gemirro 3.0.0 → 3.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4433d72ad5aef6af085761295239943b68ca7afbf8decf4a6e4fd1724eae1d3
-  data.tar.gz: 73492105d34fa6b3dbd0da1f0158e9a9c6ac95915e2b714be1c107f375473264
+  metadata.gz: bb35f2d2c69224e8bebd764161f0c855af924b03ab98eb0089473d11489a6ec9
+  data.tar.gz: 4fb54e6dcce8923151dd273f4e5b45f8f64e90a6ad28cc8c06d8ed3c10085893
 SHA512:
-  metadata.gz: 1c5ab9469369f159fe071f0f9eb8215971018f5880cbbf4236333c30675a460f8b5936f136d2becc15203b07f8065d9f2c6309d3c58f5807e7be7555e7804314
-  data.tar.gz: bff9e9a7c93475fcfa4a8a341bc57823e3267b759c3602905449af813a4d239fc29f9bec3d12976b2e08e1bfb79daa27f5d2fe442c08e09c41547e2ba81d1415
+  metadata.gz: e5bb871e3788098502d5f76a6b6b568910c511392d21c53b13b6e069e2c1fc85329bea413d6ae6c02efd55a0a0d3a6c5d432d4dccfb2487c1b607136188286f2
+  data.tar.gz: bc363cf380cb471dddac0c68717112d3c15169175c2aba17503e46e566bc9a170e49ebf810a3c3e9c761acee1e65dcd4c9379fb833aeabc0b4ade2a3bb7749b1

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gemirro (3.0.0)
+    gemirro (3.0.1)
       addressable (~> 2.8)
       builder (~> 3.2)
       compact_index (~> 0.15)

data/MANIFEST

@@ -45,6 +45,7 @@ spec/gemirro/mirror_directory_spec.rb
 spec/gemirro/mirror_file_spec.rb
 spec/gemirro/server_spec.rb
 spec/gemirro/source_spec.rb
+spec/gemirro/utils_spec.rb
 spec/gemirro/versions_fetcher_spec.rb
 spec/gemirro/versions_file_spec.rb
 spec/spec_helper.rb

data/lib/gemirro/utils.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'addressable/uri'
 require 'gemirro/gem_version'
 
 module Gemirro
@@ -25,6 +26,7 @@ module Gemirro
     URI_REGEXP = /^(.*)-(\d+(?:\.\d+){1,4}.*?)(?:-(x86-(?:(?:mswin|mingw)(?:32|64)).*?|java))?\.(gem(?:spec\.rz)?)$/
     GEMSPEC_TYPE = 'gemspec.rz'
     GEM_TYPE = 'gem'
+    SAFE_HOMEPAGE_SCHEMES = %w[http https].freeze
 
     ##
     # Generate Gems collection from Marshal dump - always the .local file
@@ -156,6 +158,31 @@ module Gemirro
       end
     end
 
+    ##
+    # Return a normalized homepage URL that is safe to use as a link target,
+    # or nil when it is missing, unparsable or not an http(s) URL with a host.
+    # Gem metadata comes from upstream sources and must not be trusted.
+    #
+    # @param [String] homepage
+    # @return [String, nil]
+    #
+    def self.safe_homepage(homepage)
+      return if homepage.nil?
+
+      # Browsers ignore control characters and whitespace inside a scheme
+      # (e.g. "java\tscript:"), so drop them before validating.
+      value = homepage.to_s.gsub(/[[:cntrl:][:space:]]/, '')
+      return if value.empty?
+
+      uri = Addressable::URI.parse(value).normalize
+      return unless SAFE_HOMEPAGE_SCHEMES.include?(uri.scheme&.downcase)
+      return if uri.host.nil? || uri.host.empty?
+
+      uri.to_s
+    rescue Addressable::URI::InvalidURIError, ArgumentError, TypeError
+      nil
+    end
+
     ##
     # Try to fetch gem and download its if it's possible, and
     # build and install indicies.

data/lib/gemirro/version.rb

@@ -2,5 +2,5 @@
 
 # Gemirro Version
 module Gemirro
-  VERSION = '3.0.0'
+  VERSION = '3.0.1'
 end

data/spec/gemirro/server_spec.rb

@@ -81,6 +81,39 @@ module Gemirro
         expect(last_response.status).to eq(200)
         expect(last_response).to be_ok
       end
+
+      it 'should not link a javascript: homepage from gem metadata' do
+        MirrorFile.new('/var/www/gemirro/versions.md5.aaa256.list').write(%(created_at: 2025-01-01T00:00:00Z\n---\nvolay 0.1.0 checksum))
+        spec = ::Gem::Specification.new do |s|
+          s.name = 'volay'
+          s.version = '0.1.0'
+          s.authors = ['Mallory']
+          s.homepage = 'javascript:alert(1)'
+        end
+        allow(Utils).to receive(:spec_for).and_return(spec)
+
+        get '/gem/volay'
+
+        expect(last_response).to be_ok
+        expect(last_response.body).to include('Mallory')
+        expect(last_response.body).not_to include('javascript:')
+      end
+
+      it 'should link an https homepage from gem metadata' do
+        MirrorFile.new('/var/www/gemirro/versions.md5.aaa256.list').write(%(created_at: 2025-01-01T00:00:00Z\n---\nvolay 0.1.0 checksum))
+        spec = ::Gem::Specification.new do |s|
+          s.name = 'volay'
+          s.version = '0.1.0'
+          s.authors = ['Alice']
+          s.homepage = 'https://example.com/volay'
+        end
+        allow(Utils).to receive(:spec_for).and_return(spec)
+
+        get '/gem/volay'
+
+        expect(last_response).to be_ok
+        expect(last_response.body).to include('href="https://example.com/volay"')
+      end
       
       it 'responds to compact_index /names' do
         MirrorFile.new('/var/www/gemirro/names.md5.aaa256.list').write(%(---\nvolay))

data/spec/gemirro/utils_spec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'gemirro/utils'
+
+# Utils tests
+module Gemirro
+  describe Utils do
+    describe '.safe_homepage' do
+      it 'keeps http and https URLs' do
+        expect(Utils.safe_homepage('http://example.com')).to eq('http://example.com/')
+        expect(Utils.safe_homepage('https://example.com/foo?a=1')).to eq('https://example.com/foo?a=1')
+        expect(Utils.safe_homepage('HTTPS://Example.com/x')).to eq('https://example.com/x')
+      end
+
+      it 'rejects missing or empty values' do
+        expect(Utils.safe_homepage(nil)).to be_nil
+        expect(Utils.safe_homepage('')).to be_nil
+        expect(Utils.safe_homepage("  \n")).to be_nil
+      end
+
+      [
+        'javascript:alert(1)',
+        'JavaScript:alert(1)',
+        ' javascript:alert(1)',
+        "java\tscript:alert(1)",
+        "java\nscript:alert(1)",
+        "\u0000javascript:alert(1)",
+        'data:text/html,<script>alert(1)</script>',
+        'vbscript:msgbox(1)',
+        'file:///etc/passwd',
+        'javascript%3Aalert(1)',
+        '//evil.example.com',
+        '/relative/path',
+        'https://'
+      ].each do |value|
+        it "rejects #{value.inspect}" do
+          expect(Utils.safe_homepage(value)).to be_nil
+        end
+      end
+    end
+  end
+end

data/views/gem.erb

@@ -34,12 +34,17 @@
         <% end %>
 
         <% if spec.authors.size > 0 %>
+          <% homepage = Gemirro::Utils.safe_homepage(spec.homepage) %>
           <dd class="authors">
             <h3>Authors</h3>
             <ul>
               <% spec.authors.each do |author| %>
                 <li class="list-group-item">
-                  <a href="<%= URI.parse(Addressable::URI.escape(spec.homepage)) %>"><%= Rack::Utils.escape_html(author) %></a>
+                  <% if homepage %>
+                    <a href="<%= Rack::Utils.escape_html(homepage) %>" rel="noopener noreferrer nofollow"><%= Rack::Utils.escape_html(author) %></a>
+                  <% else %>
+                    <%= Rack::Utils.escape_html(author) %>
+                  <% end %>
                 </li>
               <% end %>
             </ul>

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gemirro
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.0.1
 platform: ruby
 authors:
 - Pierre Rambaud
@@ -245,6 +245,7 @@ files:
 - spec/gemirro/mirror_file_spec.rb
 - spec/gemirro/server_spec.rb
 - spec/gemirro/source_spec.rb
+- spec/gemirro/utils_spec.rb
 - spec/gemirro/versions_fetcher_spec.rb
 - spec/gemirro/versions_file_spec.rb
 - spec/spec_helper.rb