summaryrefslogtreecommitdiff
path: root/test
diff options
context:
space:
mode:
Diffstat (limited to 'test')
-rw-r--r--test/rubygems/test_gem.rb10
-rw-r--r--test/rubygems/test_gem_installer.rb108
-rw-r--r--test/rubygems/test_gem_package.rb37
-rw-r--r--test/rubygems/test_gem_package_tar_writer.rb3
-rw-r--r--test/rubygems/test_gem_requirement.rb6
-rw-r--r--test/rubygems/test_gem_specification.rb3
-rw-r--r--test/rubygems/test_gem_text.rb5
7 files changed, 171 insertions, 1 deletions
diff --git a/test/rubygems/test_gem.rb b/test/rubygems/test_gem.rb
index b65787470c..e740a5ab94 100644
--- a/test/rubygems/test_gem.rb
+++ b/test/rubygems/test_gem.rb
@@ -150,6 +150,11 @@ class TestGem < Gem::TestCase
File.umask(umask)
end
+ def test_self_install_permissions_with_format_executable
+ @format_executable = true
+ assert_self_install_permissions
+ end
+
def assert_self_install_permissions
mask = /mingw|mswin/ =~ RUBY_PLATFORM ? 0700 : 0777
options = {
@@ -157,6 +162,7 @@ class TestGem < Gem::TestCase
:prog_mode => 0510,
:data_mode => 0640,
:wrappers => true,
+ :format_executable => !!(@format_executable if defined?(@format_executable))
}
Dir.chdir @tempdir do
Dir.mkdir 'bin'
@@ -182,8 +188,10 @@ class TestGem < Gem::TestCase
prog_mode = (options[:prog_mode] & mask).to_s(8)
dir_mode = (options[:dir_mode] & mask).to_s(8)
data_mode = (options[:data_mode] & mask).to_s(8)
+ prog_name = 'foo.cmd'
+ prog_name = RUBY_INSTALL_NAME.sub('ruby', 'foo.cmd') if options[:format_executable]
expected = {
- "bin/#{RUBY_INSTALL_NAME.sub('ruby', 'foo.cmd')}" => prog_mode,
+ "bin/#{prog_name}" => prog_mode,
'gems/foo-1' => dir_mode,
'gems/foo-1/bin' => dir_mode,
'gems/foo-1/data' => dir_mode,
diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb
index 23c153d69b..e32cccaf6d 100644
--- a/test/rubygems/test_gem_installer.rb
+++ b/test/rubygems/test_gem_installer.rb
@@ -1446,6 +1446,114 @@ gem 'other', version
end
end
+ def test_pre_install_checks_malicious_name_before_eval
+ spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1'
+ def spec.full_name # so the spec is buildable
+ "malicious-1"
+ end
+ def spec.validate(*args); end
+
+ util_build_gem spec
+
+ gem = File.join(@gemhome, 'cache', spec.file_name)
+
+ use_ui @ui do
+ @installer = Gem::Installer.at gem
+ e = assert_raises Gem::InstallError do
+ @installer.pre_install_checks
+ end
+ assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message
+ end
+ refute defined?(::Object::FROM_EVAL)
+ end
+
+ def test_pre_install_checks_malicious_require_paths_before_eval
+ spec = util_spec "malicious", '1'
+ def spec.full_name # so the spec is buildable
+ "malicious-1"
+ end
+ def spec.validate(*args); end
+ spec.require_paths = ["malicious\n``"]
+
+ util_build_gem spec
+
+ gem = File.join(@gemhome, 'cache', spec.file_name)
+
+ use_ui @ui do
+ @installer = Gem::Installer.at gem
+ e = assert_raises Gem::InstallError do
+ @installer.pre_install_checks
+ end
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message
+ end
+ end
+
+ def test_pre_install_checks_malicious_extensions_before_eval
+ skip "mswin environment disallow to create file contained the carriage return code." if Gem.win_platform?
+
+ spec = util_spec "malicious", '1'
+ def spec.full_name # so the spec is buildable
+ "malicious-1"
+ end
+ def spec.validate(*args); end
+ spec.extensions = ["malicious\n``"]
+
+ util_build_gem spec
+
+ gem = File.join(@gemhome, 'cache', spec.file_name)
+
+ use_ui @ui do
+ @installer = Gem::Installer.at gem
+ e = assert_raises Gem::InstallError do
+ @installer.pre_install_checks
+ end
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message
+ end
+ end
+
+ def test_pre_install_checks_malicious_specification_version_before_eval
+ spec = util_spec "malicious", '1'
+ def spec.full_name # so the spec is buildable
+ "malicious-1"
+ end
+ def spec.validate(*args); end
+ spec.specification_version = "malicious\n``"
+
+ util_build_gem spec
+
+ gem = File.join(@gemhome, 'cache', spec.file_name)
+
+ use_ui @ui do
+ @installer = Gem::Installer.at gem
+ e = assert_raises Gem::InstallError do
+ @installer.pre_install_checks
+ end
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message
+ end
+ end
+
+ def test_pre_install_checks_malicious_dependencies_before_eval
+ spec = util_spec "malicious", '1'
+ def spec.full_name # so the spec is buildable
+ "malicious-1"
+ end
+ def spec.validate(*args); end
+ spec.add_dependency "b\nfoo", '> 5'
+
+ util_build_gem spec
+
+ gem = File.join(@gemhome, 'cache', spec.file_name)
+
+ use_ui @ui do
+ @installer = Gem::Installer.at gem
+ @installer.ignore_dependencies = true
+ e = assert_raises Gem::InstallError do
+ @installer.pre_install_checks
+ end
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message
+ end
+ end
+
def test_shebang
util_make_exec @spec, "#!/usr/bin/ruby"
diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb
index 77c5b65c90..495c7fd644 100644
--- a/test/rubygems/test_gem_package.rb
+++ b/test/rubygems/test_gem_package.rb
@@ -105,6 +105,7 @@ class TestGemPackage < Gem::Package::TarTestCase
end
def test_build_time_source_date_epoch
+ epoch = ENV["SOURCE_DATE_EPOCH"]
ENV["SOURCE_DATE_EPOCH"] = "123456789"
spec = Gem::Specification.new 'build', '1'
@@ -118,6 +119,8 @@ class TestGemPackage < Gem::Package::TarTestCase
package = Gem::Package.new spec.file_name
assert_equal Time.at(ENV["SOURCE_DATE_EPOCH"].to_i).utc, package.build_time
+ ensure
+ ENV["SOURCE_DATE_EPOCH"] = epoch
end
def test_add_files
@@ -526,6 +529,40 @@ class TestGemPackage < Gem::Package::TarTestCase
end
end
+ def test_extract_symlink_parent_doesnt_delete_user_dir
+ package = Gem::Package.new @gem
+
+ # Extract into a subdirectory of @destination; if this test fails it writes
+ # a file outside destination_subdir, but we want the file to remain inside
+ # @destination so it will be cleaned up.
+ destination_subdir = File.join @destination, 'subdir'
+ FileUtils.mkdir_p destination_subdir
+
+ destination_user_dir = File.join @destination, 'user'
+ destination_user_subdir = File.join destination_user_dir, 'dir'
+ FileUtils.mkdir_p destination_user_subdir
+
+ tgz_io = util_tar_gz do |tar|
+ tar.add_symlink 'link', destination_user_dir, 16877
+ tar.add_symlink 'link/dir', '.', 16877
+ end
+
+ e = assert_raises(Gem::Package::PathError, Errno::EACCES) do
+ package.extract_tar_gz tgz_io, destination_subdir
+ end
+
+ assert_path_exists destination_user_subdir
+
+ if Gem::Package::PathError === e
+ assert_equal("installing into parent path #{destination_user_subdir} of " +
+ "#{destination_subdir} is not allowed", e.message)
+ elsif win_platform?
+ skip "symlink - must be admin with no UAC on Windows"
+ else
+ raise e
+ end
+ end
+
def test_extract_tar_gz_directory
package = Gem::Package.new @gem
diff --git a/test/rubygems/test_gem_package_tar_writer.rb b/test/rubygems/test_gem_package_tar_writer.rb
index 408db07de7..517320c011 100644
--- a/test/rubygems/test_gem_package_tar_writer.rb
+++ b/test/rubygems/test_gem_package_tar_writer.rb
@@ -11,9 +11,12 @@ class TestGemPackageTarWriter < Gem::Package::TarTestCase
@data = 'abcde12345'
@io = TempIO.new
@tar_writer = Gem::Package::TarWriter.new @io
+ @epoch = ENV["SOURCE_DATE_EPOCH"]
+ ENV["SOURCE_DATE_EPOCH"] = nil
end
def teardown
+ ENV["SOURCE_DATE_EPOCH"] = @epoch
@tar_writer.close unless @tar_writer.closed?
@io.close!
diff --git a/test/rubygems/test_gem_requirement.rb b/test/rubygems/test_gem_requirement.rb
index 1564ffb0ed..7a59243b6a 100644
--- a/test/rubygems/test_gem_requirement.rb
+++ b/test/rubygems/test_gem_requirement.rb
@@ -20,6 +20,12 @@ class TestGemRequirement < Gem::TestCase
refute_requirement_equal "= 1.2", "= 1.3"
refute_requirement_equal "= 1.3", "= 1.2"
+ refute_requirement_equal "~> 1.3", "~> 1.3.0"
+ refute_requirement_equal "~> 1.3.0", "~> 1.3"
+
+ assert_requirement_equal ["> 2", "~> 1.3"], ["> 2.0", "~> 1.3"]
+ assert_requirement_equal ["> 2.0", "~> 1.3"], ["> 2", "~> 1.3"]
+
refute_equal Object.new, req("= 1.2")
refute_equal req("= 1.2"), Object.new
end
diff --git a/test/rubygems/test_gem_specification.rb b/test/rubygems/test_gem_specification.rb
index 8deb211798..d2ecbf4434 100644
--- a/test/rubygems/test_gem_specification.rb
+++ b/test/rubygems/test_gem_specification.rb
@@ -1719,8 +1719,11 @@ dependencies: []
end
def test_date_use_env_source_date_epoch
+ epoch = ENV["SOURCE_DATE_EPOCH"]
ENV["SOURCE_DATE_EPOCH"] = "123456789"
assert_equal Time.utc(1973,11,29,0,0,0), @a1.date
+ ensure
+ ENV["SOURCE_DATE_EPOCH"] = epoch
end
def test_dependencies
diff --git a/test/rubygems/test_gem_text.rb b/test/rubygems/test_gem_text.rb
index 0249c47f83..c50d0bdb7a 100644
--- a/test/rubygems/test_gem_text.rb
+++ b/test/rubygems/test_gem_text.rb
@@ -89,4 +89,9 @@ Without the wrapping, the text might not look good in the RSS feed.
s = "ab" * 500_001
assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)
end
+
+ def test_clean_text
+ assert_equal ".]2;nyan.", clean_text("\e]2;nyan\a")
+ end
+
end
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-04 17:09:11 +0000