1 files changed, 10 insertions, 0 deletions
diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
index 8695b85fec..3bf4f8fd62 100644
--- a/lib/rubygems/package.rb
+++ b/lib/rubygems/package.rb
@@ -456,6 +456,16 @@ EOM
     raise Gem::Package::PathError.new(destination, destination_dir) unless
       destination.start_with? destination_dir + '/'
 
+    begin
+      real_destination = File.expand_path(File.realpath(destination))
+    rescue
+      # it's fine if the destination doesn't exist, because rm -rf'ing it can't cause any damage
+      nil
+    else
+      raise Gem::Package::PathError.new(real_destination, destination_dir) unless
+        real_destination.start_with? destination_dir + '/'
+    end
+
     destination.untaint
     destination
   end