diff options
author | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-02-16 16:27:56 +0000 |
---|---|---|
committer | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2018-02-16 16:27:56 +0000 |
commit | 664b94fd2b4b19edd7d75c6bbcd3154905b2624e (patch) | |
tree | 9d53b0ee7df087059a29d517a485652b7f8a1419 /lib | |
parent | 02b8978ff10b05304dbb46d73b49a2cf3a87cb92 (diff) |
merge revision(s) 58471,58493,62436: [Backport #13505]
load.c: backtrace of circular require
* load.c (load_lock): print backtrace of circular require via
`Warning.warn` [ruby-core:80850] [Bug #13505]
Send the backtrace of the circular require warning as a single String to Warning.warn
* load.c: send as a single string.
* error.c: expose the string formatted by rb_warning as rb_warning_string().
* test/ruby/test_exception.rb: update tests.
[ruby-core:80850] [Bug #13505]
fix regexp literal warning.
* test/rubygems/test_gem_server.rb: eliminate duplicated character class warning.
[Bug #14481]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@62441 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib')
-rw-r--r-- | lib/rubygems.rb | 2 | ||||
-rw-r--r-- | lib/rubygems/package.rb | 6 | ||||
-rw-r--r-- | lib/rubygems/package/tar_header.rb | 23 | ||||
-rw-r--r-- | lib/rubygems/package/tar_writer.rb | 2 | ||||
-rw-r--r-- | lib/rubygems/server.rb | 14 | ||||
-rw-r--r-- | lib/rubygems/specification.rb | 15 |
6 files changed, 46 insertions, 16 deletions
diff --git a/lib/rubygems.rb b/lib/rubygems.rb index 6a30e315de..dded57bb6a 100644 --- a/lib/rubygems.rb +++ b/lib/rubygems.rb @@ -9,7 +9,7 @@ require 'rbconfig' require 'thread' module Gem - VERSION = '2.4.5.4' + VERSION = '2.4.5.5' end # Must be first since it unloads the prelude from 1.9.2 diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb index 4d2a2edc80..bd33f4cc13 100644 --- a/lib/rubygems/package.rb +++ b/lib/rubygems/package.rb @@ -408,7 +408,7 @@ EOM destination = File.expand_path destination raise Gem::Package::PathError.new(destination, destination_dir) unless - destination.start_with? destination_dir + destination.start_with? destination_dir + '/' destination.untaint destination @@ -587,6 +587,10 @@ EOM raise Gem::Package::FormatError.new \ 'package content (data.tar.gz) is missing', @gem end + + if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any? + raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})" + end end ## diff --git a/lib/rubygems/package/tar_header.rb b/lib/rubygems/package/tar_header.rb index f9ab13aca7..9b457ec2eb 100644 --- a/lib/rubygems/package/tar_header.rb +++ b/lib/rubygems/package/tar_header.rb @@ -103,25 +103,30 @@ class Gem::Package::TarHeader fields = header.unpack UNPACK_FORMAT new :name => fields.shift, - :mode => fields.shift.oct, - :uid => fields.shift.oct, - :gid => fields.shift.oct, - :size => fields.shift.oct, - :mtime => fields.shift.oct, - :checksum => fields.shift.oct, + :mode => strict_oct(fields.shift), + :uid => strict_oct(fields.shift), + :gid => strict_oct(fields.shift), + :size => strict_oct(fields.shift), + :mtime => strict_oct(fields.shift), + :checksum => strict_oct(fields.shift), :typeflag => fields.shift, :linkname => fields.shift, :magic => fields.shift, - :version => fields.shift.oct, + :version => strict_oct(fields.shift), :uname => fields.shift, :gname => fields.shift, - :devmajor => fields.shift.oct, - :devminor => fields.shift.oct, + :devmajor => strict_oct(fields.shift), + :devminor => strict_oct(fields.shift), :prefix => fields.shift, :empty => empty end + def self.strict_oct(str) + return str.oct if str =~ /\A[0-7]*\z/ + raise ArgumentError, "#{str.inspect} is not an octal string" + end + ## # Creates a new TarHeader using +vals+ diff --git a/lib/rubygems/package/tar_writer.rb b/lib/rubygems/package/tar_writer.rb index dfd635724b..59bb476664 100644 --- a/lib/rubygems/package/tar_writer.rb +++ b/lib/rubygems/package/tar_writer.rb @@ -195,6 +195,8 @@ class Gem::Package::TarWriter digest_name == signer.digest_name end + raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest + if signer.key then signature = signer.sign signature_digest.digest diff --git a/lib/rubygems/server.rb b/lib/rubygems/server.rb index 7655be22ce..728e4f3bf1 100644 --- a/lib/rubygems/server.rb +++ b/lib/rubygems/server.rb @@ -625,6 +625,18 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; } executables = nil if executables.empty? executables.last["is_last"] = true if executables + # Pre-process spec homepage for safety reasons + begin + homepage_uri = URI.parse(spec.homepage) + if [URI::HTTP, URI::HTTPS].member? homepage_uri.class + homepage_uri = spec.homepage + else + homepage_uri = "." + end + rescue URI::InvalidURIError + homepage_uri = "." + end + specs << { "authors" => spec.authors.sort.join(", "), "date" => spec.date.to_s, @@ -634,7 +646,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; } "only_one_executable" => (executables && executables.size == 1), "full_name" => spec.full_name, "has_deps" => !deps.empty?, - "homepage" => spec.homepage, + "homepage" => homepage_uri, "name" => spec.name, "rdoc_installed" => Gem::RDoc.new(spec).rdoc_installed?, "ri_installed" => Gem::RDoc.new(spec).ri_installed?, diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb index 6d46621823..da75d1cf04 100644 --- a/lib/rubygems/specification.rb +++ b/lib/rubygems/specification.rb @@ -13,6 +13,7 @@ require 'rubygems/deprecate' require 'rubygems/basic_specification' require 'rubygems/stub_specification' require 'rubygems/util/stringio' +require 'uri' ## # The Specification class contains the information for a Gem. Typically @@ -2609,10 +2610,16 @@ http://opensource.org/licenses/alphabetical raise Gem::InvalidSpecificationException, "#{lazy} is not a summary" end - if homepage and not homepage.empty? and - homepage !~ /\A[a-z][a-z\d+.-]*:/i then - raise Gem::InvalidSpecificationException, - "\"#{homepage}\" is not a URI" + # Make sure a homepage is valid HTTP/HTTPS URI + if homepage and not homepage.empty? + begin + homepage_uri = URI.parse(homepage) + unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class + raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI" + end + rescue URI::InvalidURIError + raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI" + end end # Warnings |