diff options
| author | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-03-06 09:01:48 +0000 |
|---|---|---|
| committer | naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2019-03-06 09:01:48 +0000 |
| commit | e0005fdc2734871c4acd7dcf269e1566388794c4 (patch) | |
| tree | 8ad55fb2e000a2a66be1671e632f170db12c1e2b /test/rubygems/test_gem.rb | |
| parent | f5452efcf863e4c15577e53c52e6e8726e70f5c4 (diff) | |
Backport RubyGems 3.0.3: [Backport #15637]
* Fixed following vulnerabilities:
* CVE-2019-8320: Delete directory using symlink when decompressing tar
* CVE-2019-8321: Escape sequence injection vulnerability in verbose
* CVE-2019-8322: Escape sequence injection vulnerability in gem owner
* CVE-2019-8323: Escape sequence injection vulnerability in API response handling
* CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
* CVE-2019-8325: Escape sequence injection vulnerability in errors
* see also https://blog.rubygems.org/2019/03/05/3.0.3-released.html
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67182 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'test/rubygems/test_gem.rb')
| -rw-r--r-- | test/rubygems/test_gem.rb | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/test/rubygems/test_gem.rb b/test/rubygems/test_gem.rb index b65787470c..e740a5ab94 100644 --- a/test/rubygems/test_gem.rb +++ b/test/rubygems/test_gem.rb @@ -150,6 +150,11 @@ class TestGem < Gem::TestCase File.umask(umask) end + def test_self_install_permissions_with_format_executable + @format_executable = true + assert_self_install_permissions + end + def assert_self_install_permissions mask = /mingw|mswin/ =~ RUBY_PLATFORM ? 0700 : 0777 options = { @@ -157,6 +162,7 @@ class TestGem < Gem::TestCase :prog_mode => 0510, :data_mode => 0640, :wrappers => true, + :format_executable => !!(@format_executable if defined?(@format_executable)) } Dir.chdir @tempdir do Dir.mkdir 'bin' @@ -182,8 +188,10 @@ class TestGem < Gem::TestCase prog_mode = (options[:prog_mode] & mask).to_s(8) dir_mode = (options[:dir_mode] & mask).to_s(8) data_mode = (options[:data_mode] & mask).to_s(8) + prog_name = 'foo.cmd' + prog_name = RUBY_INSTALL_NAME.sub('ruby', 'foo.cmd') if options[:format_executable] expected = { - "bin/#{RUBY_INSTALL_NAME.sub('ruby', 'foo.cmd')}" => prog_mode, + "bin/#{prog_name}" => prog_mode, 'gems/foo-1' => dir_mode, 'gems/foo-1/bin' => dir_mode, 'gems/foo-1/data' => dir_mode, |