diff options
author | David RodrÃguez <deivid.rodriguez@riseup.net> | 2021-10-06 18:17:37 +0200 |
---|---|---|
committer | git <svn-admin@ruby-lang.org> | 2021-10-10 23:12:47 +0900 |
commit | bbcf8f87ac50be423991ccbb2d83ac09ebecf46a (patch) | |
tree | ce9e1153cc80d6c0d5ef0282813f4f637d885d4b /test/rubygems/test_gem_package.rb | |
parent | a5289bfa71d85d7c3ab1ebf94237edecd847851b (diff) |
[ruby/rubygems] Check safety of packaged symlinks
If we explicitly disallow the creation of symlinks that point to files
outside of the destination directory, we can avoid any other safety
checks while creating directories, because we can be sure they will
always fall under the destination directory as well.
https://github.com/rubygems/rubygems/commit/555692b8de
Diffstat (limited to 'test/rubygems/test_gem_package.rb')
-rw-r--r-- | test/rubygems/test_gem_package.rb | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb index 5dabcfd47c..27afca1ccb 100644 --- a/test/rubygems/test_gem_package.rb +++ b/test/rubygems/test_gem_package.rb @@ -574,7 +574,7 @@ class TestGemPackage < Gem::Package::TarTestCase destination_subdir = File.join @destination, 'subdir' FileUtils.mkdir_p destination_subdir - expected_exceptions = win_platform? ? [Gem::Package::PathError, Errno::EACCES] : [Gem::Package::PathError] + expected_exceptions = win_platform? ? [Gem::Package::SymlinkError, Errno::EACCES] : [Gem::Package::SymlinkError] e = assert_raise(*expected_exceptions) do package.extract_tar_gz tgz_io, destination_subdir @@ -582,10 +582,11 @@ class TestGemPackage < Gem::Package::TarTestCase pend "symlink - must be admin with no UAC on Windows" if Errno::EACCES === e - assert_equal("installing into parent path lib/link/outside.txt of " + + assert_equal("installing symlink 'lib/link' pointing to parent path #{@destination} of " + "#{destination_subdir} is not allowed", e.message) assert_path_not_exist File.join(@destination, "outside.txt") + assert_path_not_exist File.join(destination_subdir, "lib/link") end def test_extract_symlink_parent_doesnt_delete_user_dir @@ -608,7 +609,7 @@ class TestGemPackage < Gem::Package::TarTestCase tar.add_symlink 'link/dir', '.', 16877 end - expected_exceptions = win_platform? ? [Gem::Package::PathError, Errno::EACCES] : [Gem::Package::PathError] + expected_exceptions = win_platform? ? [Gem::Package::SymlinkError, Errno::EACCES] : [Gem::Package::SymlinkError] e = assert_raise(*expected_exceptions) do package.extract_tar_gz tgz_io, destination_subdir @@ -616,10 +617,12 @@ class TestGemPackage < Gem::Package::TarTestCase pend "symlink - must be admin with no UAC on Windows" if Errno::EACCES === e - assert_equal("installing into parent path #{destination_user_subdir} of " + + assert_equal("installing symlink 'link' pointing to parent path #{destination_user_dir} of " + "#{destination_subdir} is not allowed", e.message) assert_path_exist destination_user_subdir + assert_path_not_exist File.join(destination_subdir, "link/dir") + assert_path_not_exist File.join(destination_subdir, "link") end def test_extract_tar_gz_directory |