* lib/rubygems/commands/push_command.rb: Fixed credential download for

  `gem push --host`
* lib/rubygems/gemcutter_utilities.rb:  ditto.
* test/rubygems/test_gem_commands_push_command.rb:  Test for the above.
* test/rubygems/test_gem_gemcutter_utilities.rb:  ditto.

* lib/rubygems/config_file.rb:  Abort if the `gem push` credentials
  file has insecure permissions.
* test/rubygems/test_gem_config_file.rb:  Test for the above.

* lib/rubygems/ext/builder.rb:  Do not look for Gemfile, Isolate, etc.
  while building gem extensions.

* lib/rubygems/package.rb:  Unset spec and files list if a gem's
  signatures cannot be verified.
* test/rubygems/test_gem_package.rb:  Test for the above.

* lib/rubygems/specification.rb:  Reduce use of eval.
* lib/rubygems/test_case.rb:  ditto.

* test/rubygems/test_gem_specification.rb:  Test setting
  specification_version for legacy gems.  Dup Gem.ruby before
  untainting in case it's frozen.

* lib/rubygems.rb:  Reduce use of eval.  Only read files when looking
  for Gemfile, Isolate, etc.
* test/rubygems/test_gem.rb:  Test for the above.


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@39055 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 4 insertions, 25 deletions

diff --git a/lib/rubygems.rb b/lib/rubygems.rb
index dcfe74039c..0fb718aedc 100644
--- a/lib/rubygems.rb
+++ b/lib/rubygems.rb
@@ -207,7 +207,7 @@ module Gem
 
         begin
           while true
-            path = GEM_DEP_FILES.find { |f| File.exists?(f) }
+            path = GEM_DEP_FILES.find { |f| File.file?(f) }
 
             if path
               path = File.join here, path
@@ -226,7 +226,9 @@ module Gem
         end
       end
 
-      return unless File.exists? path
+      path.untaint
+
+      return unless File.file? path
 
       rs = Gem::RequestSet.new
       rs.load_gemdeps path
@@ -370,29 +372,6 @@ module Gem
   end
 
   ##
-  # Expand each partial gem path with each of the required paths specified
-  # in the Gem spec.  Each expanded path is yielded.
-
-  def self.each_load_path(partials)
-    partials.each do |gp|
-      base = File.basename gp
-      specfn = File.join(dir, "specifications", "#{base}.gemspec")
-      if File.exists? specfn
-        spec = eval(File.read(specfn))
-        spec.require_paths.each do |rp|
-          yield File.join(gp,rp)
-        end
-      else
-        filename = File.join(gp, 'lib')
-        yield(filename) if File.exists? filename
-      end
-    end
-  end
-
-  private_class_method :each_load_path
-
-
-  ##
   # Quietly ensure the named Gem directory contains all the proper
   # subdirectories.  If we can't create a directory due to a permission
   # problem, then we will silently continue.