diff options
author | nagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-09-10 05:23:13 +0000 |
---|---|---|
committer | nagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-09-10 05:23:13 +0000 |
commit | 8ae151e7ab6f85185416b53528347f0cca55a10e (patch) | |
tree | c0e8a6247b8ed1b3d80f0b98229a78cbcc8363d1 /test | |
parent | fd41a38470e1ba2ee1857eae08fe909ef34b9b2d (diff) |
lib/rubygems: fix several vulnerabilities in RubyGems; bump to version 2.6.13.
[Backport #13842]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@59814 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'test')
-rw-r--r-- | test/rubygems/test_gem_commands_query_command.rb | 80 | ||||
-rw-r--r-- | test/rubygems/test_gem_installer.rb | 20 | ||||
-rw-r--r-- | test/rubygems/test_gem_remote_fetcher.rb | 15 | ||||
-rw-r--r-- | test/rubygems/test_gem_specification.rb | 32 | ||||
-rw-r--r-- | test/rubygems/test_gem_text.rb | 11 |
5 files changed, 157 insertions, 1 deletions
diff --git a/test/rubygems/test_gem_commands_query_command.rb b/test/rubygems/test_gem_commands_query_command.rb index d8d682b136..469223c6c0 100644 --- a/test/rubygems/test_gem_commands_query_command.rb +++ b/test/rubygems/test_gem_commands_query_command.rb @@ -128,6 +128,86 @@ pl (1) assert_equal '', @ui.error end + def test_execute_details_cleans_text + spec_fetcher do |fetcher| + fetcher.spec 'a', 2 do |s| + s.summary = 'This is a lot of text. ' * 4 + s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"] + s.homepage = "http://a.example.com/\x03" + end + + fetcher.legacy_platform + end + + @cmd.handle_options %w[-r -d] + + use_ui @ui do + @cmd.execute + end + + expected = <<-EOF + +*** REMOTE GEMS *** + +a (2) + Authors: Abraham Lincoln ., . Hirohito + Homepage: http://a.example.com/. + + This is a lot of text. This is a lot of text. This is a lot of text. + This is a lot of text. + +pl (1) + Platform: i386-linux + Author: A User + Homepage: http://example.com + + this is a summary + EOF + + assert_equal expected, @ui.output + assert_equal '', @ui.error + end + + def test_execute_details_truncates_summary + spec_fetcher do |fetcher| + fetcher.spec 'a', 2 do |s| + s.summary = 'This is a lot of text. ' * 10_000 + s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"] + s.homepage = "http://a.example.com/\x03" + end + + fetcher.legacy_platform + end + + @cmd.handle_options %w[-r -d] + + use_ui @ui do + @cmd.execute + end + + expected = <<-EOF + +*** REMOTE GEMS *** + +a (2) + Authors: Abraham Lincoln ., . Hirohito + Homepage: http://a.example.com/. + + Truncating the summary for a-2 to 100,000 characters: +#{" This is a lot of text. This is a lot of text. This is a lot of text.\n" * 1449} This is a lot of te + +pl (1) + Platform: i386-linux + Author: A User + Homepage: http://example.com + + this is a summary + EOF + + assert_equal expected, @ui.output + assert_equal '', @ui.error + end + def test_execute_installed @cmd.handle_options %w[-n a --installed] diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb index 882981d344..dd049214fb 100644 --- a/test/rubygems/test_gem_installer.rb +++ b/test/rubygems/test_gem_installer.rb @@ -1448,6 +1448,26 @@ gem 'other', version end end + def test_pre_install_checks_malicious_name + spec = util_spec '../malicious', '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate; end + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal '#<Gem::Specification name=../malicious version=1> has an invalid name', e.message + end + end + def test_shebang util_make_exec @spec, "#!/usr/bin/ruby" diff --git a/test/rubygems/test_gem_remote_fetcher.rb b/test/rubygems/test_gem_remote_fetcher.rb index cb994462cd..fbb7d89019 100644 --- a/test/rubygems/test_gem_remote_fetcher.rb +++ b/test/rubygems/test_gem_remote_fetcher.rb @@ -241,6 +241,21 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg== dns.verify end + def test_api_endpoint_ignores_trans_domain_values_that_end_with_original_in_path + uri = URI.parse "http://example.com/foo" + target = MiniTest::Mock.new + target.expect :target, "evil.com/a.example.com" + + dns = MiniTest::Mock.new + dns.expect :getresource, target, [String, Object] + + fetch = Gem::RemoteFetcher.new nil, dns + assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri) + + target.verify + dns.verify + end + def test_api_endpoint_timeout_warning uri = URI.parse "http://gems.example.com/foo" diff --git a/test/rubygems/test_gem_specification.rb b/test/rubygems/test_gem_specification.rb index d43289d745..0fcc11e78f 100644 --- a/test/rubygems/test_gem_specification.rb +++ b/test/rubygems/test_gem_specification.rb @@ -2985,7 +2985,37 @@ Did you mean 'Ruby'? @a1.validate end - assert_equal 'invalid value for attribute name: ":json"', e.message + assert_equal 'invalid value for attribute name: ":json" must be a string', e.message + + @a1.name = [] + e = assert_raises Gem::InvalidSpecificationException do + @a1.validate + end + assert_equal "invalid value for attribute name: \"[]\" must be a string", e.message + + @a1.name = "" + e = assert_raises Gem::InvalidSpecificationException do + @a1.validate + end + assert_equal "invalid value for attribute name: \"\" must include at least one letter", e.message + + @a1.name = "12345" + e = assert_raises Gem::InvalidSpecificationException do + @a1.validate + end + assert_equal "invalid value for attribute name: \"12345\" must include at least one letter", e.message + + @a1.name = "../malicious" + e = assert_raises Gem::InvalidSpecificationException do + @a1.validate + end + assert_equal "invalid value for attribute name: \"../malicious\" can only include letters, numbers, dashes, and underscores", e.message + + @a1.name = "\ba\t" + e = assert_raises Gem::InvalidSpecificationException do + @a1.validate + end + assert_equal "invalid value for attribute name: \"\\ba\\t\" can only include letters, numbers, dashes, and underscores", e.message end def test_validate_non_nil diff --git a/test/rubygems/test_gem_text.rb b/test/rubygems/test_gem_text.rb index a6e22e04da..04f3f605e8 100644 --- a/test/rubygems/test_gem_text.rb +++ b/test/rubygems/test_gem_text.rb @@ -36,6 +36,10 @@ Without the wrapping, the text might not look good in the RSS feed. assert_equal expected, format_text(text, 78) end + def test_format_removes_nonprintable_characters + assert_equal "text with weird .. stuff .", format_text("text with weird \x1b\x02 stuff \x7f", 40) + end + def test_min3 assert_equal 1, min3(1, 1, 1) assert_equal 1, min3(1, 1, 2) @@ -74,4 +78,11 @@ Without the wrapping, the text might not look good in the RSS feed. assert_equal 7, levenshtein_distance("xxxxxxx", "ZenTest") assert_equal 7, levenshtein_distance("zentest", "xxxxxxx") end + + def test_truncate_text + assert_equal "abc", truncate_text("abc", "desc") + assert_equal "Truncating desc to 2 characters:\nab", truncate_text("abc", "desc", 2) + s = "ab" * 500_001 + assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000) + end end |