geminabox 3.0.0 → 3.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4286ff9507b08e7212e2fc72813336bf169e4c86e082802bc600648ecc8a0e99
-  data.tar.gz: ffdd59e137b59252c6a9f526652ee5e99c092cd55e6e13ef191a9e004bbeb47d
+  metadata.gz: 4da5997cf6f07bf5f5c18308b50ddabae4e3acad3c59b5e725555632c94338ec
+  data.tar.gz: 27a3b1392251204e9f210b9efd1b2dbb0e081e851381fce830385f1eb9db4c28
 SHA512:
-  metadata.gz: 215aef46c5ecfe77d391368be8a119230f4b2afe11e65a31b468e67a24c3030aa427801fff384080e75bd8942ac2b9006adf917e8dda5c6857bb9888ad6838ba
-  data.tar.gz: e29de3a2b4eedc3f603c41af8b449bb90a7f6f6ef2a75184d2febe416a86bc1680d0e2d6525591f585571f5749359b2d7c6c130eed940327f6109d9f397f1493
+  metadata.gz: 74b98e66ccc6112d37fb694189c216297cbdfedaeaf1570ce2c0682db24722cb59c1ea5f513f7068743beb7b607969c6eca404f47d72aac822d99a066e9c07be
+  data.tar.gz: 4c818745e2edf7e128e4c6849d07a01f54b29cc851eaa57d5ffb9f101076b28db02f2c45ec49cc8c2bb25500f8e0ad1c67930b54b851122b4041e0f42fac8591

data/README.md

@@ -43,6 +43,12 @@ Start your gem server with 'rackup' to run WEBrick or hook up the config.ru as y
 
 ## RubyGems Proxy
 
+> **Deprecated.** The RubyGems proxy is unmaintained and **will be removed in
+> Geminabox 4.0.** It depends on the RubyGems.org Dependency API
+> (`/api/v1/dependencies`), which was [sunset on 2023-05-24](https://blog.rubygems.org/2023/02/22/dependency-api-deprecation.html)
+> in favour of the Compact Index API, so proxy mode no longer functions.
+> Enabling it now emits a deprecation warning. Do not rely on this feature.
+
 Geminabox can be configured to pull gems, it does not currently have, from rubygems.org. To enable this mode you can either:
 
 Set RUBYGEM_PROXY to true in the environment:
@@ -180,6 +186,8 @@ Your Gemfile only needs:
 source 'https://rubygems.org'
 
 gem 'geminabox'
+gem 'rackup'
+gem 'webrick' # or other server you prefer
 ```
 
 From there

data/lib/geminabox/hostess.rb

@@ -9,7 +9,10 @@ module Geminabox
 
     def serve
       headers["Cache-Control"] = 'no-transform'
-      send_file(File.expand_path(File.join(Geminabox.data, *request.path_info)), :type => response['Content-Type'])
+      path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+      # Rack::Protection normally strips ".." first; this holds without it.
+      halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+      send_file(path, :type => response['Content-Type'])
     end
 
     %w[/specs.4.8.gz

data/lib/geminabox/incoming_gem.rb

@@ -26,8 +26,12 @@ module Geminabox
       File.open(@tempfile.path, "rb")
     end
 
+    # spec comes from the uploaded archive and RubyGems does not validate it on
+    # read, so the name must be checked before it becomes part of a path.
     def valid?
-      spec && spec.name && spec.version
+      spec && spec.name && spec.version &&
+        spec.name.match?(Gem::Specification::VALID_NAME_PATTERN) &&
+        File.basename(name) == name
     rescue Gem::Package::Error
       false
     end

data/lib/geminabox/proxy/file_handler.rb

@@ -8,6 +8,11 @@ module Geminabox
 
       def initialize(file_name)
         @file_name = file_name
+        # file_name comes from the request path; both paths get mkdir_p and writes.
+        root = File.expand_path(root_path) + File::SEPARATOR
+        unless local_path.start_with?(root) && proxy_path.start_with?(root)
+          raise ArgumentError, "#{file_name} resolves outside #{root_path}"
+        end
         ensure_destination_exists
       end
 

data/lib/geminabox/proxy/hostess.rb

@@ -14,7 +14,7 @@ module Geminabox
         if file_handler
           send_file file_handler.proxy_path
         else
-          send_file(File.expand_path(File.join(Geminabox.data, *request.path_info)), :type => response['Content-Type'])
+          send_file(data_path, :type => response['Content-Type'])
         end
       end
 
@@ -53,9 +53,7 @@ module Geminabox
       private
       def get_from_rubygems_if_not_local
 
-        file = File.expand_path(File.join(Geminabox.data, *request.path_info))
-
-        unless File.exist?(file)
+        unless File.exist?(data_path)
           ruby_gems_url = Geminabox.ruby_gems_url
           path = File.join(ruby_gems_url, *request.path_info)
           content = Geminabox.http_adapter.get_content(path)
@@ -70,6 +68,15 @@ module Geminabox
 
       def copy_file(file_name)
         self.file_handler = Copier.copy(file_name)
+      rescue ArgumentError
+        halt 404
+      end
+
+      # Rack::Protection normally strips ".." first; this holds without it.
+      def data_path
+        path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+        halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+        path
       end
 
 

data/lib/geminabox/server.rb

@@ -12,6 +12,7 @@ module Geminabox
     set :host_authorization, { permitted_hosts: [] }
 
     if Geminabox.rubygems_proxy
+      Geminabox.warn_rubygems_proxy_deprecation
       use Proxy::Hostess
     else
       use Hostess
@@ -143,8 +144,9 @@ module Geminabox
         error_response(403, 'Gem deletion is disabled - see https://github.com/geminabox/geminabox/issues/115')
       end
 
+      path = file_path
       serialize_update do
-        File.delete file_path if File.exist? file_path
+        File.delete path if File.exist? path
         self.class.reindex(:force_rebuild)
         redirect url("/")
       end
@@ -254,7 +256,10 @@ HTML
     end
 
     def file_path
-      File.expand_path(File.join(Geminabox.data, *request.path_info))
+      path = File.expand_path(File.join(Geminabox.data, *request.path_info))
+      # Rack::Protection normally strips ".." first; this holds without it.
+      halt 404 unless path.start_with?(File.expand_path(Geminabox.data) + File::SEPARATOR)
+      path
     end
 
     def dependency_cache

data/lib/geminabox/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Geminabox
-  VERSION = '3.0.0' unless defined? VERSION
+  VERSION = '3.1.1' unless defined? VERSION
 end

data/lib/geminabox.rb

@@ -68,6 +68,17 @@ module Geminabox
       Server.settings
     end
 
+    # Deprecated: the RubyGems proxy is unmaintained and will be removed in
+    # Geminabox 4.0. It depends on the RubyGems.org Dependency API
+    # (/api/v1/dependencies), which was sunset on 2023-05-24, so proxy mode no
+    # longer functions.
+    def warn_rubygems_proxy_deprecation
+      warn '[DEPRECATION] Geminabox RubyGems proxy is deprecated and will be ' \
+           'removed in Geminabox 4.0. It depends on the RubyGems.org ' \
+           'Dependency API (/api/v1/dependencies), which was sunset on ' \
+           '2023-05-24, so proxy mode no longer functions.'
+    end
+
     def call(env)
       Server.call env
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: geminabox
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.1.1
 platform: ruby
 authors:
 - Tom Lea