summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authornagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2015-08-17 14:20:34 +0000
committernagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2015-08-17 14:20:34 +0000
commitc732611149c8c7175261608fab5176a0cda016e7 (patch)
treefa01a6fd4eb014108c7d8d5437e72eebfb19e898
parent776c8182f0aad54c6efaa8cb868b16a912ca232d (diff)
merge revision(s) 50829: [Backport #11248]
* lib/rubygems.rb: bump version to 2.4.5.1. this version fixed CVE-2015-3900. * lib/rubygems/remote_fetcher.rb: ditto. * test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@51619 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r--ChangeLog7
-rw-r--r--lib/rubygems.rb2
-rw-r--r--lib/rubygems/remote_fetcher.rb8
-rw-r--r--test/rubygems/test_gem_remote_fetcher.rb48
-rw-r--r--version.h2
5 files changed, 62 insertions, 5 deletions
diff --git a/ChangeLog b/ChangeLog
index 220b095..c95e4bc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+Mon Aug 17 23:07:47 2015 SHIBATA Hiroshi <hsbt@ruby-lang.org>
+
+ * lib/rubygems.rb: bump version to 2.4.5.1. this version fixed
+ CVE-2015-3900.
+ * lib/rubygems/remote_fetcher.rb: ditto.
+ * test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900
+
Mon Aug 17 23:00:56 2015 Nobuyoshi Nakada <nobu@ruby-lang.org>
* ext/win32/lib/win32/registry.rb (API#SetValue): data size should
diff --git a/lib/rubygems.rb b/lib/rubygems.rb
index 05690c8..98e7dfa 100644
--- a/lib/rubygems.rb
+++ b/lib/rubygems.rb
@@ -9,7 +9,7 @@ require 'rbconfig'
require 'thread'
module Gem
- VERSION = '2.4.5'
+ VERSION = '2.4.5.1'
end
# Must be first since it unloads the prelude from 1.9.2
diff --git a/lib/rubygems/remote_fetcher.rb b/lib/rubygems/remote_fetcher.rb
index d42a7bd..b1f6dd1 100644
--- a/lib/rubygems/remote_fetcher.rb
+++ b/lib/rubygems/remote_fetcher.rb
@@ -94,7 +94,13 @@ class Gem::RemoteFetcher
rescue Resolv::ResolvError
uri
else
- URI.parse "#{uri.scheme}://#{res.target}#{uri.path}"
+ target = res.target.to_s.strip
+
+ if /\.#{Regexp.quote(host)}\z/ =~ target
+ return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
+ end
+
+ uri
end
end
diff --git a/test/rubygems/test_gem_remote_fetcher.rb b/test/rubygems/test_gem_remote_fetcher.rb
index 74c52b6..63dd8fe 100644
--- a/test/rubygems/test_gem_remote_fetcher.rb
+++ b/test/rubygems/test_gem_remote_fetcher.rb
@@ -167,6 +167,21 @@ gems:
end
def test_api_endpoint
+ uri = URI.parse "http://example.com/foo"
+ target = MiniTest::Mock.new
+ target.expect :target, "gems.example.com"
+
+ dns = MiniTest::Mock.new
+ dns.expect :getresource, target, [String, Object]
+
+ fetch = Gem::RemoteFetcher.new nil, dns
+ assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri)
+
+ target.verify
+ dns.verify
+ end
+
+ def test_api_endpoint_ignores_trans_domain_values
uri = URI.parse "http://gems.example.com/foo"
target = MiniTest::Mock.new
target.expect :target, "blah.com"
@@ -175,8 +190,37 @@ gems:
dns.expect :getresource, target, [String, Object]
fetch = Gem::RemoteFetcher.new nil, dns
- @fetcher = fetcher
- assert_equal URI.parse("http://blah.com/foo"), fetch.api_endpoint(uri)
+ assert_equal URI.parse("http://gems.example.com/foo"), fetch.api_endpoint(uri)
+
+ target.verify
+ dns.verify
+ end
+
+ def test_api_endpoint_ignores_trans_domain_values_that_starts_with_original
+ uri = URI.parse "http://example.com/foo"
+ target = MiniTest::Mock.new
+ target.expect :target, "example.combadguy.com"
+
+ dns = MiniTest::Mock.new
+ dns.expect :getresource, target, [String, Object]
+
+ fetch = Gem::RemoteFetcher.new nil, dns
+ assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+
+ target.verify
+ dns.verify
+ end
+
+ def test_api_endpoint_ignores_trans_domain_values_that_end_with_original
+ uri = URI.parse "http://example.com/foo"
+ target = MiniTest::Mock.new
+ target.expect :target, "badexample.com"
+
+ dns = MiniTest::Mock.new
+ dns.expect :getresource, target, [String, Object]
+
+ fetch = Gem::RemoteFetcher.new nil, dns
+ assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
target.verify
dns.verify
diff --git a/version.h b/version.h
index 5db522a..4cd2c81 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
#define RUBY_VERSION "2.2.3"
#define RUBY_RELEASE_DATE "2015-08-17"
-#define RUBY_PATCHLEVEL 170
+#define RUBY_PATCHLEVEL 171
#define RUBY_RELEASE_YEAR 2015
#define RUBY_RELEASE_MONTH 8