pre-process spec homepage for safety reasons
+ begin
+ homepage_uri = URI.parse(spec.homepage)
+ if [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+ homepage_uri = spec.homepage
+ else
+ homepage_uri = "."
+ end
+ rescue URI::InvalidURIError
+ homepage_uri = "."
+ end
+
specs << {
"authors" => spec.authors.sort.join(", "),
"date" => spec.date.to_s,
"only_one_executable" => (executables && executables.size == 1),
"full_name" => spec.full_name,
"has_deps" => !deps.empty?,
- "homepage" => spec.homepage,
+ "homepage" => homepage_uri,
"name" => spec.name,
"rdoc_installed" => Gem::RDoc.new(spec).rdoc_installed?,
"ri_installed" => Gem::RDoc.new(spec).ri_installed?,
if update_cache? then
FileUtils.mkdir_p cache_dir
- open local_spec, 'wb' do |io|
+ File.open local_spec, 'wb' do |io|
io.write spec
end
end
require 'rubygems/stub_specification'
require 'rubygems/util/list'
require 'stringio'
+require 'uri'
##
# The Specification class contains the information for a Gem. Typically
raise Gem::InvalidSpecificationException, "#{lazy} is not a summary"
end
- if homepage and not homepage.empty? and
- homepage !~ /\A[a-z][a-z\d+.-]*:/i then
- raise Gem::InvalidSpecificationException,
- "\"#{homepage}\" is not a URI"
+ # Make sure a homepage is valid HTTP/HTTPS URI
+ if homepage and not homepage.empty?
+ begin
+ homepage_uri = URI.parse(homepage)
+ unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+ raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
+ end
+ rescue URI::InvalidURIError
+ raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
+ end
end
# Warnings
unless @data
begin
saved_lineno = $.
+
+ # TODO It should be use `File.open`, but bundler-1.16.1 example expects Kernel#open.
open loaded_from, OPEN_MODE do |file|
begin
file.readline # discard encoding line
gemspec = "#{name}.gemspec"
- open File.join(directory, gemspec), 'w' do |io|
+ File.open File.join(directory, gemspec), 'w' do |io|
io.write git_spec.to_ruby
end
# Reads a Marshal file at +path+
def read_cache(path)
- open path.dup.untaint, 'rb' do |io|
+ File.open path.dup.untaint, 'rb' do |io|
Marshal.load io.read
end
end
dir = File.dirname path
FileUtils.mkdir_p dir unless File.directory? dir
- open path, 'wb' do |io|
+ File.open path, 'wb' do |io|
yield io if block_given?
end
install_default_specs(*specs)
specs.each do |spec|
- open spec.loaded_from, 'w' do |io|
+ File.open spec.loaded_from, 'w' do |io|
io.write spec.to_ruby_for_cache
end
end
yield specification if block_given?
end
- open File.join(directory, "#{name}.gemspec"), 'w' do |io|
+ File.open File.join(directory, "#{name}.gemspec"), 'w' do |io|
io.write vendor_spec.to_ruby
end
end
def write_spec spec # :nodoc:
- open spec.spec_file, 'w' do |io|
+ File.open spec.spec_file, 'w' do |io|
io.write spec.to_ruby_for_cache
end
end
here = File.expand_path directory
loop do
- Dir.chdir here, &block
+ Dir.chdir here, &block rescue Errno::EACCES
+
new_here = File.expand_path('..', here)
return if new_here == here # toplevel
here = new_here
# gem_path:: [String] Path to gem file
def verify_gem_file(gem_path)
- open gem_path, Gem.binary_mode do |file|
+ File.open gem_path, Gem.binary_mode do |file|
gem_data = file.read
verify_gem gem_data
end
good, gone, unreadable = nil, nil, nil, nil
- open gem_path, Gem.binary_mode do |file|
+ File.open gem_path, Gem.binary_mode do |file|
package = Gem::Package.new gem_path
good, gone = package.contents.partition { |file_name|
source = File.join gem_directory, entry['path']
- open source, Gem.binary_mode do |f|
+ File.open source, Gem.binary_mode do |f|
unless f.read == data then
errors[gem_name][entry['path']] = "Modified from original"
end
require 'tmpdir'
# TODO: push this up to test_case.rb once battle tested
-$SAFE=1
+
$LOAD_PATH.map! do |path|
path.dup.untaint
end
assert File.directory?(util_cache_dir)
end
- unless win_platform? then # only for FS that support write protection
+ unless win_platform? || Process.uid.zero? then # only for FS that support write protection
def test_self_ensure_gem_directories_write_protected
gemdir = File.join @tempdir, "egd"
FileUtils.rm_r gemdir rescue nil
end
def test_self_read_binary
- open 'test', 'w' do |io|
+ File.open 'test', 'w' do |io|
io.write "\xCF\x80"
end
spec = Gem::Specification.find { |s| s == spec }
refute spec.activated?
- open gem_deps_file, 'w' do |io|
+ File.open gem_deps_file, 'w' do |io|
io.write 'gem "a"'
end
refute spec.activated?
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.write 'gem "a"'
end
refute spec.activated?
- open 'Gemfile', 'w' do |io|
+ File.open 'Gemfile', 'w' do |io|
io.write 'gem "a"'
end
refute spec.activated?
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.write 'gem "a"'
end
skip 'Insecure operation - read' if RUBY_VERSION <= "1.8.7"
rubygems_gemdeps, ENV['RUBYGEMS_GEMDEPS'] = ENV['RUBYGEMS_GEMDEPS'], 'x'
- open 'x', 'w' do |io|
+ File.open 'x', 'w' do |io|
io.write 'gem "a"'
end
spec = Gem::Specification.find { |s| s == spec }
refute spec.activated?
- open 'x', 'w' do |io|
+ File.open 'x', 'w' do |io|
io.write 'gem "a"'
end
assert_path_exists @a_1_1.gem_dir
ensure
FileUtils.chmod 0755, @gemhome
- end unless win_platform?
+ end unless win_platform? || Process.uid.zero?
def test_execute_dry_run
@cmd.options[:args] = %w[a]
def test_execute_no_user_install
skip 'skipped on MS Windows (chmod has no effect)' if win_platform?
+ skip 'skipped in root privilege' if Process.uid.zero?
specs = spec_fetcher do |fetcher|
fetcher.gem 'a', 2
assert_match %r{- 4}, @ui.output
end
+ def test_show_owners_dont_load_objects
+ skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass)
+
+ response = <<EOF
+---
+- email: !ruby/object:Object {}
+ id: 1
+ handle: user1
+- email: user2@example.com
+- id: 3
+ handle: user3
+- id: 4
+EOF
+
+ @fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
+
+ assert_raises Psych::DisallowedClass do
+ use_ui @ui do
+ @cmd.show_owners("freewill")
+ end
+ end
+
+ end
+
+
def test_show_owners_setting_up_host_through_env_var
response = "- email: user1@example.com\n"
host = "http://rubygems.example"
}
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
Gem.configuration.load_api_keys
}
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
Gem.configuration.load_api_keys
}
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
Gem.configuration.load_api_keys
}
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
Gem.configuration.load_api_keys
}
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
Gem.configuration.load_api_keys
class TestGemCommandsSetupCommand < Gem::TestCase
+ bundler_gemspec = File.expand_path("../../../bundler/lib/bundler/version.rb", __FILE__)
+ if File.exist?(bundler_gemspec)
+ BUNDLER_VERS = File.read(bundler_gemspec).match(/VERSION = "(#{Gem::Version::VERSION_PATTERN})"/)[1]
+ else
+ BUNDLER_VERS = "1.16.1"
+ end
+
def setup
super
FileUtils.mkdir_p 'bin'
FileUtils.mkdir_p 'lib/rubygems/ssl_certs/rubygems.org'
- open 'bin/gem', 'w' do |io| io.puts '# gem' end
- open 'lib/rubygems.rb', 'w' do |io| io.puts '# rubygems.rb' end
- open 'lib/rubygems/test_case.rb', 'w' do |io| io.puts '# test_case.rb' end
- open 'lib/rubygems/ssl_certs/rubygems.org/foo.pem', 'w' do |io| io.puts 'PEM' end
+ File.open 'bin/gem', 'w' do |io| io.puts '# gem' end
+ File.open 'lib/rubygems.rb', 'w' do |io| io.puts '# rubygems.rb' end
+ File.open 'lib/rubygems/test_case.rb', 'w' do |io| io.puts '# test_case.rb' end
+ File.open 'lib/rubygems/ssl_certs/rubygems.org/foo.pem', 'w' do |io| io.puts 'PEM' end
FileUtils.mkdir_p 'bundler/exe'
FileUtils.mkdir_p 'bundler/lib/bundler'
- open 'bundler/exe/bundle', 'w' do |io| io.puts '# bundle' end
- open 'bundler/lib/bundler.rb', 'w' do |io| io.puts '# bundler.rb' end
- open 'bundler/lib/bundler/b.rb', 'w' do |io| io.puts '# b.rb' end
+ File.open 'bundler/exe/bundle', 'w' do |io| io.puts '# bundle' end
+ File.open 'bundler/lib/bundler.rb', 'w' do |io| io.puts '# bundler.rb' end
+ File.open 'bundler/lib/bundler/b.rb', 'w' do |io| io.puts '# b.rb' end
FileUtils.mkdir_p 'default/gems'
gemspec = Gem::Specification.new
gemspec.name = "bundler"
- gemspec.version = "1.16.0"
+ gemspec.version = BUNDLER_VERS
gemspec.bindir = "exe"
gemspec.executables = ["bundle"]
- open 'bundler/bundler.gemspec', 'w' do |io|
+ File.open 'bundler/bundler.gemspec', 'w' do |io|
io.puts gemspec.to_ruby
end
end
FileUtils.mkdir_p File.join(Gem.default_dir, "specifications")
+
+ open(File.join(Gem.default_dir, "specifications", "bundler-#{BUNDLER_VERS}.gemspec"), 'w') do |io|
+ io.puts "# bundler-#{BUNDLER_VERS}"
+ end
+
open(File.join(Gem.default_dir, "specifications", "bundler-audit-1.0.0.gemspec"), 'w') do |io|
io.puts '# bundler-audit'
end
default_dir = Gem::Specification.default_specifications_dir
+ # expect to remove other versions of bundler gemspecs on default specification directory.
refute_path_exists File.join(default_dir, "bundler-1.15.4.gemspec")
- refute_path_exists 'default/gems/bundler-1.15.4'
-
- assert_path_exists File.join(default_dir, "bundler-1.16.0.gemspec")
- assert_path_exists 'default/gems/bundler-1.16.0'
+ assert_path_exists File.join(default_dir, "bundler-#{BUNDLER_VERS}.gemspec")
+ # expect to not remove bundler-* gemspecs.
assert_path_exists File.join(Gem.default_dir, "specifications", "bundler-audit-1.0.0.gemspec")
+
+ # expect to remove normal gem that was same version. because it's promoted default gems.
+ refute_path_exists File.join(Gem.default_dir, "specifications", "bundler-#{BUNDLER_VERS}.gemspec")
+
+ # expect to install default gems. It location was `site_ruby` directory on real world.
+ assert_path_exists "default/gems/bundler-#{BUNDLER_VERS}"
+
+ # expect to not remove other versions of bundler on `site_ruby`
+ assert_path_exists 'default/gems/bundler-1.15.4'
+
+ # TODO: We need to assert to remove same version of bundler on gem_dir directory(It's not site_ruby dir)
+
+ # expect to not remove bundler-* direcotyr.
assert_path_exists 'default/gems/bundler-audit-1.0.0'
end if Gem::USE_BUNDLER_FOR_GEMDEPS
FileUtils.mkdir_p lib_rubygems_defaults
FileUtils.mkdir_p lib_bundler
- open securerandom_rb, 'w' do |io| io.puts '# securerandom.rb' end
+ File.open securerandom_rb, 'w' do |io| io.puts '# securerandom.rb' end
- open old_builder_rb, 'w' do |io| io.puts '# builder.rb' end
- open old_format_rb, 'w' do |io| io.puts '# format.rb' end
- open old_bundler_c_rb, 'w' do |io| io.puts '# c.rb' end
+ File.open old_builder_rb, 'w' do |io| io.puts '# builder.rb' end
+ File.open old_format_rb, 'w' do |io| io.puts '# format.rb' end
+ File.open old_bundler_c_rb, 'w' do |io| io.puts '# c.rb' end
- open engine_defaults_rb, 'w' do |io| io.puts '# jruby.rb' end
- open os_defaults_rb, 'w' do |io| io.puts '# operating_system.rb' end
+ File.open engine_defaults_rb, 'w' do |io| io.puts '# jruby.rb' end
+ File.open os_defaults_rb, 'w' do |io| io.puts '# operating_system.rb' end
@cmd.remove_old_lib_files lib
@cmd.options[:previous_version] = Gem::Version.new '2.0.2'
- open 'History.txt', 'w' do |io|
+ File.open 'History.txt', 'w' do |io|
io.puts <<-History_txt
# coding: UTF-8
# Evil hack to prevent false removal success
FileUtils.rm_f @executable
- open @executable, "wb+" do |f| f.puts "binary" end
+ File.open @executable, "wb+" do |f| f.puts "binary" end
@cmd.options[:executables] = true
@cmd.options[:args] = [@spec.name]
end
assert Gem::Specification.find_all_by_name('dep_x').length > 0
- assert Gem::Specification.find_all_by_name('x').length == 0
+ assert Gem::Specification.find_all_by_name('x').length.zero?
end
def test_execute_all
extconf_rb = File.join @gemhome, 'gems', 'e-1', 'extconf.rb'
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |io|
+ File.open extconf_rb, 'w' do |io|
io.write <<-EXTCONF_RB
require 'mkmf'
create_makefile 'e'
FileUtils.rm b.spec_file
- open c.spec_file, 'w' do |io|
+ File.open c.spec_file, 'w' do |io|
io.write 'this will raise an exception when evaluated.'
end
FileUtils.rm b.spec_file
- open c.spec_file, 'w' do |io|
+ File.open c.spec_file, 'w' do |io|
io.write 'this will raise an exception when evaluated.'
end
results = []
Dir.chdir @ext do
- open 'Makefile', 'w' do |io|
+ File.open 'Makefile', 'w' do |io|
io.puts <<-MAKEFILE
all:
\t@#{Gem.ruby} -e "puts %Q{all: \#{ENV['DESTDIR']}}"
results = []
Dir.chdir @ext do
- open 'Makefile', 'w' do |io|
+ File.open 'Makefile', 'w' do |io|
io.puts <<-MAKEFILE
all:
\t@#{Gem.ruby} -e "puts %Q{all: \#{ENV['DESTDIR']}}"
extconf_rb = File.join ext_dir, 'extconf.rb'
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
require 'mkmf'
extconf_rb = File.join ext_dir, 'extconf.rb'
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
require 'mkmf'
FileUtils.mkdir_p @spec.gem_dir
- open File.join(@spec.gem_dir, "extconf.rb"), "w" do |f|
+ File.open File.join(@spec.gem_dir, "extconf.rb"), "w" do |f|
f.write <<-'RUBY'
puts "IN EXTCONF"
extconf_args = File.join File.dirname(__FILE__), 'extconf_args'
build_info_file = File.join build_info_dir, "#{@spec.full_name}.info"
- open build_info_file, 'w' do |io|
+ File.open build_info_file, 'w' do |io|
io.puts '--with-foo-dir=/nonexistent'
end
# frozen_string_literal: true
require 'rubygems/test_case'
-begin
- gem_home_files = lambda{
- if Dir.exist?(ENV["GEM_HOME"])
- require "find"
- ary = Find.find(ENV["GEM_HOME"]).to_a
- else
- []
- end
- }
- prev_gem_home = ENV["GEM_HOME"]
- prev_gem_home_files = gem_home_files.call
- prev_threads = Thread.list.map{|e| e.inspect}
-
- require 'rubygems/gem_runner'
-ensure
- if $!
- msg = <<eom
-***************
-PREV
- GEM_HOME: #{prev_gem_home}
- Files in GEM_HOME: #{prev_gem_home_files.inspect}
- Threads: #{prev_threads.inspect}
-Current:
- GEM_HOME: #{ENV["GEM_HOME"]}
- Files in GEM_HOME: #{gem_home_files.call}
- Threads: #{Thread.list.map{|e| e.inspect}.inspect}
-Exception: #{$!.message}
-eom
- p $!.class
- p $!.message.frozen?
- raise $!.class, msg, $!.backtrace
- end
-end
+require 'rubygems/gem_runner'
class TestGemGemRunner < Gem::TestCase
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
keys = { :rubygems_api_key => 'KEY' }
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
keys = { :rubygems_api_key => 'KEY', :other => 'OTHER' }
FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write keys.to_yaml
end
other_api_key = 'f46dbb18bb6a9c97cdc61b5b85c186a17403cdcbf'
FileUtils.mkdir_p File.dirname(Gem.configuration.credentials_path)
- open Gem.configuration.credentials_path, 'w' do |f|
+ File.open Gem.configuration.credentials_path, 'w' do |f|
f.write Hash[:other_api_key, other_api_key].to_yaml
end
util_sign_in [api_key, 200, 'OK']
def test_initialize
assert_equal @tempdir, @indexer.dest_directory
- assert_equal File.join(Dir.tmpdir, "gem_generate_index_#{$$}"),
- @indexer.directory
+ assert_match %r{#{Dir.mktmpdir('gem_generate_index').match(/.*-/)}}, @indexer.directory
indexer = Gem::Indexer.new @tempdir
assert indexer.build_modern
def test_user_install_disabled_read_only
if win_platform?
skip('test_user_install_disabled_read_only test skipped on MS Windows')
+ elsif Process.uid.zero?
+ skip('test_user_install_disabled_read_only test skipped in root privilege')
else
@cmd.handle_options %w[--no-user-install]
s.require_path = 'lib'
end
- open File.join(util_inst_bindir, 'executable'), 'w' do |io|
+ File.open File.join(util_inst_bindir, 'executable'), 'w' do |io|
io.write <<-EXEC
#!/usr/local/bin/ruby
#
if win_platform?
skip('test_generate_bin_script_no_perms skipped on MS Windows')
+ elsif Process.uid.zero?
+ skip('test_generate_bin_script_no_perms skipped in root privilege')
else
FileUtils.chmod 0000, util_inst_bindir
if win_platform?
skip('test_generate_bin_symlink_no_perms skipped on MS Windows')
+ elsif Process.uid.zero?
+ skip('test_user_install_disabled_read_only test skipped in root privilege')
else
FileUtils.chmod 0000, util_inst_bindir
end
def test_class_new_old_format
- open 'old_format.gem', 'wb' do |io|
+ File.open 'old_format.gem', 'wb' do |io|
io.write SIMPLE_GEM
end
FileUtils.mkdir 'lib'
- open 'lib/code.rb', 'w' do |io|
+ File.open 'lib/code.rb', 'w' do |io|
io.write '# lib/code.rb'
end
FileUtils.mkdir_p 'lib/empty'
- open 'lib/code.rb', 'w' do |io| io.write '# lib/code.rb' end
- open 'lib/extra.rb', 'w' do |io| io.write '# lib/extra.rb' end
+ File.open 'lib/code.rb', 'w' do |io| io.write '# lib/code.rb' end
+ File.open 'lib/extra.rb', 'w' do |io| io.write '# lib/extra.rb' end
package = Gem::Package.new 'bogus.gem'
package.spec = spec
spec.files = %w[lib/code.rb lib/code_sym.rb]
FileUtils.mkdir_p 'lib'
- open 'lib/code.rb', 'w' do |io| io.write '# lib/code.rb' end
+ File.open 'lib/code.rb', 'w' do |io| io.write '# lib/code.rb' end
# NOTE: 'code.rb' is correct, because it's relative to lib/code_sym.rb
File.symlink('code.rb', 'lib/code_sym.rb')
FileUtils.mkdir 'lib'
- open 'lib/code.rb', 'w' do |io|
+ File.open 'lib/code.rb', 'w' do |io|
io.write '# lib/code.rb'
end
FileUtils.mkdir 'lib'
- open 'lib/code.rb', 'w' do |io|
+ File.open 'lib/code.rb', 'w' do |io|
io.write '# lib/code.rb'
end
FileUtils.mkdir 'lib'
- open 'lib/code.rb', 'w' do |io|
+ File.open 'lib/code.rb', 'w' do |io|
io.write '# lib/code.rb'
end
FileUtils.mkdir 'lib'
- open 'lib/code.rb', 'w' do |io|
+ File.open 'lib/code.rb', 'w' do |io|
io.write '# lib/code.rb'
end
FileUtils.mkdir 'lib'
- open 'lib/code.rb', 'w' do |io|
+ File.open 'lib/code.rb', 'w' do |io|
io.write '# lib/code.rb'
end
end
end
- open 'empty.gem', 'wb' do |io|
+ File.open 'empty.gem', 'wb' do |io|
io.write gem.string
end
File.read(extracted)
end
+ def test_extract_symlink_parent
+ skip 'symlink not supported' if Gem.win_platform?
+
+ package = Gem::Package.new @gem
+
+ tgz_io = util_tar_gz do |tar|
+ tar.mkdir 'lib', 0755
+ tar.add_symlink 'lib/link', '../..', 0644
+ tar.add_file 'lib/link/outside.txt', 0644 do |io| io.write 'hi' end
+ end
+
+ # Extract into a subdirectory of @destination; if this test fails it writes
+ # a file outside destination_subdir, but we want the file to remain inside
+ # @destination so it will be cleaned up.
+ destination_subdir = File.join @destination, 'subdir'
+ FileUtils.mkdir_p destination_subdir
+
+ e = assert_raises Gem::Package::PathError do
+ package.extract_tar_gz tgz_io, destination_subdir
+ end
+
+ assert_equal("installing into parent path lib/link/outside.txt of " +
+ "#{destination_subdir} is not allowed", e.message)
+ end
+
def test_extract_tar_gz_directory
package = Gem::Package.new @gem
"#{@destination} is not allowed", e.message)
end
+ def test_install_location_suffix
+ package = Gem::Package.new @gem
+
+ filename = "../#{File.basename(@destination)}suffix.rb"
+
+ e = assert_raises Gem::Package::PathError do
+ package.install_location filename, @destination
+ end
+
+ parent = File.expand_path File.join @destination, filename
+
+ assert_equal("installing into parent path #{parent} of " +
+ "#{@destination} is not allowed", e.message)
+ end
+
def test_load_spec
entry = StringIO.new Gem.gzip @spec.to_yaml
def entry.full_name() 'metadata.gz' end
end
end
- open 'mismatch.gem', 'wb' do |io|
+ File.open 'mismatch.gem', 'wb' do |io|
io.write gem.string
end
end
end
- open 'data_checksum_missing.gem', 'wb' do |io|
+ File.open 'data_checksum_missing.gem', 'wb' do |io|
io.write gem.string
end
assert_match %r%nonexistent.gem$%, e.message
end
+ def test_verify_duplicate_file
+ FileUtils.mkdir_p 'lib'
+ FileUtils.touch 'lib/code.rb'
+
+ build = Gem::Package.new @gem
+ build.spec = @spec
+ build.setup_signer
+ open @gem, 'wb' do |gem_io|
+ Gem::Package::TarWriter.new gem_io do |gem|
+ build.add_metadata gem
+ build.add_contents gem
+
+ gem.add_file_simple 'a.sig', 0444, 0
+ gem.add_file_simple 'a.sig', 0444, 0
+ end
+ end
+
+ package = Gem::Package.new @gem
+
+ e = assert_raises Gem::Security::Exception do
+ package.verify
+ end
+
+ assert_equal 'duplicate files in the package: ("a.sig")', e.message
+ end
+
def test_verify_security_policy
skip 'openssl is missing' unless defined?(OpenSSL::SSL)
FileUtils.mkdir 'lib'
FileUtils.touch 'lib/code.rb'
- open @gem, 'wb' do |gem_io|
+ File.open @gem, 'wb' do |gem_io|
Gem::Package::TarWriter.new gem_io do |gem|
build.add_metadata gem
build.add_contents gem
# write bogus data.tar.gz to foil signature
bogus_data = Gem.gzip 'hello'
- gem.add_file_simple 'data.tar.gz', 0444, bogus_data.length do |io|
+ fake_signer = Class.new do
+ def digest_name; 'SHA512'; end
+ def digest_algorithm; Digest(:SHA512); end
+ def key; 'key'; end
+ def sign(*); 'fake_sig'; end
+ end
+ gem.add_file_signed 'data2.tar.gz', 0444, fake_signer.new do |io|
io.write bogus_data
end
end
def test_verify_truncate
- open 'bad.gem', 'wb' do |io|
+ File.open 'bad.gem', 'wb' do |io|
io.write File.read(@gem, 1024) # don't care about newlines
end
def setup
super
- open 'old_format.gem', 'wb' do |io|
+ File.open 'old_format.gem', 'wb' do |io|
io.write SIMPLE_GEM
end
assert_equal '012467', @tar_header.checksum
end
+ def test_from_bad_octal
+ test_cases = [
+ "00000006,44\000", # bogus character
+ "00000006789\000", # non-octal digit
+ "+0000001234\000", # positive sign
+ "-0000001000\000", # negative sign
+ "0x000123abc\000", # radix prefix
+ ]
+
+ test_cases.each do |val|
+ header_s = @tar_header.to_s
+ # overwrite the size field
+ header_s[124, 12] = val
+ io = TempIO.new header_s
+ assert_raises ArgumentError do
+ new_header = Gem::Package::TarHeader.from io
+ end
+ io.close! if io.respond_to? :close!
+ end
+ end
+
end
def test_remove_unwritable
skip 'chmod not supported' if Gem.win_platform?
+ skip 'skipped in root privilege' if Process.uid.zero?
FileUtils.mkdir_p @a.base_dir
FileUtils.chmod 0, @a.base_dir
def test_setup_unwritable
skip 'chmod not supported' if Gem.win_platform?
+ skip 'skipped in root privilege' if Process.uid.zero?
FileUtils.mkdir_p @a.doc_dir
FileUtils.chmod 0, @a.doc_dir
assert File.exist?(a1_cache_gem)
end
- unless win_platform? # File.chmod doesn't work
+ unless win_platform? || Process.uid.zero? # File.chmod doesn't work
def test_download_local_read_only
FileUtils.mv @a1_gem, @tempdir
local_path = File.join @tempdir, @a1.file_name
rs = Gem::RequestSet.new
installed = []
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.puts 'gem "a"'
io.flush
rs = Gem::RequestSet.new
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.puts 'gem "a"'
io.flush
rs = Gem::RequestSet.new
installed = []
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.puts 'gem "a"'
end
rs = Gem::RequestSet.new
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.puts 'gem "a"'
io.flush
rs = Gem::RequestSet.new
installed = []
- open 'gem.deps.rb.lock', 'w' do |io|
+ File.open 'gem.deps.rb.lock', 'w' do |io|
io.puts <<-LOCKFILE
GEM
remote: #{@gem_repo}
LOCKFILE
end
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.puts 'gem "b"'
end
rs = Gem::RequestSet.new
installed = []
- open 'gem.deps.rb', 'w' do |io|
+ File.open 'gem.deps.rb', 'w' do |io|
io.puts <<-GEM_DEPS
gem "a"
ruby "0"
def write_lockfile lockfile
@lock_file = File.expand_path "#{@gem_deps_file}.lock"
- open @lock_file, 'w' do |io|
+ File.open @lock_file, 'w' do |io|
io.write lockfile
end
end
s.add_dependency 'c', '~> 1.0'
end
- open 'b.gemspec', 'w' do |io|
+ File.open 'b.gemspec', 'w' do |io|
io.write b.to_ruby
end
Dir.chdir 'c' do
c = Gem::Specification.new 'c', 1
- open 'c.gemspec', 'w' do |io|
+ File.open 'c.gemspec', 'w' do |io|
io.write c.to_ruby
end
gem_deps_lock_file = "#{@gem_deps_file}.lock"
- open gem_deps_lock_file, 'w' do |io|
+ File.open gem_deps_lock_file, 'w' do |io|
io.write 'hello'
end
end
def write_lockfile lockfile
- open @lock_file, 'w' do |io|
+ File.open @lock_file, 'w' do |io|
io.write lockfile
end
end
end
def write_lockfile lockfile
- open @lock_file, 'w' do |io|
+ File.open @lock_file, 'w' do |io|
io.write lockfile
end
end
Dir.chdir 'git/a' do
FileUtils.mkdir_p 'ext/lib'
- open 'ext/extconf.rb', 'w' do |io|
+ File.open 'ext/extconf.rb', 'w' do |io|
io.puts 'require "mkmf"'
io.puts 'create_makefile "a"'
end
specs_dir = File.join dir, 'specifications'
FileUtils.mkdir_p specs_dir
- open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
io.write spec.to_ruby
end
FileUtils.mkdir_p specs_dir
- open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
io.write spec.to_ruby
end
specs_dir = File.join dir, 'specifications'
FileUtils.mkdir_p specs_dir
- open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
io.write spec.to_ruby
end
assert_match 'z 9', @res.body
end
+
+ def test_xss_homepage_fix_289313
+ data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+ dir = "#{@gemhome}2"
+
+ spec = util_spec 'xsshomepagegem', 1
+ spec.homepage = "javascript:confirm(document.domain)"
+
+ specs_dir = File.join dir, 'specifications'
+ FileUtils.mkdir_p specs_dir
+
+ open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ io.write spec.to_ruby
+ end
+
+ server = Gem::Server.new dir, process_based_port, false
+
+ @req.parse data
+
+ server.root @req, @res
+
+ assert_equal 200, @res.status
+ assert_match 'xsshomepagegem 1', @res.body
+
+ # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a
+ # valid HTTP/HTTPS URL and could be unsafe in an HTML context. We would prefer to throw an exception here,
+ # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be
+ # validated in future versions of Gem::Specification.
+ #
+ # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
+ #
+ # Variant #1 - rdoc not installed
+ #
+ # <b>xsshomepagegem 1</b>
+ #
+ #
+ # <span title="rdoc not installed">[rdoc]</span>
+ #
+ #
+ #
+ # <a href="." title=".">[www]</a>
+ #
+ # Variant #2 - rdoc installed
+ #
+ # <b>xsshomepagegem 1</b>
+ #
+ #
+ # <a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>
+ #
+ #
+ #
+ # <a href="." title=".">[www]</a>
+ regex_match = /xsshomepagegem 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="\." title="\.">\[www\]<\/a>/
+ assert_match regex_match, @res.body
+ end
+
+ def test_invalid_homepage
+ data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+ dir = "#{@gemhome}2"
+
+ spec = util_spec 'invalidhomepagegem', 1
+ spec.homepage = "notavalidhomepageurl"
+
+ specs_dir = File.join dir, 'specifications'
+ FileUtils.mkdir_p specs_dir
+
+ open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ io.write spec.to_ruby
+ end
+
+ server = Gem::Server.new dir, process_based_port, false
+
+ @req.parse data
+
+ server.root @req, @res
+
+ assert_equal 200, @res.status
+ assert_match 'invalidhomepagegem 1', @res.body
+
+ # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a
+ # valid HTTP/HTTPS URL and could be unsafe in an HTML context. We would prefer to throw an exception here,
+ # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be
+ # validated in future versions of Gem::Specification.
+ #
+ # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
+ #
+ # Variant #1 - rdoc not installed
+ #
+ # <b>invalidhomepagegem 1</b>
+ #
+ #
+ # <span title="rdoc not installed">[rdoc]</span>
+ #
+ #
+ #
+ # <a href="." title=".">[www]</a>
+ #
+ # Variant #2 - rdoc installed
+ #
+ # <b>invalidhomepagegem 1</b>
+ #
+ #
+ # <a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>
+ #
+ #
+ #
+ # <a href="." title=".">[www]</a>
+ regex_match = /invalidhomepagegem 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="\." title="\.">\[www\]<\/a>/
+ assert_match regex_match, @res.body
+ end
+
+ def test_valid_homepage_http
+ data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+ dir = "#{@gemhome}2"
+
+ spec = util_spec 'validhomepagegemhttp', 1
+ spec.homepage = "http://rubygems.org"
+
+ specs_dir = File.join dir, 'specifications'
+ FileUtils.mkdir_p specs_dir
+
+ open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ io.write spec.to_ruby
+ end
+
+ server = Gem::Server.new dir, process_based_port, false
+
+ @req.parse data
+
+ server.root @req, @res
+
+ assert_equal 200, @res.status
+ assert_match 'validhomepagegemhttp 1', @res.body
+
+ regex_match = /validhomepagegemhttp 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttp-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="http:\/\/rubygems\.org" title="http:\/\/rubygems\.org">\[www\]<\/a>/
+ assert_match regex_match, @res.body
+ end
+
+ def test_valid_homepage_https
+ data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+ dir = "#{@gemhome}2"
+
+ spec = util_spec 'validhomepagegemhttps', 1
+ spec.homepage = "https://rubygems.org"
+
+ specs_dir = File.join dir, 'specifications'
+ FileUtils.mkdir_p specs_dir
+
+ open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ io.write spec.to_ruby
+ end
+
+ server = Gem::Server.new dir, process_based_port, false
+
+ @req.parse data
+
+ server.root @req, @res
+
+ assert_equal 200, @res.status
+ assert_match 'validhomepagegemhttps 1', @res.body
+
+ regex_match = /validhomepagegemhttps 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttps-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="https:\/\/rubygems\.org" title="https:\/\/rubygems\.org">\[www\]<\/a>/
+ assert_match regex_match, @res.body
+ end
+
def test_specs
data = StringIO.new "GET /specs.#{Gem.marshal_version} HTTP/1.0\r\n\r\n"
@req.parse data
specs_dir = File.join dir, 'specifications'
FileUtils.mkdir_p specs_dir
- open File.join(specs_dir, spec.spec_name), 'w' do |io|
+ File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
io.write spec.to_ruby
end
cache_file = File.join cache_dir, a1.spec_name
- open cache_file, 'wb' do |io|
+ File.open cache_file, 'wb' do |io|
Marshal.dump a1, io
end
cache_file = File.join cache_dir, "latest_specs.#{Gem.marshal_version}"
- open cache_file, 'wb' do |io|
+ File.open cache_file, 'wb' do |io|
Marshal.dump latest_specs, io
end
cache_file = File.join cache_dir, "latest_specs.#{Gem.marshal_version}"
- open cache_file, 'wb' do |io|
+ File.open cache_file, 'wb' do |io|
# Setup invalid data in the cache:
io.write Marshal.dump(latest_specs)[0, 10]
end
Dir.chdir 'b' do
b = Gem::Specification.new 'b', 1
- open 'b.gemspec', 'w' do |io|
+ File.open 'b.gemspec', 'w' do |io|
io.write b.to_ruby
end
end
def test_self_load_relative
- open 'a-2.gemspec', 'w' do |io|
+ File.open 'a-2.gemspec', 'w' do |io|
io.write @a2.to_ruby_for_cache
end
@a2.files.clear
assert_equal @a2, spec
+
+ ensure
+ $SAFE = 0
end
def test_self_load_escape_curly
end
def test_self_remove_spec_removed
- open @a1.spec_file, 'w' do |io|
+ File.open @a1.spec_file, 'w' do |io|
io.write @a1.to_ruby
end
assert_empty @ext.build_args
- open @ext.build_info_file, 'w' do |io|
+ File.open @ext.build_info_file, 'w' do |io|
io.puts
end
assert_empty @ext.build_args
- open @ext.build_info_file, 'w' do |io|
+ File.open @ext.build_info_file, 'w' do |io|
io.puts '--with-foo-dir=wherever'
end
extconf_rb = File.join @ext.gem_dir, @ext.extensions.first
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
- open 'Makefile', 'w' do |f|
+ File.open 'Makefile', 'w' do |f|
f.puts "clean:\n\techo clean"
f.puts "default:\n\techo built"
f.puts "install:\n\techo installed"
extconf_rb = File.join spec.gem_dir, spec.extensions.first
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
- open 'Makefile', 'w' do |f|
+ File.open 'Makefile', 'w' do |f|
f.puts "default:\n\techo built"
f.puts "install:\n\techo installed"
end
def test_build_extensions_extensions_dir_unwritable
skip 'chmod not supported' if Gem.win_platform?
+ skip 'skipped in root privilege' if Process.uid.zero?
ext_spec
extconf_rb = File.join @ext.gem_dir, @ext.extensions.first
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
- open 'Makefile', 'w' do |f|
+ File.open 'Makefile', 'w' do |f|
f.puts "clean:\n\techo clean"
f.puts "default:\n\techo built"
f.puts "install:\n\techo installed"
@ext.build_extensions
refute_path_exists @ext.extension_dir
ensure
- unless ($DEBUG or win_platform?) then
+ unless ($DEBUG or win_platform? or Process.uid.zero?) then
FileUtils.chmod 0755, File.join(@ext.base_dir, 'extensions')
FileUtils.chmod 0755, @ext.base_dir
end
extconf_rb = File.join @ext.gem_dir, @ext.extensions.first
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
- open 'Makefile', 'w' do |f|
+ File.open 'Makefile', 'w' do |f|
f.puts "clean:\n\techo clean"
f.puts "default:\n\techo built"
f.puts "install:\n\techo installed"
extconf_rb = File.join @ext.gem_dir, @ext.extensions.first
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
- open 'Makefile', 'w' do |f|
+ File.open 'Makefile', 'w' do |f|
f.puts "clean:\n\techo clean"
f.puts "default:\n\techo built"
f.puts "install:\n\techo installed"
@a1.validate
end
- assert_equal '"over at my cool site" is not a URI', e.message
+ assert_equal '"over at my cool site" is not a valid HTTP URI', e.message
+
+ @a1.homepage = 'ftp://rubygems.org'
+
+ e = assert_raises Gem::InvalidSpecificationException do
+ @a1.validate
+ end
+
+ assert_equal '"ftp://rubygems.org" is not a valid HTTP URI', e.message
+
+ @a1.homepage = 'http://rubygems.org'
+ assert_equal true, @a1.validate
+
+ @a1.homepage = 'https://rubygems.org'
+ assert_equal true, @a1.validate
+
end
end
extconf_rb = File.join @ext.gem_dir, @ext.extensions.first
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
- open 'Makefile', 'w' do |f|
+ File.open 'Makefile', 'w' do |f|
f.puts "clean:\n\techo clean"
f.puts "default:\n\techo built"
f.puts "install:\n\techo installed"
extconf_rb = File.join s.gem_dir, s.extensions.first
FileUtils.mkdir_p File.dirname extconf_rb
- open extconf_rb, 'w' do |f|
+ File.open extconf_rb, 'w' do |f|
f.write <<-'RUBY'
- open 'Makefile', 'w' do |f|
+ File.open 'Makefile', 'w' do |f|
f.puts "clean:\n\techo clean"
f.puts "default:\n\techo built"
f.puts "install:\n\techo installed"
spec = new_default_spec 'default', 1
spec.extensions << 'extconf.rb'
- open spec.loaded_from, 'w' do |io|
+ File.open spec.loaded_from, 'w' do |io|
io.write spec.to_ruby_for_cache
end
def stub_with_version
spec = File.join @gemhome, 'specifications', 'stub_e-2.gemspec'
- open spec, 'w' do |io|
+ File.open spec, 'w' do |io|
io.write <<-STUB
# -*- encoding: utf-8 -*-
# stub: stub_v 2 ruby lib
def stub_without_version
spec = File.join @gemhome, 'specifications', 'stub-2.gemspec'
- open spec, 'w' do |io|
+ File.open spec, 'w' do |io|
io.write <<-STUB
# -*- encoding: utf-8 -*-
# stub: stub_v ruby lib
def stub_with_extension
spec = File.join @gemhome, 'specifications', 'stub_e-2.gemspec'
- open spec, 'w' do |io|
+ File.open spec, 'w' do |io|
io.write <<-STUB
# -*- encoding: utf-8 -*-
# stub: stub_e 2 ruby lib
def stub_without_extension
spec = File.join @gemhome, 'specifications', 'stub-2.gemspec'
- open spec, 'w' do |io|
+ File.open spec, 'w' do |io|
io.write <<-STUB
# -*- encoding: utf-8 -*-
# stub: stub 2 ruby lib
class TestGemUtil < Gem::TestCase
def test_class_popen
+ skip "MJIT executes process and it's caught by Process.wait(-1)" if defined?(RubyVM::MJIT) && RubyVM::MJIT.enabled?
assert_equal "0\n", Gem::Util.popen(Gem.ruby, '-e', 'p 0')
assert_raises Errno::ECHILD do
loop { break if enum.next.nil? } # exhaust the enumerator
end
+ def test_traverse_parents_does_not_crash_on_permissions_error
+ skip 'skipped on MS Windows (chmod has no effect)' if win_platform?
+
+ FileUtils.mkdir_p 'd/e/f'
+ # remove 'execute' permission from "e" directory and make it
+ # impossible to cd into it and its children
+ FileUtils.chmod(0666, 'd/e')
+
+ paths = Gem::Util.traverse_parents('d/e/f').to_a
+
+ assert_equal File.join(@tempdir, 'd'), paths[0]
+ assert_equal @tempdir, paths[1]
+ if File.respond_to?(:realpath)
+ assert_equal File.realpath(Dir.tmpdir), paths[2]
+ assert_equal File.realpath("..", Dir.tmpdir), paths[3]
+ elsif RUBY_PLATFORM !~ /darwin/
+ assert_equal Dir.tmpdir, paths[2]
+ assert_equal '/', paths[3]
+ end
+ ensure
+ # restore default permissions, allow the directory to be removed
+ FileUtils.chmod(0775, 'd/e') unless win_platform?
+ end
+
def test_linked_list_find
list = [1,2,3,4,5].inject(Gem::List.new(0)) { |m,o|
Gem::List.new o, m
require 'rubygems/test_case'
require "rubygems/version"
+require "minitest/benchmark"
+
class TestGemVersion < Gem::TestCase
class V < ::Gem::Version
end
end
+ def bench_anchored_version_pattern
+ assert_performance_linear 0.5 do |count|
+ version_string = count.times.map {|i| "0" * i.succ }.join(".") << "."
+ version_string =~ Gem::Version::ANCHORED_VERSION_PATTERN
+ end
+ rescue RegexpError
+ skip "It fails to allocate the memory for regex pattern of Gem::Version::ANCHORED_VERSION_PATTERN"
+ end
+
def test_empty_version
["", " ", " "].each do |empty|
assert_equal "0", Gem::Version.new(empty).version
assert require(path), "'#{path}' was already required"
end
- def append_latch spec
- dir = spec.gem_dir
- Dir.chdir dir do
- spec.files.each do |file|
- File.open file, 'a' do |fp|
- fp.puts "FILE_ENTERED_LATCH.release"
- fp.puts "FILE_EXIT_LATCH.await"
- end
- end
- end
- end
-
# Providing -I on the commandline should always beat gems
def test_dash_i_beats_gems
a1 = new_spec "a", "1", {"b" => "= 1"}, "lib/test_gem_require_a.rb"
Object.send :remove_const, :HELLO if Object.const_defined? :HELLO
end
+ def create_sync_thread
+ Thread.new do
+ begin
+ yield
+ ensure
+ FILE_ENTERED_LATCH.release
+ FILE_EXIT_LATCH.await
+ end
+ end
+ end
+
def test_concurrent_require
skip 'deadlock' if /^1\.8\./ =~ RUBY_VERSION
install_specs a1, b1
- append_latch a1
- append_latch b1
-
- t1 = Thread.new { assert_require 'a' }
- t2 = Thread.new { assert_require 'b' }
+ t1 = create_sync_thread{ assert_require 'a' }
+ t2 = create_sync_thread{ assert_require 'b' }
# wait until both files are waiting on the exit latch
FILE_ENTERED_LATCH.await
assert t1.join, "thread 1 should exit"
assert t2.join, "thread 2 should exit"
ensure
- return if $! # skipping
-
- Object.send :remove_const, :FILE_ENTERED_LATCH
- Object.send :remove_const, :FILE_EXIT_LATCH
+ Object.send :remove_const, :FILE_ENTERED_LATCH if Object.const_defined? :FILE_ENTERED_LATCH
+ Object.send :remove_const, :FILE_EXIT_LATCH if Object.const_defined? :FILE_EXIT_LATCH
end
def test_require_is_not_lazy_with_exact_req
projects / ruby2.5.git / commitdiff