merge revision(s) 50829: [Backport #11248]

* lib/rubygems.rb: bump version to 2.4.5.1. this version fixed
  CVE-2015-3900.

* lib/rubygems/remote_fetcher.rb: ditto.

* test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900



git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_1@51627 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 7 insertions, 1 deletions

diff --git a/lib/rubygems/remote_fetcher.rb b/lib/rubygems/remote_fetcher.rb
index 58991caeda..ed2e171d2c 100644
--- a/lib/rubygems/remote_fetcher.rb
+++ b/lib/rubygems/remote_fetcher.rb
@@ -90,7 +90,13 @@ class Gem::RemoteFetcher
     rescue Resolv::ResolvError
       uri
     else
-      URI.parse "#{uri.scheme}://#{res.target}#{uri.path}"
+      target = res.target.to_s.strip
+
+      if /\.#{Regexp.quote(host)}\z/ =~ target
+        return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
+      end
+
+      uri
     end
   end