rubygems-update 2.6.0 → 3.4.22

data/lib/rubygems/package/tar_reader/entry.rb

@@ -1,5 +1,5 @@
-# -*- coding: utf-8 -*-
 # frozen_string_literal: true
+
 #++
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.
@@ -9,6 +9,19 @@
 # Class for reading entries out of a tar file
 
 class Gem::Package::TarReader::Entry
+  ##
+  # Creates a new tar entry for +header+ that will be read from +io+
+  # If a block is given, the entry is yielded and then closed.
+
+  def self.open(header, io, &block)
+    entry = new header, io
+    return entry unless block_given?
+    begin
+      yield entry
+    ensure
+      entry.close
+    end
+  end
 
   ##
   # Header for this tar entry
@@ -23,6 +36,7 @@ class Gem::Package::TarReader::Entry
     @header = header
     @io = io
     @orig_pos = @io.pos
+    @end_pos = @orig_pos + @header.size
     @read = 0
   end
 
@@ -41,7 +55,14 @@ class Gem::Package::TarReader::Entry
   # Closes the tar entry
 
   def close
+    return if closed?
+    # Seek to the end of the entry if it wasn't fully read
+    seek(0, IO::SEEK_END)
+    # discard trailing zeros
+    skip = (512 - (@header.size % 512)) % 512
+    @io.read(skip)
     @closed = true
+    nil
   end
 
   ##
@@ -64,24 +85,22 @@ class Gem::Package::TarReader::Entry
   # Full name of the tar entry
 
   def full_name
-    if @header.prefix != "" then
+    if @header.prefix != ""
       File.join @header.prefix, @header.name
     else
       @header.name
     end
   rescue ArgumentError => e
-    raise unless e.message == 'string contains null byte'
+    raise unless e.message == "string contains null byte"
     raise Gem::Package::TarInvalidError,
-          'tar is corrupt, name contains null byte'
+          "tar is corrupt, name contains null byte"
   end
 
   ##
   # Read one byte from the tar entry
 
   def getc
-    check_closed
-
-    return nil if @read >= @header.size
+    return nil if eof?
 
     ret = @io.getc
     @read += 1 if ret
@@ -120,35 +139,109 @@ class Gem::Package::TarReader::Entry
   end
 
   ##
-  # Reads +len+ bytes from the tar file entry, or the rest of the entry if
-  # nil
+  # Seek to the position in the tar entry
 
-  def read(len = nil)
-    check_closed
+  def pos=(new_pos)
+    seek(new_pos, IO::SEEK_SET)
+    new_pos
+  end
+
+  def size
+    @header.size
+  end
+
+  alias length size
 
-    return nil if @read >= @header.size
+  ##
+  # Reads +maxlen+ bytes from the tar file entry, or the rest of the entry if nil
+
+  def read(maxlen = nil)
+    if eof?
+      return maxlen.to_i.zero? ? "" : nil
+    end
 
-    len ||= @header.size - @read
-    max_read = [len, @header.size - @read].min
+    max_read = [maxlen, @header.size - @read].compact.min
 
     ret = @io.read max_read
+    if ret.nil?
+      return maxlen ? nil : "" # IO.read returns nil on EOF with len argument
+    end
     @read += ret.size
 
     ret
   end
 
-  alias readpartial read # :nodoc:
+  def readpartial(maxlen, outbuf = "".b)
+    if eof? && maxlen > 0
+      raise EOFError, "end of file reached"
+    end
+
+    max_read = [maxlen, @header.size - @read].min
+
+    @io.readpartial(max_read, outbuf)
+    @read += outbuf.size
+
+    outbuf
+  end
 
   ##
-  # Rewinds to the beginning of the tar file entry
+  # Seeks to +offset+ bytes into the tar file entry
+  # +whence+ can be IO::SEEK_SET, IO::SEEK_CUR, or IO::SEEK_END
 
-  def rewind
+  def seek(offset, whence = IO::SEEK_SET)
     check_closed
 
-    raise Gem::Package::NonSeekableIO unless @io.respond_to? :pos=
+    new_pos =
+      case whence
+      when IO::SEEK_SET then @orig_pos + offset
+      when IO::SEEK_CUR then @io.pos + offset
+      when IO::SEEK_END then @end_pos + offset
+      else
+        raise ArgumentError, "invalid whence"
+      end
+
+    if new_pos < @orig_pos
+      new_pos = @orig_pos
+    elsif new_pos > @end_pos
+      new_pos = @end_pos
+    end
 
-    @io.pos = @orig_pos
-    @read = 0
+    pending = new_pos - @io.pos
+
+    return 0 if pending == 0
+
+    if @io.respond_to?(:seek)
+      begin
+        # avoid reading if the @io supports seeking
+        @io.seek new_pos, IO::SEEK_SET
+        pending = 0
+      rescue Errno::EINVAL
+      end
+    end
+
+    # if seeking isn't supported or failed
+    # negative seek requires that we rewind and read
+    if pending < 0
+      @io.rewind
+      pending = new_pos
+    end
+
+    while pending > 0 do
+      size_read = @io.read([pending, 4096].min)&.size
+      raise(EOFError, "end of file reached") if size_read.nil?
+      pending -= size_read
+    end
+
+    @read = @io.pos - @orig_pos
+
+    0
   end
 
+  ##
+  # Rewinds to the beginning of the tar file entry
+
+  def rewind
+    check_closed
+    seek(0, IO::SEEK_SET)
+  end
 end

data/lib/rubygems/package/tar_reader.rb

@@ -1,5 +1,5 @@
-# -*- coding: utf-8 -*-
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.
@@ -9,14 +9,8 @@
 # TarReader reads tar files and allows iteration over their items
 
 class Gem::Package::TarReader
-
   include Enumerable
 
-  ##
-  # Raised if the tar IO is not seekable
-
-  class UnexpectedEOF < StandardError; end
-
   ##
   # Creates a new TarReader on +io+ and yields it to the block, if given.
 
@@ -56,32 +50,17 @@ class Gem::Package::TarReader
     return enum_for __method__ unless block_given?
 
     until @io.eof? do
-      header = Gem::Package::TarHeader.from @io
-      return if header.empty?
-
-      entry = Gem::Package::TarReader::Entry.new header, @io
-      size = entry.header.size
-
-      yield entry
-
-      skip = (512 - (size % 512)) % 512
-      pending = size - entry.bytes_read
-
       begin
-        # avoid reading...
-        @io.seek pending, IO::SEEK_CUR
-        pending = 0
-      rescue Errno::EINVAL, NameError
-        while pending > 0 do
-          bytes_read = @io.read([pending, 4096].min).size
-          raise UnexpectedEOF if @io.eof?
-          pending -= bytes_read
-        end
+        header = Gem::Package::TarHeader.from @io
+      rescue ArgumentError => e
+        # Specialize only exceptions from Gem::Package::TarHeader.strict_oct
+        raise e unless e.message.match?(/ is not an octal string$/)
+        raise Gem::Package::TarInvalidError, e.message
       end
 
-      @io.read skip # discard trailing zeros
-
-      # make sure nobody can use #read, #getc or #rewind anymore
+      return if header.empty?
+      entry = Gem::Package::TarReader::Entry.new header, @io
+      yield entry
       entry.close
     end
   end
@@ -92,11 +71,9 @@ class Gem::Package::TarReader
   # NOTE: Do not call #rewind during #each
 
   def rewind
-    if @init_pos == 0 then
-      raise Gem::Package::NonSeekableIO unless @io.respond_to? :rewind
+    if @init_pos == 0
       @io.rewind
     else
-      raise Gem::Package::NonSeekableIO unless @io.respond_to? :pos=
       @io.pos = @init_pos
     end
   end
@@ -106,18 +83,17 @@ class Gem::Package::TarReader
   # yields it.  Rewinds the tar file to the beginning when the block
   # terminates.
 
-  def seek name # :yields: entry
+  def seek(name) # :yields: entry
     found = find do |entry|
       entry.full_name == name
     end
 
     return unless found
 
-    return yield found
+    yield found
   ensure
     rewind
   end
-
 end
 
-require 'rubygems/package/tar_reader/entry'
+require_relative "tar_reader/entry"

data/lib/rubygems/package/tar_writer.rb

@@ -1,24 +1,20 @@
-# -*- coding: utf-8 -*-
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.
 #++
 
-require 'digest'
-
 ##
 # Allows writing of tar files
 
 class Gem::Package::TarWriter
-
   class FileOverflow < StandardError; end
 
   ##
   # IO wrapper that allows writing a limited amount of data
 
   class BoundedStream
-
     ##
     # Maximum number of bytes that can be written
 
@@ -50,14 +46,12 @@ class Gem::Package::TarWriter
       @written += data.bytesize
       data.bytesize
     end
-
   end
 
   ##
   # IO wrapper that provides only #write
 
   class RestrictedStream
-
     ##
     # Creates a new RestrictedStream wrapping +io+
 
@@ -71,7 +65,6 @@ class Gem::Package::TarWriter
     def write(data)
       @io.write data
     end
-
   end
 
   ##
@@ -106,12 +99,10 @@ class Gem::Package::TarWriter
   def add_file(name, mode) # :yields: io
     check_closed
 
-    raise Gem::Package::NonSeekableIO unless @io.respond_to? :pos=
-
     name, prefix = split_name name
 
     init_pos = @io.pos
-    @io.write "\0" * 512 # placeholder for the header
+    @io.write Gem::Package::TarHeader::EMPTY_HEADER # placeholder for the header
 
     yield RestrictedStream.new(@io) if block_given?
 
@@ -125,7 +116,7 @@ class Gem::Package::TarWriter
 
     header = Gem::Package::TarHeader.new :name => name, :mode => mode,
                                          :size => size, :prefix => prefix,
-                                         :mtime => Time.now
+                                         :mtime => Gem.source_date_epoch
 
     @io.write header
     @io.pos = final_pos
@@ -141,15 +132,14 @@ class Gem::Package::TarWriter
   #
   # The created digest object is returned.
 
-  def add_file_digest name, mode, digest_algorithms # :yields: io
+  def add_file_digest(name, mode, digest_algorithms) # :yields: io
     digests = digest_algorithms.map do |digest_algorithm|
       digest = digest_algorithm.new
       digest_name =
-        if digest.respond_to? :name then
+        if digest.respond_to? :name
           digest.name
         else
-          /::([^:]+)$/ =~ digest_algorithm.name
-          $1
+          digest_algorithm.class.name[/::([^:]+)\z/, 1]
         end
 
       [digest_name, digest]
@@ -174,10 +164,10 @@ class Gem::Package::TarWriter
   #
   # Returns the digest.
 
-  def add_file_signed name, mode, signer
+  def add_file_signed(name, mode, signer)
     digest_algorithms = [
       signer.digest_algorithm,
-      Digest::SHA512,
+      Gem::Security.create_digest("SHA512"),
     ].compact.uniq
 
     digests = add_file_digest name, mode, digest_algorithms do |io|
@@ -186,20 +176,21 @@ class Gem::Package::TarWriter
 
     signature_digest = digests.values.compact.find do |digest|
       digest_name =
-        if digest.respond_to? :name then
+        if digest.respond_to? :name
           digest.name
         else
-          /::([^:]+)$/ =~ digest.class.name
-          $1
+          digest.class.name[/::([^:]+)\z/, 1]
         end
 
       digest_name == signer.digest_name
     end
 
-    if signer.key then
+    raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest
+
+    if signer.key
       signature = signer.sign signature_digest.digest
 
-      add_file_simple "#{name}.sig", 0444, signature.length do |io|
+      add_file_simple "#{name}.sig", 0o444, signature.length do |io|
         io.write signature
       end
     end
@@ -218,7 +209,7 @@ class Gem::Package::TarWriter
 
     header = Gem::Package::TarHeader.new(:name => name, :mode => mode,
                                          :size => size, :prefix => prefix,
-                                         :mtime => Time.now).to_s
+                                         :mtime => Gem.source_date_epoch).to_s
 
     @io.write header
     os = BoundedStream.new @io, size
@@ -246,7 +237,7 @@ class Gem::Package::TarWriter
                                          :size => 0, :typeflag => "2",
                                          :linkname => target,
                                          :prefix => prefix,
-                                         :mtime => Time.now).to_s
+                                         :mtime => Gem.source_date_epoch).to_s
 
     @io.write header
 
@@ -299,7 +290,7 @@ class Gem::Package::TarWriter
     header = Gem::Package::TarHeader.new :name => name, :mode => mode,
                                          :typeflag => "5", :size => 0,
                                          :prefix => prefix,
-                                         :mtime => Time.now
+                                         :mtime => Gem.source_date_epoch
 
     @io.write header
 
@@ -314,32 +305,25 @@ class Gem::Package::TarWriter
       raise Gem::Package::TooLongFileName.new("File \"#{name}\" has a too long path (should be 256 or less)")
     end
 
-    if name.bytesize <= 100 then
-      prefix = ""
-    else
-      parts = name.split(/\//)
-      newname = parts.pop
-      nxt = ""
-
-      loop do
-        nxt = parts.pop
-        break if newname.bytesize + 1 + nxt.bytesize > 100
-        newname = nxt + "/" + newname
+    prefix = ""
+    if name.bytesize > 100
+      parts = name.split("/", -1) # parts are never empty here
+      name = parts.pop            # initially empty for names with a trailing slash ("foo/.../bar/")
+      prefix = parts.join("/")    # if empty, then it's impossible to split (parts is empty too)
+      while !parts.empty? && (prefix.bytesize > 155 || name.empty?)
+        name = parts.pop + "/" + name
+        prefix = parts.join("/")
       end
 
-      prefix = (parts + [nxt]).join "/"
-      name = newname
-
-      if name.bytesize > 100
+      if name.bytesize > 100 || prefix.empty?
         raise Gem::Package::TooLongFileName.new("File \"#{prefix}/#{name}\" has a too long name (should be 100 or less)")
       end
 
-      if prefix.bytesize > 155 then
+      if prefix.bytesize > 155
         raise Gem::Package::TooLongFileName.new("File \"#{prefix}/#{name}\" has a too long base path (should be 155 or less)")
       end
     end
 
-    return name, prefix
+    [name, prefix]
   end
-
 end