* lib/rubygems.rb: bump version to 2.4.7 and 2.4.8. these versions fixed

  CVE-2015-3900.
* lib/rubygems/remote_fetcher.rb: ditto.
* test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@50829 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

2 files changed, 8 insertions, 2 deletions

diff --git a/lib/rubygems.rb b/lib/rubygems.rb
index 2bd8cc77f9..817805c1f4 100644
--- a/lib/rubygems.rb
+++ b/lib/rubygems.rb
@@ -9,7 +9,7 @@ require 'rbconfig'
 require 'thread'
 
 module Gem
-  VERSION = '2.4.6'
+  VERSION = '2.4.8'
 end
 
 # Must be first since it unloads the prelude from 1.9.2
diff --git a/lib/rubygems/remote_fetcher.rb b/lib/rubygems/remote_fetcher.rb
index da1febbe86..3f107a3981 100644
--- a/lib/rubygems/remote_fetcher.rb
+++ b/lib/rubygems/remote_fetcher.rb
@@ -94,7 +94,13 @@ class Gem::RemoteFetcher
     rescue Resolv::ResolvError
       uri
     else
-      URI.parse "#{uri.scheme}://#{res.target}#{uri.path}"
+      target = res.target.to_s.strip
+
+      if /\.#{Regexp.quote(host)}\z/ =~ target
+        return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
+      end
+
+      uri
     end
   end