From 08f8cfe14e0f8937e3bcf8a22becdc5ce60b920e Mon Sep 17 00:00:00 2001
From: hsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 5 Mar 2019 03:32:58 +0000
Subject: Merge RubyGems upstream: 56c0bbb69e4506bda7ef7f447dfec5db820df20b

  It fixed the multiple vulnerabilities.
  https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@67168 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 test/rubygems/test_gem.rb                          |  44 +++---
 test/rubygems/test_gem_command_manager.rb          |  10 ++
 test/rubygems/test_gem_commands_install_command.rb | 151 ++++++++++++++++++
 test/rubygems/test_gem_commands_owner_command.rb   |   8 +-
 test/rubygems/test_gem_commands_push_command.rb    |   8 +-
 test/rubygems/test_gem_commands_update_command.rb  |  55 +++++++
 test/rubygems/test_gem_commands_yank_command.rb    |  45 ++++++
 test/rubygems/test_gem_indexer.rb                  |  16 +-
 test/rubygems/test_gem_installer.rb                | 171 +++++++++++++++++++--
 test/rubygems/test_gem_package.rb                  |  34 ++++
 test/rubygems/test_gem_requirement.rb              |   1 -
 test/rubygems/test_gem_specification.rb            |   8 +
 test/rubygems/test_gem_text.rb                     |   4 +
 13 files changed, 503 insertions(+), 52 deletions(-)

(limited to 'test')

diff --git a/test/rubygems/test_gem.rb b/test/rubygems/test_gem.rb
index b2f718bf1a..ad802e0f95 100644
--- a/test/rubygems/test_gem.rb
+++ b/test/rubygems/test_gem.rb
@@ -155,8 +155,10 @@ class TestGem < Gem::TestCase
 
   def test_self_install_permissions_with_format_executable_and_non_standard_ruby_install_name
     Gem::Installer.exec_format = nil
-    ruby_install_name 'ruby27' do
-      assert_self_install_permissions(format_executable: true)
+    with_clean_path_to_ruby do
+      ruby_install_name 'ruby27' do
+        assert_self_install_permissions(format_executable: true)
+      end
     end
   ensure
     Gem::Installer.exec_format = nil
@@ -553,7 +555,7 @@ class TestGem < Gem::TestCase
 
     Gem.ensure_gem_subdirectories @gemhome, 0750
 
-    assert File.directory? File.join(@gemhome, "cache")
+    assert_directory_exists File.join(@gemhome, "cache")
 
     assert_equal 0750, File::Stat.new(@gemhome).mode & 0777
     assert_equal 0750, File::Stat.new(File.join(@gemhome, "cache")).mode & 0777
@@ -582,7 +584,7 @@ class TestGem < Gem::TestCase
 
     Gem.ensure_gem_subdirectories gemdir
 
-    assert File.directory?(util_cache_dir)
+    assert_directory_exists util_cache_dir
   end
 
   unless win_platform? || Process.uid.zero?  # only for FS that support write protection
@@ -952,40 +954,36 @@ class TestGem < Gem::TestCase
   end
 
   def test_self_ruby_escaping_spaces_in_path
-    orig_ruby = Gem.ruby
     orig_bindir = RbConfig::CONFIG['bindir']
-    orig_ruby_install_name = RbConfig::CONFIG['ruby_install_name']
     orig_exe_ext = RbConfig::CONFIG['EXEEXT']
 
     RbConfig::CONFIG['bindir'] = "C:/Ruby 1.8/bin"
-    RbConfig::CONFIG['ruby_install_name'] = "ruby"
     RbConfig::CONFIG['EXEEXT'] = ".exe"
-    Gem.instance_variable_set("@ruby", nil)
 
-    assert_equal "\"C:/Ruby 1.8/bin/ruby.exe\"", Gem.ruby
+    ruby_install_name "ruby" do
+      with_clean_path_to_ruby do
+        assert_equal "\"C:/Ruby 1.8/bin/ruby.exe\"", Gem.ruby
+      end
+    end
   ensure
-    Gem.instance_variable_set("@ruby", orig_ruby)
     RbConfig::CONFIG['bindir'] = orig_bindir
-    RbConfig::CONFIG['ruby_install_name'] = orig_ruby_install_name
     RbConfig::CONFIG['EXEEXT'] = orig_exe_ext
   end
 
   def test_self_ruby_path_without_spaces
-    orig_ruby = Gem.ruby
     orig_bindir = RbConfig::CONFIG['bindir']
-    orig_ruby_install_name = RbConfig::CONFIG['ruby_install_name']
     orig_exe_ext = RbConfig::CONFIG['EXEEXT']
 
     RbConfig::CONFIG['bindir'] = "C:/Ruby18/bin"
-    RbConfig::CONFIG['ruby_install_name'] = "ruby"
     RbConfig::CONFIG['EXEEXT'] = ".exe"
-    Gem.instance_variable_set("@ruby", nil)
 
-    assert_equal "C:/Ruby18/bin/ruby.exe", Gem.ruby
+    ruby_install_name "ruby" do
+      with_clean_path_to_ruby do
+        assert_equal "C:/Ruby18/bin/ruby.exe", Gem.ruby
+      end
+    end
   ensure
-    Gem.instance_variable_set("@ruby", orig_ruby)
     RbConfig::CONFIG['bindir'] = orig_bindir
-    RbConfig::CONFIG['ruby_install_name'] = orig_ruby_install_name
     RbConfig::CONFIG['EXEEXT'] = orig_exe_ext
   end
 
@@ -1904,6 +1902,16 @@ You may need to `gem install -g` to install missing gems
     end
   end
 
+  def with_clean_path_to_ruby
+    orig_ruby = Gem.ruby
+
+    Gem.instance_variable_set :@ruby, nil
+
+    yield
+  ensure
+    Gem.instance_variable_set("@ruby", orig_ruby)
+  end
+
   def with_plugin(path)
     test_plugin_path = File.expand_path("test/rubygems/plugin/#{path}",
                                         @@project_dir)
diff --git a/test/rubygems/test_gem_command_manager.rb b/test/rubygems/test_gem_command_manager.rb
index 6ada96f1c1..83757b74c8 100644
--- a/test/rubygems/test_gem_command_manager.rb
+++ b/test/rubygems/test_gem_command_manager.rb
@@ -103,6 +103,16 @@ class TestGemCommandManager < Gem::TestCase
     assert_match(/invalid option: --bad-arg/i, @ui.error)
   end
 
+  def test_process_args_bad_no_ri
+    use_ui @ui do
+      assert_raises Gem::MockGemUi::TermError do
+        @command_manager.process_args %w[--no-ri]
+      end
+    end
+
+    assert_match(/invalid option: --no-ri. Use --no-document instead./i, @ui.error)
+  end
+
   # HACK move to install command test
   def test_process_args_install
     #capture all install options
diff --git a/test/rubygems/test_gem_commands_install_command.rb b/test/rubygems/test_gem_commands_install_command.rb
index 21aa29822f..1812c221b5 100644
--- a/test/rubygems/test_gem_commands_install_command.rb
+++ b/test/rubygems/test_gem_commands_install_command.rb
@@ -96,6 +96,64 @@ class TestGemCommandsInstallCommand < Gem::TestCase
     assert_match "1 gem installed", @ui.output
   end
 
+  def test_execute_local_dependency_nonexistent
+    specs = spec_fetcher do |fetcher|
+      fetcher.gem 'foo', 2, 'bar' => '0.5'
+    end
+
+    @cmd.options[:domain] = :local
+
+    FileUtils.mv specs['foo-2'].cache_file, @tempdir
+
+    @cmd.options[:args] = ['foo']
+
+    use_ui @ui do
+      orig_dir = Dir.pwd
+      begin
+        Dir.chdir @tempdir
+        e = assert_raises Gem::MockGemUi::TermError do
+          @cmd.execute
+        end
+        assert_equal 2, e.exit_code
+      ensure
+        Dir.chdir orig_dir
+      end
+    end
+
+    expected = <<-EXPECTED
+ERROR:  Could not find a valid gem 'bar' (= 0.5) (required by 'foo' (>= 0)) in any repository
+    EXPECTED
+
+    assert_equal expected, @ui.error
+  end
+
+  def test_execute_local_dependency_nonexistent_ignore_dependencies
+    specs = spec_fetcher do |fetcher|
+      fetcher.gem 'foo', 2, 'bar' => '0.5'
+    end
+
+    @cmd.options[:domain] = :local
+    @cmd.options[:ignore_dependencies] = true
+
+    FileUtils.mv specs['foo-2'].cache_file, @tempdir
+
+    @cmd.options[:args] = ['foo']
+
+    use_ui @ui do
+      orig_dir = Dir.pwd
+      begin
+        Dir.chdir orig_dir
+        assert_raises Gem::MockGemUi::SystemExitException, @ui.error do
+          @cmd.execute
+        end
+      ensure
+        Dir.chdir orig_dir
+      end
+    end
+
+    assert_match "1 gem installed", @ui.output
+  end
+
   def test_execute_local_transitive_prerelease
     specs = spec_fetcher do |fetcher|
       fetcher.download 'a', 2, 'b' => "2.a", 'c' => '3'
@@ -178,6 +236,25 @@ class TestGemCommandsInstallCommand < Gem::TestCase
     assert_match(/ould not find a valid gem 'no_such_gem'/, @ui.error)
   end
 
+  def test_execute_local_missing_ignore_dependencies
+    spec_fetcher
+
+    @cmd.options[:domain] = :local
+    @cmd.options[:ignore_dependencies] = true
+
+    @cmd.options[:args] = %w[no_such_gem]
+
+    use_ui @ui do
+      e = assert_raises Gem::MockGemUi::TermError do
+        @cmd.execute
+      end
+      assert_equal 2, e.exit_code
+    end
+
+    # HACK no repository was checked
+    assert_match(/ould not find a valid gem 'no_such_gem'/, @ui.error)
+  end
+
   def test_execute_no_gem
     @cmd.options[:args] = %w[]
 
@@ -753,6 +830,23 @@ ERROR:  Possible alternatives: non_existent_with_hint
     assert_equal %w[a-2], @cmd.installed_specs.map { |spec| spec.full_name }
   end
 
+  def test_install_gem_ignore_dependencies_remote_platform_local
+    local = Gem::Platform.local
+    spec_fetcher do |fetcher|
+      fetcher.gem 'a', 3
+
+      fetcher.gem 'a', 3 do |s|
+        s.platform = local
+      end
+    end
+
+    @cmd.options[:ignore_dependencies] = true
+
+    @cmd.install_gem 'a', '>= 0'
+
+    assert_equal %W[a-3-#{local}], @cmd.installed_specs.map { |spec| spec.full_name }
+  end
+
   def test_install_gem_ignore_dependencies_specific_file
     spec = util_spec 'a', 2
 
@@ -1168,6 +1262,33 @@ ERROR:  Possible alternatives: non_existent_with_hint
     assert_empty out
   end
 
+  def test_explain_platform_local_ignore_dependencies
+    local = Gem::Platform.local
+    spec_fetcher do |fetcher|
+      fetcher.spec 'a', 3
+
+      fetcher.spec 'a', 3 do |s|
+        s.platform = local
+      end
+    end
+
+    @cmd.options[:ignore_dependencies] = true
+    @cmd.options[:explain] = true
+    @cmd.options[:args] = %w[a]
+
+    use_ui @ui do
+      assert_raises Gem::MockGemUi::SystemExitException, @ui.error do
+        @cmd.execute
+      end
+    end
+
+    out = @ui.output.split "\n"
+
+    assert_equal "Gems to install:", out.shift
+    assert_equal "  a-3-#{local}", out.shift
+    assert_empty out
+  end
+
   def test_explain_platform_ruby
     local = Gem::Platform.local
     spec_fetcher do |fetcher|
@@ -1197,4 +1318,34 @@ ERROR:  Possible alternatives: non_existent_with_hint
     assert_empty out
   end
 
+  def test_explain_platform_ruby_ignore_dependencies
+    local = Gem::Platform.local
+    spec_fetcher do |fetcher|
+      fetcher.spec 'a', 3
+
+      fetcher.spec 'a', 3 do |s|
+        s.platform = local
+      end
+    end
+
+    # equivalent to --platform=ruby
+    Gem.platforms = [Gem::Platform::RUBY]
+
+    @cmd.options[:ignore_dependencies] = true
+    @cmd.options[:explain] = true
+    @cmd.options[:args] = %w[a]
+
+    use_ui @ui do
+      assert_raises Gem::MockGemUi::SystemExitException, @ui.error do
+        @cmd.execute
+      end
+    end
+
+    out = @ui.output.split "\n"
+
+    assert_equal "Gems to install:", out.shift
+    assert_equal "  a-3", out.shift
+    assert_empty out
+  end
+
 end
diff --git a/test/rubygems/test_gem_commands_owner_command.rb b/test/rubygems/test_gem_commands_owner_command.rb
index 071079c0dd..7c86e1f5e8 100644
--- a/test/rubygems/test_gem_commands_owner_command.rb
+++ b/test/rubygems/test_gem_commands_owner_command.rb
@@ -239,10 +239,10 @@ EOF
     response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
     response_success = "Owner added successfully."
 
-    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = proc do
-      @call_count ||= 0
-      (@call_count += 1).odd? ? [response_fail, 401, 'Unauthorized'] : [response_success, 200, 'OK']
-    end
+    @stub_fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners"] = [
+      [response_fail, 401, 'Unauthorized'],
+      [response_success, 200, 'OK']
+    ]
 
     @otp_ui = Gem::MockGemUi.new "111111\n"
     use_ui @otp_ui do
diff --git a/test/rubygems/test_gem_commands_push_command.rb b/test/rubygems/test_gem_commands_push_command.rb
index 185d3cc1fc..955dc7ced3 100644
--- a/test/rubygems/test_gem_commands_push_command.rb
+++ b/test/rubygems/test_gem_commands_push_command.rb
@@ -372,10 +372,10 @@ class TestGemCommandsPushCommand < Gem::TestCase
     response_fail = "You have enabled multifactor authentication but your request doesn't have the correct OTP code. Please check it and retry."
     response_success = 'Successfully registered gem: freewill (1.0.0)'
 
-    @fetcher.data["#{Gem.host}/api/v1/gems"] = proc do
-      @call_count ||= 0
-      (@call_count += 1).odd? ? [response_fail, 401, 'Unauthorized'] : [response_success, 200, 'OK']
-    end
+    @fetcher.data["#{Gem.host}/api/v1/gems"] = [
+      [response_fail, 401, 'Unauthorized'],
+      [response_success, 200, 'OK']
+    ]
 
     @otp_ui = Gem::MockGemUi.new "111111\n"
     use_ui @otp_ui do
diff --git a/test/rubygems/test_gem_commands_update_command.rb b/test/rubygems/test_gem_commands_update_command.rb
index 0247a03477..77851d32d6 100644
--- a/test/rubygems/test_gem_commands_update_command.rb
+++ b/test/rubygems/test_gem_commands_update_command.rb
@@ -543,4 +543,59 @@ class TestGemCommandsUpdateCommand < Gem::TestCase
     assert_empty out
   end
 
+  def test_explain_platform_local
+    local = Gem::Platform.local
+    spec_fetcher do |fetcher|
+      fetcher.download 'a', 2
+
+      fetcher.download 'a', 2 do |s|
+        s.platform = local
+      end
+
+      fetcher.spec 'a', 1
+    end
+
+    @cmd.options[:explain] = true
+    @cmd.options[:args] = %w[a]
+
+    use_ui @ui do
+      @cmd.execute
+    end
+
+    out = @ui.output.split "\n"
+
+    assert_equal "Gems to update:", out.shift
+    assert_equal "  a-2-#{local}", out.shift
+    assert_empty out
+  end
+
+  def test_explain_platform_ruby
+    local = Gem::Platform.local
+    spec_fetcher do |fetcher|
+      fetcher.download 'a', 2
+
+      fetcher.download 'a', 2 do |s|
+        s.platform = local
+      end
+
+      fetcher.spec 'a', 1
+    end
+
+    # equivalent to --platform=ruby
+    Gem.platforms = [Gem::Platform::RUBY]
+
+    @cmd.options[:explain] = true
+    @cmd.options[:args] = %w[a]
+
+    use_ui @ui do
+      @cmd.execute
+    end
+
+    out = @ui.output.split "\n"
+
+    assert_equal "Gems to update:", out.shift
+    assert_equal "  a-2", out.shift
+    assert_empty out
+  end
+
 end
diff --git a/test/rubygems/test_gem_commands_yank_command.rb b/test/rubygems/test_gem_commands_yank_command.rb
index 666779a4ac..602b137d48 100644
--- a/test/rubygems/test_gem_commands_yank_command.rb
+++ b/test/rubygems/test_gem_commands_yank_command.rb
@@ -49,6 +49,7 @@ class TestGemCommandsYankCommand < Gem::TestCase
     assert_match %r%Yanking gem from http://example%, @ui.output
     assert_match %r%Successfully yanked%,      @ui.output
 
+
     platform = Gem.platforms[1]
     body = @fetcher.last_request.body.split('&').sort
     assert_equal %W[gem_name=a platform=#{platform} version=1.0], body
@@ -58,6 +59,50 @@ class TestGemCommandsYankCommand < Gem::TestCase
     assert_equal [yank_uri], @fetcher.paths
   end
 
+  def test_execute_with_otp_success
+    response_fail = 'You have enabled multifactor authentication but your request doesn\'t have the correct OTP code. Please check it and retry.'
+    yank_uri = 'http://example/api/v1/gems/yank'
+    @fetcher.data[yank_uri] = [
+      [response_fail, 401, 'Unauthorized'],
+      ['Successfully yanked', 200, 'OK']
+    ]
+
+    @cmd.options[:args]           = %w[a]
+    @cmd.options[:added_platform] = true
+    @cmd.options[:version]        = req('= 1.0')
+
+    @otp_ui = Gem::MockGemUi.new "111111\n"
+    use_ui @otp_ui do
+      @cmd.execute
+    end
+
+    assert_match 'You have enabled multi-factor authentication. Please enter OTP code.', @otp_ui.output
+    assert_match 'Code: ', @otp_ui.output
+    assert_match %r%Yanking gem from http://example%, @otp_ui.output
+    assert_match %r%Successfully yanked%,      @otp_ui.output
+    assert_equal '111111', @fetcher.last_request['OTP']
+  end
+
+  def test_execute_with_otp_failure
+    response = 'You have enabled multifactor authentication but your request doesn\'t have the correct OTP code. Please check it and retry.'
+    yank_uri = 'http://example/api/v1/gems/yank'
+    @fetcher.data[yank_uri] = [response, 401, 'Unauthorized']
+
+    @cmd.options[:args]           = %w[a]
+    @cmd.options[:added_platform] = true
+    @cmd.options[:version]        = req('= 1.0')
+
+    @otp_ui = Gem::MockGemUi.new "111111\n"
+    use_ui @otp_ui do
+      @cmd.execute
+    end
+
+    assert_match 'You have enabled multi-factor authentication. Please enter OTP code.', @otp_ui.output
+    assert_match response, @otp_ui.output
+    assert_match 'Code: ', @otp_ui.output
+    assert_equal '111111', @fetcher.last_request['OTP']
+  end
+
   def test_execute_key
     yank_uri = 'http://example/api/v1/gems/yank'
     @fetcher.data[yank_uri] = ['Successfully yanked', 200, 'OK']
diff --git a/test/rubygems/test_gem_indexer.rb b/test/rubygems/test_gem_indexer.rb
index cc83cdd81e..167f36f0cf 100644
--- a/test/rubygems/test_gem_indexer.rb
+++ b/test/rubygems/test_gem_indexer.rb
@@ -103,8 +103,8 @@ class TestGemIndexer < Gem::TestCase
     quickdir = File.join @tempdir, 'quick'
     marshal_quickdir = File.join quickdir, "Marshal.#{@marshal_version}"
 
-    assert File.directory?(quickdir)
-    assert File.directory?(marshal_quickdir)
+    assert_directory_exists quickdir
+    assert_directory_exists marshal_quickdir
 
     assert_indexed marshal_quickdir, "#{File.basename(@a1.spec_file)}.rz"
     assert_indexed marshal_quickdir, "#{File.basename(@a2.spec_file)}.rz"
@@ -133,8 +133,8 @@ class TestGemIndexer < Gem::TestCase
     quickdir = File.join @tempdir, 'quick'
     marshal_quickdir = File.join quickdir, "Marshal.#{@marshal_version}"
 
-    assert File.directory?(quickdir), 'quickdir should be directory'
-    assert File.directory?(marshal_quickdir)
+    assert_directory_exists quickdir, 'quickdir should be directory'
+    assert_directory_exists marshal_quickdir
 
     refute_indexed quickdir, "index"
     refute_indexed quickdir, "index.rz"
@@ -179,8 +179,8 @@ class TestGemIndexer < Gem::TestCase
     quickdir = File.join @tempdir, 'quick'
     marshal_quickdir = File.join quickdir, "Marshal.#{@marshal_version}"
 
-    assert File.directory?(quickdir)
-    assert File.directory?(marshal_quickdir)
+    assert_directory_exists quickdir
+    assert_directory_exists marshal_quickdir
 
     assert_indexed marshal_quickdir, "#{File.basename(@a1.spec_file)}.rz"
     assert_indexed marshal_quickdir, "#{File.basename(@a2.spec_file)}.rz"
@@ -315,8 +315,8 @@ class TestGemIndexer < Gem::TestCase
     quickdir = File.join @tempdir, 'quick'
     marshal_quickdir = File.join quickdir, "Marshal.#{@marshal_version}"
 
-    assert File.directory?(quickdir)
-    assert File.directory?(marshal_quickdir)
+    assert_directory_exists quickdir
+    assert_directory_exists marshal_quickdir
 
     @d2_1 = util_spec 'd', '2.1'
     util_build_gem @d2_1
diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb
index ebf23ecfcc..b16404f2b9 100644
--- a/test/rubygems/test_gem_installer.rb
+++ b/test/rubygems/test_gem_installer.rb
@@ -314,7 +314,7 @@ gem 'other', version
     @installer.wrappers = true
 
     @spec.executables = %w[executable]
-    @spec.bindir = '.'
+    @spec.bindir = 'bin'
 
     exec_file = @installer.formatted_program_filename 'executable'
     exec_path = File.join @spec.gem_dir, exec_file
@@ -326,7 +326,7 @@ gem 'other', version
 
     @installer.generate_bin
 
-    assert_equal true, File.directory?(util_inst_bindir)
+    assert_directory_exists (util_inst_bindir)
     installed_exec = File.join(util_inst_bindir, 'executable')
     assert_path_exists installed_exec
     assert_equal mask, File.stat(installed_exec).mode unless win_platform?
@@ -367,7 +367,7 @@ gem 'other', version
     @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
-    assert File.directory? util_inst_bindir
+    assert_directory_exists util_inst_bindir
     installed_exec = File.join util_inst_bindir, 'executable'
     assert_path_exists installed_exec
     assert_equal mask, File.stat(installed_exec).mode unless win_platform?
@@ -384,7 +384,7 @@ gem 'other', version
 
     Gem::Installer.exec_format = 'foo-%s-bar'
     @installer.generate_bin
-    assert_equal true, File.directory?(util_inst_bindir)
+    assert_directory_exists util_inst_bindir
     installed_exec = File.join util_inst_bindir, 'foo-executable-bar'
     assert_path_exists installed_exec
   ensure
@@ -398,7 +398,7 @@ gem 'other', version
 
     Gem::Installer.exec_format = 'foo-%s-bar'
     @installer.generate_bin
-    assert_equal true, File.directory?(util_inst_bindir)
+    assert_directory_exists util_inst_bindir
     installed_exec = File.join util_inst_bindir, 'executable'
     assert_path_exists installed_exec
   ensure
@@ -497,7 +497,7 @@ gem 'other', version
     end
 
     @installer.generate_bin
-    assert_equal true, File.directory?(util_inst_bindir)
+    assert_directory_exists util_inst_bindir
     assert_path_exists installed_exec
     assert_equal mask, File.stat(installed_exec).mode unless win_platform?
 
@@ -515,7 +515,7 @@ gem 'other', version
     @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
-    assert_equal true, File.directory?(util_inst_bindir)
+    assert_directory_exists util_inst_bindir
     installed_exec = File.join util_inst_bindir, 'executable'
     assert_equal true, File.symlink?(installed_exec)
     assert_equal(File.join(@spec.gem_dir, 'bin', 'executable'),
@@ -667,7 +667,7 @@ gem 'other', version
       @installer.generate_bin
     end
 
-    assert_equal true, File.directory?(util_inst_bindir)
+    assert_directory_exists util_inst_bindir
     installed_exec = File.join(util_inst_bindir, 'executable')
     assert_path_exists installed_exec
 
@@ -984,16 +984,16 @@ gem 'other', version
 
   def test_install_missing_dirs
     FileUtils.rm_f File.join(Gem.dir, 'cache')
-    FileUtils.rm_f File.join(Gem.dir, 'docs')
+    FileUtils.rm_f File.join(Gem.dir, 'doc')
     FileUtils.rm_f File.join(Gem.dir, 'specifications')
 
     use_ui @ui do
       @installer.install
     end
 
-    File.directory? File.join(Gem.dir, 'cache')
-    File.directory? File.join(Gem.dir, 'docs')
-    File.directory? File.join(Gem.dir, 'specifications')
+    assert_directory_exists File.join(Gem.dir, 'cache')
+    assert_directory_exists File.join(Gem.dir, 'doc')
+    assert_directory_exists File.join(Gem.dir, 'specifications')
 
     assert_path_exists File.join @gemhome, 'cache', @spec.file_name
     assert_path_exists File.join @gemhome, 'specifications', @spec.spec_name
@@ -1455,6 +1455,112 @@ gem 'other', version
     end
   end
 
+  def test_pre_install_checks_malicious_name_before_eval
+    spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message
+    end
+    refute defined?(::Object::FROM_EVAL)
+  end
+
+  def test_pre_install_checks_malicious_require_paths_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.require_paths = ["malicious\n``"]
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_extensions_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.extensions = ["malicious\n``"]
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_specification_version_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.specification_version = "malicious\n``"
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_dependencies_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.add_dependency "b\nfoo", '> 5'
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      @installer.ignore_dependencies = true
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message
+    end
+  end
+
   def test_shebang
     util_make_exec @spec, "#!/usr/bin/ruby"
 
@@ -1727,24 +1833,55 @@ gem 'other', version
     @installer.wrappers = true
     @installer.options[:install_as_default] = true
     @installer.gem_dir = @spec.gem_dir
-    @installer.generate_bin
 
     use_ui @ui do
       @installer.install
     end
 
-    assert File.directory? util_inst_bindir
-    installed_exec = File.join util_inst_bindir, 'executable'
+    assert_directory_exists File.join(@spec.gem_dir, 'bin')
+    installed_exec = File.join @spec.gem_dir, 'bin', 'executable'
     assert_path_exists installed_exec
 
-    assert File.directory? File.join(Gem.default_dir, 'specifications')
-    assert File.directory? File.join(Gem.default_dir, 'specifications', 'default')
+    assert_directory_exists File.join(Gem.default_dir, 'specifications')
+    assert_directory_exists File.join(Gem.default_dir, 'specifications', 'default')
 
     default_spec = eval File.read File.join(Gem.default_dir, 'specifications', 'default', 'a-2.gemspec')
     assert_equal Gem::Version.new("2"), default_spec.version
     assert_equal ['bin/executable'], default_spec.files
   end
 
+  def test_default_gem_with_exe_as_bindir
+    FileUtils.rm_f File.join(Gem.dir, 'specifications')
+
+    @spec = quick_gem 'c' do |spec|
+      util_make_exec spec, '#!/usr/bin/ruby', 'exe'
+    end
+
+    util_build_gem @spec
+
+    @spec.cache_file
+
+    installer = util_installer @spec, @gemhome
+
+    installer.options[:install_as_default] = true
+    installer.gem_dir = @spec.gem_dir
+
+    use_ui @ui do
+      installer.install
+    end
+
+    assert_directory_exists File.join(@spec.gem_dir, 'exe')
+    installed_exec = File.join @spec.gem_dir, 'exe', 'executable'
+    assert_path_exists installed_exec
+
+    assert_directory_exists File.join(Gem.default_dir, 'specifications')
+    assert_directory_exists File.join(Gem.default_dir, 'specifications', 'default')
+
+    default_spec = eval File.read File.join(Gem.default_dir, 'specifications', 'default', 'c-2.gemspec')
+    assert_equal Gem::Version.new("2"), default_spec.version
+    assert_equal ['exe/executable'], default_spec.files
+  end
+
   def old_ruby_required(requirement)
     spec = util_spec 'old_ruby_required', '1' do |s|
       s.required_ruby_version = requirement
diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb
index 17e288998f..c7a83319a0 100644
--- a/test/rubygems/test_gem_package.rb
+++ b/test/rubygems/test_gem_package.rb
@@ -544,6 +544,40 @@ class TestGemPackage < Gem::Package::TarTestCase
     end
   end
 
+  def test_extract_symlink_parent_doesnt_delete_user_dir
+    package = Gem::Package.new @gem
+
+    # Extract into a subdirectory of @destination; if this test fails it writes
+    # a file outside destination_subdir, but we want the file to remain inside
+    # @destination so it will be cleaned up.
+    destination_subdir = File.join @destination, 'subdir'
+    FileUtils.mkdir_p destination_subdir
+
+    destination_user_dir = File.join @destination, 'user'
+    destination_user_subdir = File.join destination_user_dir, 'dir'
+    FileUtils.mkdir_p destination_user_subdir
+
+    tgz_io = util_tar_gz do |tar|
+      tar.add_symlink 'link', destination_user_dir, 16877
+      tar.add_symlink 'link/dir', '.', 16877
+    end
+
+    e = assert_raises(Gem::Package::PathError, Errno::EACCES) do
+      package.extract_tar_gz tgz_io, destination_subdir
+    end
+
+    assert_path_exists destination_user_subdir
+
+    if Gem::Package::PathError === e
+      assert_equal("installing into parent path #{destination_user_subdir} of " +
+                  "#{destination_subdir} is not allowed", e.message)
+    elsif win_platform?
+      skip "symlink - must be admin with no UAC on Windows"
+    else
+      raise e
+    end
+  end
+
   def test_extract_tar_gz_directory
     package = Gem::Package.new @gem
 
diff --git a/test/rubygems/test_gem_requirement.rb b/test/rubygems/test_gem_requirement.rb
index 96acb24703..a93eea56b7 100644
--- a/test/rubygems/test_gem_requirement.rb
+++ b/test/rubygems/test_gem_requirement.rb
@@ -35,7 +35,6 @@ class TestGemRequirement < Gem::TestCase
     assert_requirement_equal "= 2", ["2"]
     assert_requirement_equal "= 2", v(2)
     assert_requirement_equal "2.0", "2"
-    assert_requirement_equal ["= 2", ">= 2"], [">= 2", "= 2"]
   end
 
   def test_create
diff --git a/test/rubygems/test_gem_specification.rb b/test/rubygems/test_gem_specification.rb
index 75b8b8ed1f..2a84d88346 100644
--- a/test/rubygems/test_gem_specification.rb
+++ b/test/rubygems/test_gem_specification.rb
@@ -2544,6 +2544,14 @@ end
     assert_equal @c1, same_spec
   end
 
+  def test_to_ruby_keeps_requirements_as_originally_specified
+    spec = util_spec 'a', '1' do |s|
+      s.add_dependency 'b', ['~> 1.0', '>= 1.0.0']
+    end
+
+    assert_includes spec.to_ruby, '"~> 1.0", ">= 1.0.0"'
+  end
+
   def test_to_ruby_legacy
     gemspec1 = Gem::Deprecate.skip_during do
       eval LEGACY_RUBY_SPEC
diff --git a/test/rubygems/test_gem_text.rb b/test/rubygems/test_gem_text.rb
index 4315d358b1..ccac812c6d 100644
--- a/test/rubygems/test_gem_text.rb
+++ b/test/rubygems/test_gem_text.rb
@@ -91,4 +91,8 @@ Without the wrapping, the text might not look good in the RSS feed.
     assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)
   end
 
+  def test_clean_text
+    assert_equal ".]2;nyan.", clean_text("\e]2;nyan\a")
+  end
+
 end
-- 
cgit v1.2.3