diff options
author | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-03-06 09:01:48 +0000 |
---|---|---|
committer | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-03-06 09:01:48 +0000 |
commit | e0005fdc2734871c4acd7dcf269e1566388794c4 (patch) | |
tree | 8ad55fb2e000a2a66be1671e632f170db12c1e2b /lib/rubygems/gemcutter_utilities.rb | |
parent | f5452efcf863e4c15577e53c52e6e8726e70f5c4 (diff) |
Backport RubyGems 3.0.3: [Backport #15637]
* Fixed following vulnerabilities:
* CVE-2019-8320: Delete directory using symlink when decompressing tar
* CVE-2019-8321: Escape sequence injection vulnerability in verbose
* CVE-2019-8322: Escape sequence injection vulnerability in gem owner
* CVE-2019-8323: Escape sequence injection vulnerability in API response handling
* CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
* CVE-2019-8325: Escape sequence injection vulnerability in errors
* see also https://blog.rubygems.org/2019/03/05/3.0.3-released.html
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67182 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib/rubygems/gemcutter_utilities.rb')
-rw-r--r-- | lib/rubygems/gemcutter_utilities.rb | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/lib/rubygems/gemcutter_utilities.rb b/lib/rubygems/gemcutter_utilities.rb index 3607b61529..e49bff36f9 100644 --- a/lib/rubygems/gemcutter_utilities.rb +++ b/lib/rubygems/gemcutter_utilities.rb @@ -1,11 +1,14 @@ # frozen_string_literal: true require 'rubygems/remote_fetcher' +require 'rubygems/text' ## # Utility methods for using the RubyGems API. module Gem::GemcutterUtilities + include Gem::Text + # TODO: move to Gem::Command OptionParser.accept Symbol do |value| value.to_sym @@ -162,13 +165,13 @@ module Gem::GemcutterUtilities if block_given? yield response else - say response.body + say clean_text(response.body) end else message = response.body message = "#{error_prefix}: #{message}" if error_prefix - say message + say clean_text(message) terminate_interaction 1 # TODO: question this end end |