1 files changed, 58 insertions, 46 deletions

diff --git a/lib/rubygems/source.rb b/lib/rubygems/source.rb
index aa0cbc1641..86717e3e71 100644
--- a/lib/rubygems/source.rb
+++ b/lib/rubygems/source.rb
@@ -5,16 +5,16 @@ require_relative "text"
 # A Source knows how to list and fetch gems from a RubyGems marshal index.
 #
 # There are other Source subclasses for installed gems, local gems, the
-# bundler dependency API and so-forth.
+# Compact Index API and so-forth.
 
 class Gem::Source
   include Comparable
   include Gem::Text
 
   FILES = { # :nodoc:
-    :released => "specs",
-    :latest => "latest_specs",
-    :prerelease => "prerelease_specs",
+    released: "specs",
+    latest: "latest_specs",
+    prerelease: "prerelease_specs",
   }.freeze
 
   ##
@@ -44,20 +44,18 @@ class Gem::Source
          Gem::Source::Vendor then
       -1
     when Gem::Source then
-      if !@uri
+      unless @uri
         return 0 unless other.uri
         return 1
       end
 
-      return -1 if !other.uri
+      return -1 unless other.uri
 
       # Returning 1 here ensures that when sorting a list of sources, the
       # original ordering of sources supplied by the user is preserved.
       return 1 unless @uri.to_s == other.uri.to_s
 
       0
-    else
-      nil
     end
   end
 
@@ -69,28 +67,11 @@ class Gem::Source
 
   ##
   # Returns a Set that can fetch specifications from this source.
-
-  def dependency_resolver_set # :nodoc:
-    return Gem::Resolver::IndexSet.new self if "file" == uri.scheme
-
-    fetch_uri = if uri.host == "rubygems.org"
-      index_uri = uri.dup
-      index_uri.host = "index.rubygems.org"
-      index_uri
-    else
-      uri
-    end
-
-    bundler_api_uri = enforce_trailing_slash(fetch_uri)
-
-    begin
-      fetcher = Gem::RemoteFetcher.fetcher
-      response = fetcher.fetch_path bundler_api_uri, nil, true
-    rescue Gem::RemoteFetcher::FetchError
-      Gem::Resolver::IndexSet.new self
-    else
-      Gem::Resolver::APISet.new response.uri + "./info/"
-    end
+  #
+  # The set will optionally fetch prereleases if requested.
+  #
+  def dependency_resolver_set(prerelease = false)
+    new_dependency_resolver_set.tap {|set| set.prerelease = prerelease }
   end
 
   def hash # :nodoc:
@@ -102,8 +83,7 @@ class Gem::Source
 
   def cache_dir(uri)
     # Correct for windows paths
-    escaped_path = uri.path.sub(/^\/([a-z]):\//i, '/\\1-/')
-    escaped_path.tap(&Gem::UNTAINT)
+    escaped_path = uri.path.sub(%r{^/([a-z]):/}i, '/\\1-/')
 
     File.join Gem.spec_cache_dir, "#{uri.host}%#{uri.port}", File.dirname(escaped_path)
   end
@@ -122,7 +102,7 @@ class Gem::Source
   end
 
   ##
-  # Fetches a specification for the given +name_tuple+.
+  # Fetches a specification for the given Gem::NameTuple.
 
   def fetch_spec(name_tuple)
     fetcher = Gem::RemoteFetcher.fetcher
@@ -137,7 +117,12 @@ class Gem::Source
 
     if File.exist? local_spec
       spec = Gem.read_binary local_spec
-      spec = Marshal.load(spec) rescue nil
+      Gem.load_safe_marshal
+      spec = begin
+               Gem::SafeMarshal.safe_load(spec)
+             rescue StandardError
+               nil
+             end
       return spec if spec
     end
 
@@ -155,8 +140,9 @@ class Gem::Source
       end
     end
 
+    Gem.load_safe_marshal
     # TODO: Investigate setting Gem::Specification#loaded_from to a URI
-    Marshal.load spec
+    Gem::SafeMarshal.safe_load spec
   end
 
   ##
@@ -186,8 +172,9 @@ class Gem::Source
 
     spec_dump = fetcher.cache_update_path spec_path, local_file, update_cache?
 
+    Gem.load_safe_marshal
     begin
-      Gem::NameTuple.from_list Marshal.load(spec_dump)
+      Gem::NameTuple.from_list Gem::SafeMarshal.safe_load(spec_dump)
     rescue ArgumentError
       if update_cache? && !retried
         FileUtils.rm local_file
@@ -203,33 +190,58 @@ class Gem::Source
   # Downloads +spec+ and writes it to +dir+.  See also
   # Gem::RemoteFetcher#download.
 
-  def download(spec, dir=Dir.pwd)
+  def download(spec, dir = Dir.pwd)
     fetcher = Gem::RemoteFetcher.fetcher
     fetcher.download spec, uri.to_s, dir
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[Remote:", "]" do
-      q.breakable
-      q.text @uri.to_s
-
-      if api = uri
+    q.object_group(self) do
+      q.group 2, "[Remote:", "]" do
         q.breakable
-        q.text "API URI: "
-        q.text api.to_s
+        q.text @uri.to_s
+
+        if api = uri
+          q.breakable
+          q.text "API URI: "
+          q.text api.to_s
+        end
       end
     end
   end
 
-  def typo_squatting?(host, distance_threshold=4)
+  def typo_squatting?(host, distance_threshold = 4)
     return if @uri.host.nil?
     levenshtein_distance(@uri.host, host).between? 1, distance_threshold
   end
 
   private
 
+  def new_dependency_resolver_set
+    return Gem::Resolver::IndexSet.new self if uri.scheme == "file"
+
+    fetch_uri = if uri.host == "rubygems.org"
+      index_uri = uri.dup
+      index_uri.host = "index.rubygems.org"
+      index_uri
+    else
+      uri
+    end
+
+    bundler_api_uri = enforce_trailing_slash(fetch_uri) + "versions"
+
+    begin
+      fetcher = Gem::RemoteFetcher.fetcher
+      response = fetcher.fetch_path bundler_api_uri, nil, true
+    rescue Gem::RemoteFetcher::FetchError
+      Gem::Resolver::IndexSet.new self
+    else
+      Gem::Resolver::APISet.new response.uri + "./info/"
+    end
+  end
+
   def enforce_trailing_slash(uri)
-    uri.merge(uri.path.gsub(/\/+$/, "") + "/")
+    uri.merge(uri.path.gsub(%r{/+$}, "") + "/")
   end
 end