rubygems-update 2.6.0 → 3.5.4

data/lib/rubygems/source.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
-require 'uri'
-require 'fileutils'
 
+require_relative "text"
 ##
 # A Source knows how to list and fetch gems from a RubyGems marshal index.
 #
@@ -9,14 +8,14 @@ require 'fileutils'
 # bundler dependency API and so-forth.
 
 class Gem::Source
-
   include Comparable
+  include Gem::Text
 
   FILES = { # :nodoc:
-    :released   => 'specs',
-    :latest     => 'latest_specs',
-    :prerelease => 'prerelease_specs',
-  }
+    released: "specs",
+    latest: "latest_specs",
+    prerelease: "prerelease_specs",
+  }.freeze
 
   ##
   # The URI this source will fetch gems from.
@@ -27,24 +26,9 @@ class Gem::Source
   # Creates a new Source which will use the index located at +uri+.
 
   def initialize(uri)
-    begin
-      unless uri.kind_of? URI
-        uri = URI.parse(uri.to_s)
-      end
-    rescue URI::InvalidURIError
-      raise if Gem::Source == self.class
-    end
-
-    @uri = uri
-    @api_uri = nil
-  end
-
-  ##
-  # Use an SRV record on the host to look up the true endpoint for the index.
-
-  def api_uri # :nodoc:
-    require 'rubygems/remote_fetcher'
-    @api_uri ||= Gem::RemoteFetcher.fetcher.api_endpoint uri
+    require_relative "uri"
+    @uri = Gem::Uri.parse!(uri)
+    @update_cache = nil
   end
 
   ##
@@ -60,21 +44,23 @@ class Gem::Source
          Gem::Source::Vendor then
       -1
     when Gem::Source then
-      if !@uri
+      unless @uri
         return 0 unless other.uri
         return 1
       end
 
-      return -1 if !other.uri
+      return -1 unless other.uri
 
-      @uri.to_s <=> other.uri.to_s
-    else
-      nil
+      # Returning 1 here ensures that when sorting a list of sources, the
+      # original ordering of sources supplied by the user is preserved.
+      return 1 unless @uri.to_s == other.uri.to_s
+
+      0
     end
   end
 
-  def == other # :nodoc:
-    self.class === other and @uri == other.uri
+  def ==(other) # :nodoc:
+    self.class === other && @uri == other.uri
   end
 
   alias_method :eql?, :== # :nodoc:
@@ -83,9 +69,17 @@ class Gem::Source
   # Returns a Set that can fetch specifications from this source.
 
   def dependency_resolver_set # :nodoc:
-    return Gem::Resolver::IndexSet.new self if 'file' == api_uri.scheme
+    return Gem::Resolver::IndexSet.new self if uri.scheme == "file"
 
-    bundler_api_uri = api_uri + './api/v1/dependencies'
+    fetch_uri = if uri.host == "rubygems.org"
+      index_uri = uri.dup
+      index_uri.host = "index.rubygems.org"
+      index_uri
+    else
+      uri
+    end
+
+    bundler_api_uri = enforce_trailing_slash(fetch_uri)
 
     begin
       fetcher = Gem::RemoteFetcher.fetcher
@@ -93,11 +87,7 @@ class Gem::Source
     rescue Gem::RemoteFetcher::FetchError
       Gem::Resolver::IndexSet.new self
     else
-      if response.respond_to? :uri then
-        Gem::Resolver::APISet.new response.uri
-      else
-        Gem::Resolver::APISet.new bundler_api_uri
-      end
+      Gem::Resolver::APISet.new response.uri + "./info/"
     end
   end
 
@@ -110,8 +100,7 @@ class Gem::Source
 
   def cache_dir(uri)
     # Correct for windows paths
-    escaped_path = uri.path.sub(/^\/([a-z]):\//i, '/\\1-/')
-    escaped_path.untaint
+    escaped_path = uri.path.sub(%r{^/([a-z]):/}i, '/\\1-/')
 
     File.join Gem.spec_cache_dir, "#{uri.host}%#{uri.port}", File.dirname(escaped_path)
   end
@@ -120,7 +109,8 @@ class Gem::Source
   # Returns true when it is possible and safe to update the cache directory.
 
   def update_cache?
-    @update_cache ||=
+    return @update_cache unless @update_cache.nil?
+    @update_cache =
       begin
         File.stat(Gem.user_home).uid == Process.uid
       rescue Errno::ENOENT
@@ -131,38 +121,45 @@ class Gem::Source
   ##
   # Fetches a specification for the given +name_tuple+.
 
-  def fetch_spec name_tuple
+  def fetch_spec(name_tuple)
     fetcher = Gem::RemoteFetcher.fetcher
 
     spec_file_name = name_tuple.spec_name
 
-    uri = api_uri + "#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}"
+    source_uri = enforce_trailing_slash(uri) + "#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}"
 
-    cache_dir = cache_dir uri
+    cache_dir = cache_dir source_uri
 
     local_spec = File.join cache_dir, spec_file_name
 
-    if File.exist? local_spec then
+    if File.exist? local_spec
       spec = Gem.read_binary local_spec
-      spec = Marshal.load(spec) rescue nil
+      Gem.load_safe_marshal
+      spec = begin
+               Gem::SafeMarshal.safe_load(spec)
+             rescue StandardError
+               nil
+             end
       return spec if spec
     end
 
-    uri.path << '.rz'
+    source_uri.path << ".rz"
 
-    spec = fetcher.fetch_path uri
-    spec = Gem.inflate spec
+    spec = fetcher.fetch_path source_uri
+    spec = Gem::Util.inflate spec
 
-    if update_cache? then
+    if update_cache?
+      require "fileutils"
       FileUtils.mkdir_p cache_dir
 
-      open local_spec, 'wb' do |io|
+      File.open local_spec, "wb" do |io|
         io.write spec
       end
     end
 
+    Gem.load_safe_marshal
     # TODO: Investigate setting Gem::Specification#loaded_from to a URI
-    Marshal.load spec
+    Gem::SafeMarshal.safe_load spec
   end
 
   ##
@@ -180,17 +177,21 @@ class Gem::Source
     file       = FILES[type]
     fetcher    = Gem::RemoteFetcher.fetcher
     file_name  = "#{file}.#{Gem.marshal_version}"
-    spec_path  = api_uri + "#{file_name}.gz"
+    spec_path  = enforce_trailing_slash(uri) + "#{file_name}.gz"
     cache_dir  = cache_dir spec_path
     local_file = File.join(cache_dir, file_name)
     retried    = false
 
-    FileUtils.mkdir_p cache_dir if update_cache?
+    if update_cache?
+      require "fileutils"
+      FileUtils.mkdir_p cache_dir
+    end
 
     spec_dump = fetcher.cache_update_path spec_path, local_file, update_cache?
 
+    Gem.load_safe_marshal
     begin
-      Gem::NameTuple.from_list Marshal.load(spec_dump)
+      Gem::NameTuple.from_list Gem::SafeMarshal.safe_load(spec_dump)
     rescue ArgumentError
       if update_cache? && !retried
         FileUtils.rm local_file
@@ -208,28 +209,37 @@ class Gem::Source
 
   def download(spec, dir=Dir.pwd)
     fetcher = Gem::RemoteFetcher.fetcher
-    fetcher.download spec, api_uri.to_s, dir
+    fetcher.download spec, uri.to_s, dir
   end
 
-  def pretty_print q # :nodoc:
-    q.group 2, '[Remote:', ']' do
+  def pretty_print(q) # :nodoc:
+    q.group 2, "[Remote:", "]" do
       q.breakable
       q.text @uri.to_s
 
-      if api = api_uri
+      if api = uri
         q.breakable
-        q.text 'API URI: '
+        q.text "API URI: "
         q.text api.to_s
       end
     end
   end
 
-end
+  def typo_squatting?(host, distance_threshold=4)
+    return if @uri.host.nil?
+    levenshtein_distance(@uri.host, host).between? 1, distance_threshold
+  end
+
+  private
 
-require 'rubygems/source/git'
-require 'rubygems/source/installed'
-require 'rubygems/source/specific_file'
-require 'rubygems/source/local'
-require 'rubygems/source/lock'
-require 'rubygems/source/vendor'
+  def enforce_trailing_slash(uri)
+    uri.merge(uri.path.gsub(%r{/+$}, "") + "/")
+  end
+end
 
+require_relative "source/git"
+require_relative "source/installed"
+require_relative "source/specific_file"
+require_relative "source/local"
+require_relative "source/lock"
+require_relative "source/vendor"

data/lib/rubygems/source_list.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'rubygems/source'
 
 ##
 # The SourceList represents the sources rubygems has been configured to use.
@@ -15,7 +14,6 @@ require 'rubygems/source'
 # The most common way to get a SourceList is Gem.sources.
 
 class Gem::SourceList
-
   include Enumerable
 
   ##
@@ -38,7 +36,7 @@ class Gem::SourceList
 
     list.replace ary
 
-    return list
+    list
   end
 
   def initialize_copy(other) # :nodoc:
@@ -51,13 +49,11 @@ class Gem::SourceList
 
   def <<(obj)
     src = case obj
-          when URI
-            Gem::Source.new(obj)
           when Gem::Source
             obj
           else
-            Gem::Source.new(URI.parse(obj))
-          end
+            Gem::Source.new(obj)
+    end
 
     @sources << src unless @sources.include?(src)
     src
@@ -88,7 +84,7 @@ class Gem::SourceList
   # Yields each source URI in the list.
 
   def each
-    @sources.each { |s| yield s.uri.to_s }
+    @sources.each {|s| yield s.uri.to_s }
   end
 
   ##
@@ -105,7 +101,7 @@ class Gem::SourceList
     @sources.empty?
   end
 
-  def == other # :nodoc:
+  def ==(other) # :nodoc:
     to_a == other
   end
 
@@ -113,7 +109,7 @@ class Gem::SourceList
   # Returns an Array of source URI Strings.
 
   def to_a
-    @sources.map { |x| x.uri.to_s }
+    @sources.map {|x| x.uri.to_s }
   end
 
   alias_method :to_ary, :to_a
@@ -130,21 +126,21 @@ class Gem::SourceList
   # Gem::Source or a source URI.
 
   def include?(other)
-    if other.kind_of? Gem::Source
+    if other.is_a? Gem::Source
       @sources.include? other
     else
-      @sources.find { |x| x.uri.to_s == other.to_s }
+      @sources.find {|x| x.uri.to_s == other.to_s }
     end
   end
 
   ##
   # Deletes +source+ from the source list which may be a Gem::Source or a URI.
 
-  def delete source
-    if source.kind_of? Gem::Source
+  def delete(source)
+    if source.is_a? Gem::Source
       @sources.delete source
     else
-      @sources.delete_if { |x| x.uri.to_s == source.to_s }
+      @sources.delete_if {|x| x.uri.to_s == source.to_s }
     end
   end
 end

data/lib/rubygems/spec_fetcher.rb

@@ -1,15 +1,15 @@
 # frozen_string_literal: true
-require 'rubygems/remote_fetcher'
-require 'rubygems/user_interaction'
-require 'rubygems/errors'
-require 'rubygems/text'
-require 'rubygems/name_tuple'
+
+require_relative "remote_fetcher"
+require_relative "user_interaction"
+require_relative "errors"
+require_relative "text"
+require_relative "name_tuple"
 
 ##
 # SpecFetcher handles metadata updates from remote gem repositories.
 
 class Gem::SpecFetcher
-
   include Gem::UserInteraction
   include Gem::Text
 
@@ -54,7 +54,7 @@ class Gem::SpecFetcher
   # If you need to retrieve specifications from a different +source+, you can
   # send it as an argument.
 
-  def initialize sources = nil
+  def initialize(sources = nil)
     @sources = sources || Gem.sources
 
     @update_cache =
@@ -69,9 +69,9 @@ class Gem::SpecFetcher
     @prerelease_specs = {}
 
     @caches = {
-      :latest => @latest_specs,
-      :prerelease => @prerelease_specs,
-      :released => @specs,
+      latest: @latest_specs,
+      prerelease: @prerelease_specs,
+      released: @specs,
     }
 
     @fetcher = Gem::RemoteFetcher.fetcher
@@ -88,29 +88,18 @@ class Gem::SpecFetcher
 
     rejected_specs = {}
 
-    if dependency.prerelease?
-      if dependency.specific?
-        type = :complete
-      else
-        type = :abs_latest
-      end
-    elsif dependency.latest_version?
-      type = :latest
-    else
-      type = :released
-    end
+    list, errors = available_specs(dependency.identity)
 
-    list, errors = available_specs(type)
     list.each do |source, specs|
       if dependency.name.is_a?(String) && specs.respond_to?(:bsearch)
-        start_index = (0 ... specs.length).bsearch{ |i| specs[i].name >= dependency.name }
-        end_index   = (0 ... specs.length).bsearch{ |i| specs[i].name > dependency.name }
-        specs = specs[start_index ... end_index] if start_index && end_index
+        start_index = (0...specs.length).bsearch {|i| specs[i].name >= dependency.name }
+        end_index   = (0...specs.length).bsearch {|i| specs[i].name > dependency.name }
+        specs = specs[start_index...end_index] if start_index && end_index
       end
 
       found[source] = specs.select do |tup|
         if dependency.match?(tup)
-          if matching_platform and !Gem::Platform.match(tup.platform)
+          if matching_platform && !Gem::Platform.match_gem?(tup.platform, tup.name)
             pm = (
               rejected_specs[dependency] ||= \
                 Gem::PlatformMismatch.new(tup.name, tup.version))
@@ -133,12 +122,11 @@ class Gem::SpecFetcher
       end
     end
 
-    tuples = tuples.sort_by { |x| x[0] }
+    tuples = tuples.sort_by {|x| x[0].version }
 
-    return [tuples, errors]
+    [tuples, errors]
   end
 
-
   ##
   # Return all gem name tuples who's names match +obj+
 
@@ -157,7 +145,6 @@ class Gem::SpecFetcher
     tuples
   end
 
-
   ##
   # Find and fetch specs that match +dependency+.
   #
@@ -168,42 +155,47 @@ class Gem::SpecFetcher
 
     specs = []
     tuples.each do |tup, source|
-      begin
-        spec = source.fetch_spec(tup)
-      rescue Gem::RemoteFetcher::FetchError => e
-        errors << Gem::SourceFetchProblem.new(source, e)
-      else
-        specs << [spec, source]
-      end
+      spec = source.fetch_spec(tup)
+    rescue Gem::RemoteFetcher::FetchError => e
+      errors << Gem::SourceFetchProblem.new(source, e)
+    else
+      specs << [spec, source]
     end
 
-    return [specs, errors]
+    [specs, errors]
   end
 
   ##
   # Suggests gems based on the supplied +gem_name+. Returns an array of
   # alternative gem names.
 
-  def suggest_gems_from_name gem_name
-    gem_name        = gem_name.downcase.tr('_-', '')
+  def suggest_gems_from_name(gem_name, type = :latest, num_results = 5)
+    gem_name        = gem_name.downcase.tr("_-", "")
     max             = gem_name.size / 2
-    names           = available_specs(:latest).first.values.flatten(1)
+    names           = available_specs(type).first.values.flatten(1)
 
-    matches = names.map { |n|
+    matches = names.map do |n|
       next unless n.match_platform?
+      [n.name, 0] if n.name.downcase.tr("_-", "").include?(gem_name)
+    end.compact
+
+    if matches.length < num_results
+      matches += names.map do |n|
+        next unless n.match_platform?
+        distance = levenshtein_distance gem_name, n.name.downcase.tr("_-", "")
+        next if distance >= max
+        return [n.name] if distance == 0
+        [n.name, distance]
+      end.compact
+    end
 
-      distance = levenshtein_distance gem_name, n.name.downcase.tr('_-', '')
-
-      next if distance >= max
-
-      return [n.name] if distance == 0
-
-      [n.name, distance]
-    }.compact
-
-    matches = matches.uniq.sort_by { |name, dist| dist }
+    matches = if matches.empty? && type != :prerelease
+      suggest_gems_from_name gem_name, :prerelease
+    else
+      matches.uniq.sort_by {|_name, dist| dist }
+    end
 
-    matches.first(5).map { |name, dist| name }
+    matches.map {|name, _dist| name }.uniq.first(num_results)
   end
 
   ##
@@ -221,34 +213,32 @@ class Gem::SpecFetcher
     list = {}
 
     @sources.each_source do |source|
-      begin
-        names = case type
-                when :latest
-                  tuples_for source, :latest
-                when :released
-                  tuples_for source, :released
-                when :complete
-                  names =
-                    tuples_for(source, :prerelease, true) +
-                    tuples_for(source, :released)
-
-                  names.sort
-                when :abs_latest
-                  names =
-                    tuples_for(source, :prerelease, true) +
-                    tuples_for(source, :latest)
-
-                  names.sort
-                when :prerelease
-                  tuples_for(source, :prerelease)
-                else
-                  raise Gem::Exception, "Unknown type - :#{type}"
-                end
-      rescue Gem::RemoteFetcher::FetchError => e
-        errors << Gem::SourceFetchProblem.new(source, e)
-      else
-        list[source] = names
+      names = case type
+              when :latest
+                tuples_for source, :latest
+              when :released
+                tuples_for source, :released
+              when :complete
+                names =
+                  tuples_for(source, :prerelease, true) +
+                  tuples_for(source, :released)
+
+                names.sort
+              when :abs_latest
+                names =
+                  tuples_for(source, :prerelease, true) +
+                  tuples_for(source, :latest)
+
+                names.sort
+              when :prerelease
+                tuples_for(source, :prerelease)
+              else
+                raise Gem::Exception, "Unknown type - :#{type}"
       end
+    rescue Gem::RemoteFetcher::FetchError => e
+      errors << Gem::SourceFetchProblem.new(source, e)
+    else
+      list[source] = names
     end
 
     [list, errors]
@@ -260,11 +250,9 @@ class Gem::SpecFetcher
 
   def tuples_for(source, type, gracefully_ignore=false) # :nodoc:
     @caches[type][source.uri] ||=
-      source.load_specs(type).sort_by { |tup| tup.name }
+      source.load_specs(type).sort_by(&:name)
   rescue Gem::RemoteFetcher::FetchError
     raise unless gracefully_ignore
     []
   end
-
 end
-