diff options
| author | Aaron Patterson <tenderlove@ruby-lang.org> | 2025-10-16 14:05:17 -0700 |
|---|---|---|
| committer | git <svn-admin@ruby-lang.org> | 2025-10-16 23:40:04 +0000 |
| commit | 4f51f6243eb75395dcc31407fd76cc1b2b356c65 (patch) | |
| tree | eb5bfaacf45498a6a21ea62deea76878e70f8ec9 /.github | |
| parent | 9a80258b23c76a40070668dbebab8dd6f0361b92 (diff) | |
[rubygems/rubygems] Restrict what schemes are acceptable in the remote fetcher
The remote fetcher only works with certain schemes (`http`, `https`,
`s3`, and `file`). It's possible for other schemes to show up in this
code and it can cause bugs.
Before this patch, doing `gem install path:///hello` would result in an
infinite loop because this function would do `send "fetch_path"`,
calling itself forever. Now we see an exception.
I think we should validate gem names earlier, but it's really best
practice to restrict the possible strings passed to `send`.
https://github.com/rubygems/rubygems/commit/54e2781b73
Diffstat (limited to '.github')
0 files changed, 0 insertions, 0 deletions
