Backport RubyGems 3.0.3: [Backport #15637]

	* Fixed following vulnerabilities:
	  * CVE-2019-8320: Delete directory using symlink when decompressing tar
	  * CVE-2019-8321: Escape sequence injection vulnerability in verbose
	  * CVE-2019-8322: Escape sequence injection vulnerability in gem owner
	  * CVE-2019-8323: Escape sequence injection vulnerability in API response handling
	  * CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
	  * CVE-2019-8325: Escape sequence injection vulnerability in errors

	* see also https://blog.rubygems.org/2019/03/05/3.0.3-released.html


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67182 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 37 insertions, 0 deletions

diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb
index 77c5b65c90..495c7fd644 100644
--- a/test/rubygems/test_gem_package.rb
+++ b/test/rubygems/test_gem_package.rb
@@ -105,6 +105,7 @@ class TestGemPackage < Gem::Package::TarTestCase
   end
 
   def test_build_time_source_date_epoch
+    epoch = ENV["SOURCE_DATE_EPOCH"]
     ENV["SOURCE_DATE_EPOCH"] = "123456789"
 
     spec = Gem::Specification.new 'build', '1'
@@ -118,6 +119,8 @@ class TestGemPackage < Gem::Package::TarTestCase
     package = Gem::Package.new spec.file_name
 
     assert_equal Time.at(ENV["SOURCE_DATE_EPOCH"].to_i).utc, package.build_time
+  ensure
+    ENV["SOURCE_DATE_EPOCH"] = epoch
   end
 
   def test_add_files
@@ -526,6 +529,40 @@ class TestGemPackage < Gem::Package::TarTestCase
     end
   end
 
+  def test_extract_symlink_parent_doesnt_delete_user_dir
+    package = Gem::Package.new @gem
+
+    # Extract into a subdirectory of @destination; if this test fails it writes
+    # a file outside destination_subdir, but we want the file to remain inside
+    # @destination so it will be cleaned up.
+    destination_subdir = File.join @destination, 'subdir'
+    FileUtils.mkdir_p destination_subdir
+
+    destination_user_dir = File.join @destination, 'user'
+    destination_user_subdir = File.join destination_user_dir, 'dir'
+    FileUtils.mkdir_p destination_user_subdir
+
+    tgz_io = util_tar_gz do |tar|
+      tar.add_symlink 'link', destination_user_dir, 16877
+      tar.add_symlink 'link/dir', '.', 16877
+    end
+
+    e = assert_raises(Gem::Package::PathError, Errno::EACCES) do
+      package.extract_tar_gz tgz_io, destination_subdir
+    end
+
+    assert_path_exists destination_user_subdir
+
+    if Gem::Package::PathError === e
+      assert_equal("installing into parent path #{destination_user_subdir} of " +
+                  "#{destination_subdir} is not allowed", e.message)
+    elsif win_platform?
+      skip "symlink - must be admin with no UAC on Windows"
+    else
+      raise e
+    end
+  end
+
   def test_extract_tar_gz_directory
     package = Gem::Package.new @gem