rubygems-update 2.6.1 → 3.5.0

data/lib/rubygems/remote_fetcher.rb

@@ -1,17 +1,18 @@
 # frozen_string_literal: true
-require 'rubygems'
-require 'rubygems/request'
-require 'rubygems/uri_formatter'
-require 'rubygems/user_interaction'
-require 'rubygems/request/connection_pools'
-require 'resolv'
+
+require_relative "../rubygems"
+require_relative "request"
+require_relative "request/connection_pools"
+require_relative "s3_uri_signer"
+require_relative "uri_formatter"
+require_relative "uri"
+require_relative "user_interaction"
 
 ##
 # RemoteFetcher handles the details of fetching gems and gem information from
 # a remote source.
 
 class Gem::RemoteFetcher
-
   include Gem::UserInteraction
 
   ##
@@ -19,21 +20,23 @@ class Gem::RemoteFetcher
   # that could happen while downloading from the internet.
 
   class FetchError < Gem::Exception
-
     ##
     # The URI which was being accessed when the exception happened.
 
-    attr_accessor :uri
+    attr_accessor :uri, :original_uri
 
     def initialize(message, uri)
-      super message
-      @uri = uri
+      uri = Gem::Uri.new(uri)
+
+      super uri.redact_credentials_from(message)
+
+      @original_uri = uri.to_s
+      @uri = uri.redacted.to_s
     end
 
     def to_s # :nodoc:
       "#{super} (#{uri})"
     end
-
   end
 
   ##
@@ -42,6 +45,7 @@ class Gem::RemoteFetcher
 
   class UnknownHostError < FetchError
   end
+  deprecate_constant(:UnknownHostError)
 
   @fetcher = nil
 
@@ -49,7 +53,7 @@ class Gem::RemoteFetcher
   # Cached RemoteFetcher instance.
 
   def self.fetcher
-    @fetcher ||= self.new Gem.configuration[:http_proxy]
+    @fetcher ||= new Gem.configuration[:http_proxy]
   end
 
   attr_accessor :headers
@@ -65,53 +69,25 @@ class Gem::RemoteFetcher
   #        HTTP_PROXY_PASS)
   # * <tt>:no_proxy</tt>: ignore environment variables and _don't_ use a proxy
   #
-  # +dns+: An object to use for DNS resolution of the API endpoint.
-  #        By default, use Resolv::DNS.
-  #
   # +headers+: A set of additional HTTP headers to be sent to the server when
   #            fetching the gem.
 
-  def initialize(proxy=nil, dns=Resolv::DNS.new, headers={})
-    require 'net/http'
-    require 'stringio'
-    require 'time'
-    require 'uri'
+  def initialize(proxy=nil, dns=nil, headers={})
+    require_relative "core_ext/tcpsocket_init" if Gem.configuration.ipv4_fallback_enabled
+    require_relative "net/http"
+    require "stringio"
+    require "uri"
 
     Socket.do_not_reverse_lookup = true
 
     @proxy = proxy
     @pools = {}
-    @pool_lock = Mutex.new
+    @pool_lock = Thread::Mutex.new
     @cert_files = Gem::Request.get_cert_files
 
-    @dns = dns
     @headers = headers
   end
 
-  ##
-  # Given a source at +uri+, calculate what hostname to actually
-  # connect to query the data for it.
-
-  def api_endpoint(uri)
-    host = uri.host
-
-    begin
-      res = @dns.getresource "_rubygems._tcp.#{host}",
-                             Resolv::DNS::Resource::IN::SRV
-    rescue Resolv::ResolvError => e
-      verbose "Getting SRV record failed: #{e}"
-      uri
-    else
-      target = res.target.to_s.strip
-
-      if /\.#{Regexp.quote(host)}\z/ =~ target
-        return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
-      end
-
-      uri
-    end
-  end
-
   ##
   # Given a name and requirement, downloads this gem into cache and returns the
   # filename. Returns nil if the gem cannot be located.
@@ -119,14 +95,14 @@ class Gem::RemoteFetcher
   # Should probably be integrated with #download below, but that will be a
   # larger, more encompassing effort. -erikh
 
-  def download_to_cache dependency
+  def download_to_cache(dependency)
     found, _ = Gem::SpecFetcher.fetcher.spec_for_dependency dependency
 
     return if found.empty?
 
-    spec, source = found.max_by { |(s,_)| s.version }
+    spec, source = found.max_by {|(s,_)| s.version }
 
-    download spec, source.uri.to_s
+    download spec, source.uri
   end
 
   ##
@@ -135,11 +111,12 @@ class Gem::RemoteFetcher
   # always replaced.
 
   def download(spec, source_uri, install_dir = Gem.dir)
+    install_cache_dir = File.join install_dir, "cache"
     cache_dir =
-      if Dir.pwd == install_dir then # see fetch_command
+      if Dir.pwd == install_dir # see fetch_command
         install_dir
-      elsif File.writable? install_dir then
-        File.join install_dir, "cache"
+      elsif File.writable?(install_cache_dir) || (File.writable?(install_dir) && !File.exist?(install_cache_dir))
+        install_cache_dir
       else
         File.join Gem.user_dir, "cache"
       end
@@ -147,40 +124,32 @@ class Gem::RemoteFetcher
     gem_file_name = File.basename spec.cache_file
     local_gem_path = File.join cache_dir, gem_file_name
 
-    FileUtils.mkdir_p cache_dir rescue nil unless File.exist? cache_dir
+    require "fileutils"
+    begin
+      FileUtils.mkdir_p cache_dir
+    rescue StandardError
+      nil
+    end unless File.exist? cache_dir
 
-    # Always escape URI's to deal with potential spaces and such
-    # It should also be considered that source_uri may already be
-    # a valid URI with escaped characters. e.g. "{DESede}" is encoded
-    # as "%7BDESede%7D". If this is escaped again the percentage
-    # symbols will be escaped.
-    unless source_uri.is_a?(URI::Generic)
-      begin
-        source_uri = URI.parse(source_uri)
-      rescue
-        source_uri = URI.parse(URI.const_defined?(:DEFAULT_PARSER) ?
-                               URI::DEFAULT_PARSER.escape(source_uri.to_s) :
-                               URI.escape(source_uri.to_s))
-      end
-    end
+    source_uri = Gem::Uri.new(source_uri)
 
     scheme = source_uri.scheme
 
     # URI.parse gets confused by MS Windows paths with forward slashes.
-    scheme = nil if scheme =~ /^[a-z]$/i
+    scheme = nil if /^[a-z]$/i.match?(scheme)
 
     # REFACTOR: split this up and dispatch on scheme (eg download_http)
     # REFACTOR: be sure to clean up fake fetcher when you do this... cleaner
     case scheme
-    when 'http', 'https', 's3' then
-      unless File.exist? local_gem_path then
+    when "http", "https", "s3" then
+      unless File.exist? local_gem_path
         begin
           verbose "Downloading gem #{gem_file_name}"
 
           remote_gem_path = source_uri + "gems/#{gem_file_name}"
 
-          self.cache_update_path remote_gem_path, local_gem_path
-        rescue Gem::RemoteFetcher::FetchError
+          cache_update_path remote_gem_path, local_gem_path
+        rescue FetchError
           raise if spec.original_platform == spec.platform
 
           alternate_name = "#{spec.original_name}.gem"
@@ -189,15 +158,15 @@ class Gem::RemoteFetcher
 
           remote_gem_path = source_uri + "gems/#{alternate_name}"
 
-          self.cache_update_path remote_gem_path, local_gem_path
+          cache_update_path remote_gem_path, local_gem_path
         end
       end
-    when 'file' then
+    when "file" then
       begin
         path = source_uri.path
-        path = File.dirname(path) if File.extname(path) == '.gem'
+        path = File.dirname(path) if File.extname(path) == ".gem"
 
-        remote_gem_path = correct_for_windows_path(File.join(path, 'gems', gem_file_name))
+        remote_gem_path = Gem::Util.correct_for_windows_path(File.join(path, "gems", gem_file_name))
 
         FileUtils.cp(remote_gem_path, local_gem_path)
       rescue Errno::EACCES
@@ -205,13 +174,13 @@ class Gem::RemoteFetcher
       end
 
       verbose "Using local gem #{local_gem_path}"
-    when nil then # TODO test for local overriding cache
+    when nil then # TODO: test for local overriding cache
       source_path = if Gem.win_platform? && source_uri.scheme &&
-                       !source_uri.path.include?(':') then
-                      "#{source_uri.scheme}:#{source_uri.path}"
-                    else
-                      source_uri.path
-                    end
+                       !source_uri.path.include?(":")
+        "#{source_uri.scheme}:#{source_uri.path}"
+      else
+        source_uri.path
+      end
 
       source_path = Gem::UriFormatter.new(source_path).unescape
 
@@ -233,28 +202,31 @@ class Gem::RemoteFetcher
   ##
   # File Fetcher. Dispatched by +fetch_path+. Use it instead.
 
-  def fetch_file uri, *_
-    Gem.read_binary correct_for_windows_path uri.path
+  def fetch_file(uri, *_)
+    Gem.read_binary Gem::Util.correct_for_windows_path uri.path
   end
 
   ##
   # HTTP Fetcher. Dispatched by +fetch_path+. Use it instead.
 
-  def fetch_http uri, last_modified = nil, head = false, depth = 0
-    fetch_type = head ? Net::HTTP::Head : Net::HTTP::Get
+  def fetch_http(uri, last_modified = nil, head = false, depth = 0)
+    fetch_type = head ? Gem::Net::HTTP::Head : Gem::Net::HTTP::Get
     response   = request uri, fetch_type, last_modified do |req|
-      headers.each { |k,v| req.add_field(k,v) }
+      headers.each {|k,v| req.add_field(k,v) }
     end
 
     case response
-    when Net::HTTPOK, Net::HTTPNotModified then
-      response.uri = uri if response.respond_to? :uri
+    when Gem::Net::HTTPOK, Gem::Net::HTTPNotModified then
+      response.uri = uri
       head ? response : response.body
-    when Net::HTTPMovedPermanently, Net::HTTPFound, Net::HTTPSeeOther,
-         Net::HTTPTemporaryRedirect then
-      raise FetchError.new('too many redirects', uri) if depth > 10
+    when Gem::Net::HTTPMovedPermanently, Gem::Net::HTTPFound, Gem::Net::HTTPSeeOther,
+         Gem::Net::HTTPTemporaryRedirect then
+      raise FetchError.new("too many redirects", uri) if depth > 10
 
-      location = URI.parse response['Location']
+      unless location = response["Location"]
+        raise FetchError.new("redirecting but no redirect location was given", uri)
+      end
+      location = Gem::Uri.new location
 
       if https?(uri) && !https?(location)
         raise FetchError.new("redirecting to non-https resource: #{location}", uri)
@@ -266,15 +238,13 @@ class Gem::RemoteFetcher
     end
   end
 
-  alias :fetch_https :fetch_http
+  alias_method :fetch_https, :fetch_http
 
   ##
   # Downloads +uri+ and returns it as a String.
 
   def fetch_path(uri, mtime = nil, head = false)
-    uri = URI.parse uri unless URI::Generic === uri
-
-    raise ArgumentError, "bad uri: #{uri}" unless uri
+    uri = Gem::Uri.new uri
 
     unless uri.scheme
       raise ArgumentError, "uri scheme is invalid: #{uri.scheme.inspect}"
@@ -282,85 +252,61 @@ class Gem::RemoteFetcher
 
     data = send "fetch_#{uri.scheme}", uri, mtime, head
 
-    if data and !head and uri.to_s =~ /\.gz$/
+    if data && !head && uri.to_s.end_with?(".gz")
       begin
-        data = Gem.gunzip data
+        data = Gem::Util.gunzip data
       rescue Zlib::GzipFile::Error
-        raise FetchError.new("server did not return a valid file", uri.to_s)
+        raise FetchError.new("server did not return a valid file", uri)
       end
     end
 
     data
-  rescue FetchError
-    raise
-  rescue Timeout::Error
-    raise UnknownHostError.new('timed out', uri.to_s)
-  rescue IOError, SocketError, SystemCallError => e
-    if e.message =~ /getaddrinfo/
-      raise UnknownHostError.new('no such name', uri.to_s)
-    else
-      raise FetchError.new("#{e.class}: #{e}", uri.to_s)
-    end
+  rescue Gem::Timeout::Error, IOError, SocketError, SystemCallError,
+         *(OpenSSL::SSL::SSLError if Gem::HAVE_OPENSSL) => e
+    raise FetchError.new("#{e.class}: #{e}", uri)
   end
 
   def fetch_s3(uri, mtime = nil, head = false)
-    public_uri = sign_s3_url(uri)
+    begin
+      public_uri = s3_uri_signer(uri).sign
+    rescue Gem::S3URISigner::ConfigurationError, Gem::S3URISigner::InstanceProfileError => e
+      raise FetchError.new(e.message, "s3://#{uri.host}")
+    end
     fetch_https public_uri, mtime, head
   end
 
+  # we have our own signing code here to avoid a dependency on the aws-sdk gem
+  def s3_uri_signer(uri)
+    Gem::S3URISigner.new(uri)
+  end
+
   ##
   # Downloads +uri+ to +path+ if necessary. If no path is given, it just
   # passes the data.
 
-  def cache_update_path uri, path = nil, update = true
-    mtime = path && File.stat(path).mtime rescue nil
+  def cache_update_path(uri, path = nil, update = true)
+    mtime = begin
+              path && File.stat(path).mtime
+            rescue StandardError
+              nil
+            end
 
     data = fetch_path(uri, mtime)
 
-    if data == nil # indicates the server returned 304 Not Modified
+    if data.nil? # indicates the server returned 304 Not Modified
       return Gem.read_binary(path)
     end
 
-    if update and path
-      begin
-        open(path, 'wb') do |io|
-          io.flock(File::LOCK_EX)
-          io.write data
-        end
-      rescue Errno::ENOLCK # NFS
-        if Thread.main != Thread.current
-          raise
-        else
-          open(path, 'wb') do |io|
-            io.write data
-          end
-        end
-      end
+    if update && path
+      Gem.write_binary(path, data)
     end
 
     data
   end
 
   ##
-  # Returns the size of +uri+ in bytes.
-
-  def fetch_size(uri) # TODO: phase this out
-    response = fetch_path(uri, nil, true)
-
-    response['content-length'].to_i
-  end
-
-  def correct_for_windows_path(path)
-    if path[0].chr == '/' && path[1].chr =~ /[a-z]/i && path[2].chr == ':'
-      path[1..-1]
-    else
-      path
-    end
-  end
-
-  ##
-  # Performs a Net::HTTP request of type +request_class+ on +uri+ returning
-  # a Net::HTTP response object.  request maintains a table of persistent
+  # Performs a Gem::Net::HTTP request of type +request_class+ on +uri+ returning
+  # a Gem::Net::HTTP response object.  request maintains a table of persistent
   # connections to reduce connect overhead.
 
   def request(uri, request_class, last_modified = nil)
@@ -375,50 +321,22 @@ class Gem::RemoteFetcher
   end
 
   def https?(uri)
-    uri.scheme.downcase == 'https'
+    uri.scheme.casecmp("https").zero?
   end
 
   def close_all
-    @pools.each_value {|pool| pool.close_all}
-  end
-
-  protected
-
-  # we have our own signing code here to avoid a dependency on the aws-sdk gem
-  # fortunately, a simple GET request isn't too complex to sign properly
-  def sign_s3_url(uri, expiration = nil)
-    require 'base64'
-    require 'openssl'
-
-    unless uri.user && uri.password
-      raise FetchError.new("credentials needed in s3 source, like s3://key:secret@bucket-name/", uri.to_s)
-    end
-
-    expiration ||= s3_expiration
-    canonical_path = "/#{uri.host}#{uri.path}"
-    payload = "GET\n\n\n#{expiration}\n#{canonical_path}"
-    digest = OpenSSL::HMAC.digest('sha1', uri.password, payload)
-    # URI.escape is deprecated, and there isn't yet a replacement that does quite what we want
-    signature = Base64.encode64(digest).gsub("\n", '').gsub(/[\+\/=]/) { |c| BASE64_URI_TRANSLATE[c] }
-    URI.parse("https://#{uri.host}.s3.amazonaws.com#{uri.path}?AWSAccessKeyId=#{uri.user}&Expires=#{expiration}&Signature=#{signature}")
+    @pools.each_value(&:close_all)
   end
 
-  def s3_expiration
-    (Time.now + 3600).to_i # one hour from now
-  end
-
-  BASE64_URI_TRANSLATE = { '+' => '%2B', '/' => '%2F', '=' => '%3D' }.freeze
-
   private
 
-  def proxy_for proxy, uri
+  def proxy_for(proxy, uri)
     Gem::Request.proxy_uri(proxy || Gem::Request.get_proxy_from_env(uri.scheme))
   end
 
-  def pools_for proxy
+  def pools_for(proxy)
     @pool_lock.synchronize do
       @pools[proxy] ||= Gem::Request::ConnectionPools.new proxy, @cert_files
     end
   end
 end
-

data/lib/rubygems/request/connection_pools.rb

@@ -1,27 +1,25 @@
 # frozen_string_literal: true
-require 'thread'
 
 class Gem::Request::ConnectionPools # :nodoc:
-
-  @client = Net::HTTP
+  @client = Gem::Net::HTTP
 
   class << self
     attr_accessor :client
   end
 
-  def initialize proxy_uri, cert_files
+  def initialize(proxy_uri, cert_files)
     @proxy_uri  = proxy_uri
     @cert_files = cert_files
     @pools      = {}
-    @pool_mutex = Mutex.new
+    @pool_mutex = Thread::Mutex.new
   end
 
-  def pool_for uri
+  def pool_for(uri)
     http_args = net_http_args(uri, @proxy_uri)
     key       = http_args + [https?(uri)]
     @pool_mutex.synchronize do
       @pools[key] ||=
-        if https? uri then
+        if https? uri
           Gem::Request::HTTPSPool.new(http_args, @cert_files, @proxy_uri)
         else
           Gem::Request::HTTPPool.new(http_args, @cert_files, @proxy_uri)
@@ -30,7 +28,7 @@ class Gem::Request::ConnectionPools # :nodoc:
   end
 
   def close_all
-    @pools.each_value {|pool| pool.close_all}
+    @pools.each_value(&:close_all)
   end
 
   private
@@ -39,37 +37,48 @@ class Gem::Request::ConnectionPools # :nodoc:
   # Returns list of no_proxy entries (if any) from the environment
 
   def get_no_proxy_from_env
-    env_no_proxy = ENV['no_proxy'] || ENV['NO_PROXY']
+    env_no_proxy = ENV["no_proxy"] || ENV["NO_PROXY"]
 
-    return [] if env_no_proxy.nil?  or env_no_proxy.empty?
+    return [] if env_no_proxy.nil? || env_no_proxy.empty?
 
     env_no_proxy.split(/\s*,\s*/)
   end
 
-  def https? uri
-    uri.scheme.downcase == 'https'
+  def https?(uri)
+    uri.scheme.casecmp("https").zero?
   end
 
-  def no_proxy? host, env_no_proxy
+  def no_proxy?(host, env_no_proxy)
     host = host.downcase
 
     env_no_proxy.any? do |pattern|
-      pattern = pattern.downcase
+      env_no_proxy_pattern = pattern.downcase.dup
+
+      # Remove dot in front of pattern for wildcard matching
+      env_no_proxy_pattern[0] = "" if env_no_proxy_pattern[0] == "."
+
+      host_tokens = host.split(".")
+      pattern_tokens = env_no_proxy_pattern.split(".")
+
+      intersection = (host_tokens - pattern_tokens) | (pattern_tokens - host_tokens)
 
-      host[-pattern.length, pattern.length] == pattern or
-        (pattern.start_with? '.' and pattern[1..-1] == host)
+      # When we do the split into tokens we miss a dot character, so add it back if we need it
+      missing_dot = intersection.length > 0 ? 1 : 0
+      start = intersection.join(".").size + missing_dot
+
+      no_proxy_host = host[start..-1]
+
+      env_no_proxy_pattern == no_proxy_host
     end
   end
 
-  def net_http_args uri, proxy_uri
-    # URI::Generic#hostname was added in ruby 1.9.3, use it if exists, otherwise
-    # don't support IPv6 literals and use host.
-    hostname = uri.respond_to?(:hostname) ? uri.hostname : uri.host
+  def net_http_args(uri, proxy_uri)
+    hostname = uri.hostname
     net_http_args = [hostname, uri.port]
 
     no_proxy = get_no_proxy_from_env
 
-    if proxy_uri and not no_proxy?(hostname, no_proxy) then
+    if proxy_uri && !no_proxy?(hostname, no_proxy)
       proxy_hostname = proxy_uri.respond_to?(:hostname) ? proxy_uri.hostname : proxy_uri.host
       net_http_args + [
         proxy_hostname,
@@ -77,12 +86,10 @@ class Gem::Request::ConnectionPools # :nodoc:
         Gem::UriFormatter.new(proxy_uri.user).unescape,
         Gem::UriFormatter.new(proxy_uri.password).unescape,
       ]
-    elsif no_proxy? hostname, no_proxy then
+    elsif no_proxy? hostname, no_proxy
       net_http_args + [nil, nil]
     else
       net_http_args
     end
   end
-
 end
-

data/lib/rubygems/request/http_pool.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A connection "pool" that only manages one connection for now.  Provides
 # thread safe `checkout` and `checkin` methods.  The pool consists of one
@@ -8,11 +9,11 @@
 class Gem::Request::HTTPPool # :nodoc:
   attr_reader :cert_files, :proxy_uri
 
-  def initialize http_args, cert_files, proxy_uri
+  def initialize(http_args, cert_files, proxy_uri)
     @http_args  = http_args
     @cert_files = cert_files
     @proxy_uri  = proxy_uri
-    @queue      = SizedQueue.new 1
+    @queue      = Thread::SizedQueue.new 1
     @queue << nil
   end
 
@@ -20,13 +21,13 @@ class Gem::Request::HTTPPool # :nodoc:
     @queue.pop || make_connection
   end
 
-  def checkin connection
+  def checkin(connection)
     @queue.push connection
   end
 
   def close_all
     until @queue.empty?
-      if connection = @queue.pop(true) and connection.started?
+      if (connection = @queue.pop(true)) && connection.started?
         connection.finish
       end
     end
@@ -39,10 +40,8 @@ class Gem::Request::HTTPPool # :nodoc:
     setup_connection Gem::Request::ConnectionPools.client.new(*@http_args)
   end
 
-  def setup_connection connection
+  def setup_connection(connection)
     connection.start
     connection
   end
-
 end
-

data/lib/rubygems/request/https_pool.rb

@@ -1,11 +1,10 @@
 # frozen_string_literal: true
+
 class Gem::Request::HTTPSPool < Gem::Request::HTTPPool # :nodoc:
   private
 
-  def setup_connection connection
+  def setup_connection(connection)
     Gem::Request.configure_connection_for_https(connection, @cert_files)
     super
   end
 end
-
-