rubygems-update 2.6.1 → 3.5.0

data/lib/rubygems/safe_marshal/visitors/visitor.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module Gem::SafeMarshal::Visitors
+  class Visitor
+    def visit(target)
+      send DISPATCH.fetch(target.class), target
+    end
+
+    private
+
+    DISPATCH = Gem::SafeMarshal::Elements.constants.each_with_object({}) do |c, h|
+      next if c == :Element
+
+      klass = Gem::SafeMarshal::Elements.const_get(c)
+      h[klass] = :"visit_#{klass.name.gsub("::", "_")}"
+      h.default = :visit_unknown_element
+    end.compare_by_identity.freeze
+    private_constant :DISPATCH
+
+    def visit_unknown_element(e)
+      raise ArgumentError, "Attempting to visit unknown element #{e.inspect}"
+    end
+
+    def visit_Gem_SafeMarshal_Elements_Array(target)
+      target.elements.each {|e| visit(e) }
+    end
+
+    def visit_Gem_SafeMarshal_Elements_Bignum(target); end
+    def visit_Gem_SafeMarshal_Elements_False(target); end
+    def visit_Gem_SafeMarshal_Elements_Float(target); end
+
+    def visit_Gem_SafeMarshal_Elements_Hash(target)
+      target.pairs.each do |k, v|
+        visit(k)
+        visit(v)
+      end
+    end
+
+    def visit_Gem_SafeMarshal_Elements_HashWithDefaultValue(target)
+      visit_Gem_SafeMarshal_Elements_Hash(target)
+      visit(target.default)
+    end
+
+    def visit_Gem_SafeMarshal_Elements_Integer(target); end
+    def visit_Gem_SafeMarshal_Elements_Nil(target); end
+
+    def visit_Gem_SafeMarshal_Elements_Object(target)
+      visit(target.name)
+    end
+
+    def visit_Gem_SafeMarshal_Elements_ObjectLink(target); end
+    def visit_Gem_SafeMarshal_Elements_String(target); end
+    def visit_Gem_SafeMarshal_Elements_Symbol(target); end
+    def visit_Gem_SafeMarshal_Elements_SymbolLink(target); end
+    def visit_Gem_SafeMarshal_Elements_True(target); end
+
+    def visit_Gem_SafeMarshal_Elements_UserDefined(target)
+      visit(target.name)
+    end
+
+    def visit_Gem_SafeMarshal_Elements_UserMarshal(target)
+      visit(target.name)
+      visit(target.data)
+    end
+
+    def visit_Gem_SafeMarshal_Elements_WithIvars(target)
+      visit(target.object)
+      target.ivars.each do |k, v|
+        visit(k)
+        visit(v)
+      end
+    end
+  end
+end

data/lib/rubygems/safe_marshal.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "stringio"
+
+require_relative "safe_marshal/reader"
+require_relative "safe_marshal/visitors/to_ruby"
+
+module Gem
+  ###
+  # This module is used for safely loading Marshal specs from a gem.  The
+  # `safe_load` method defined on this module is specifically designed for
+  # loading Gem specifications.
+
+  module SafeMarshal
+    PERMITTED_CLASSES = %w[
+      Date
+      Time
+      Rational
+
+      Gem::Dependency
+      Gem::NameTuple
+      Gem::Platform
+      Gem::Requirement
+      Gem::Specification
+      Gem::Version
+      Gem::Version::Requirement
+
+      YAML::Syck::DefaultKey
+      YAML::PrivateType
+    ].freeze
+    private_constant :PERMITTED_CLASSES
+
+    PERMITTED_SYMBOLS = %w[
+      development
+      runtime
+
+      name
+      number
+      platform
+      dependencies
+    ].freeze
+    private_constant :PERMITTED_SYMBOLS
+
+    PERMITTED_IVARS = {
+      "String" => %w[E encoding @taguri @debug_created_info],
+      "Time" => %w[
+        offset zone nano_num nano_den submicro
+        @_zone @marshal_with_utc_coercion
+      ],
+      "Gem::Dependency" => %w[
+        @name @requirement @prerelease @version_requirement @version_requirements @type
+        @force_ruby_platform
+      ],
+      "Gem::NameTuple" => %w[@name @version @platform],
+      "Gem::Platform" => %w[@os @cpu @version],
+      "Psych::PrivateType" => %w[@value @type_id],
+    }.freeze
+    private_constant :PERMITTED_IVARS
+
+    def self.safe_load(input)
+      load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, permitted_ivars: PERMITTED_IVARS)
+    end
+
+    def self.load(input, permitted_classes: [::Symbol], permitted_symbols: [], permitted_ivars: {})
+      root = Reader.new(StringIO.new(input, "r").binmode).read!
+
+      Visitors::ToRuby.new(
+        permitted_classes: permitted_classes,
+        permitted_symbols: permitted_symbols,
+        permitted_ivars: permitted_ivars,
+      ).visit(root)
+    end
+  end
+end

data/lib/rubygems/safe_yaml.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Gem
+  ###
+  # This module is used for safely loading YAML specs from a gem.  The
+  # `safe_load` method defined on this module is specifically designed for
+  # loading Gem specifications.  For loading other YAML safely, please see
+  # Psych.safe_load
+
+  module SafeYAML
+    PERMITTED_CLASSES = %w[
+      Symbol
+      Time
+      Date
+      Gem::Dependency
+      Gem::Platform
+      Gem::Requirement
+      Gem::Specification
+      Gem::Version
+      Gem::Version::Requirement
+    ].freeze
+
+    PERMITTED_SYMBOLS = %w[
+      development
+      runtime
+    ].freeze
+
+    def self.safe_load(input)
+      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: true)
+    end
+
+    def self.load(input)
+      ::Psych.safe_load(input, permitted_classes: [::Symbol])
+    end
+  end
+end

data/lib/rubygems/security/policies.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
-module Gem::Security
 
+module Gem::Security
   ##
   # No security policy: all package signature checks are disabled.
 
   NoSecurity = Policy.new(
-    'No Security',
-    :verify_data      => false,
-    :verify_signer    => false,
-    :verify_chain     => false,
-    :verify_root      => false,
-    :only_trusted     => false,
-    :only_signed      => false
+    "No Security",
+    verify_data: false,
+    verify_signer: false,
+    verify_chain: false,
+    verify_root: false,
+    only_trusted: false,
+    only_signed: false
   )
 
   ##
@@ -23,13 +23,13 @@ module Gem::Security
   # easily spoofed, and is not recommended.
 
   AlmostNoSecurity = Policy.new(
-    'Almost No Security',
-    :verify_data      => true,
-    :verify_signer    => false,
-    :verify_chain     => false,
-    :verify_root      => false,
-    :only_trusted     => false,
-    :only_signed      => false
+    "Almost No Security",
+    verify_data: true,
+    verify_signer: false,
+    verify_chain: false,
+    verify_root: false,
+    only_trusted: false,
+    only_signed: false
   )
 
   ##
@@ -40,13 +40,13 @@ module Gem::Security
   # is not recommended.
 
   LowSecurity = Policy.new(
-    'Low Security',
-    :verify_data      => true,
-    :verify_signer    => true,
-    :verify_chain     => false,
-    :verify_root      => false,
-    :only_trusted     => false,
-    :only_signed      => false
+    "Low Security",
+    verify_data: true,
+    verify_signer: true,
+    verify_chain: false,
+    verify_root: false,
+    only_trusted: false,
+    only_signed: false
   )
 
   ##
@@ -59,13 +59,13 @@ module Gem::Security
   # gem off as unsigned.
 
   MediumSecurity = Policy.new(
-    'Medium Security',
-    :verify_data      => true,
-    :verify_signer    => true,
-    :verify_chain     => true,
-    :verify_root      => true,
-    :only_trusted     => true,
-    :only_signed      => false
+    "Medium Security",
+    verify_data: true,
+    verify_signer: true,
+    verify_chain: true,
+    verify_root: true,
+    only_trusted: true,
+    only_signed: false
   )
 
   ##
@@ -78,39 +78,37 @@ module Gem::Security
   # a reasonable guarantee that the contents of the gem have not been altered.
 
   HighSecurity = Policy.new(
-    'High Security',
-    :verify_data      => true,
-    :verify_signer    => true,
-    :verify_chain     => true,
-    :verify_root      => true,
-    :only_trusted     => true,
-    :only_signed      => true
+    "High Security",
+    verify_data: true,
+    verify_signer: true,
+    verify_chain: true,
+    verify_root: true,
+    only_trusted: true,
+    only_signed: true
   )
 
   ##
   # Policy used to verify a certificate and key when signing a gem
 
   SigningPolicy = Policy.new(
-    'Signing Policy',
-    :verify_data      => false,
-    :verify_signer    => true,
-    :verify_chain     => true,
-    :verify_root      => true,
-    :only_trusted     => false,
-    :only_signed      => false
+    "Signing Policy",
+    verify_data: false,
+    verify_signer: true,
+    verify_chain: true,
+    verify_root: true,
+    only_trusted: false,
+    only_signed: false
   )
 
   ##
   # Hash of configured security policies
 
   Policies = {
-    'NoSecurity'       => NoSecurity,
-    'AlmostNoSecurity' => AlmostNoSecurity,
-    'LowSecurity'      => LowSecurity,
-    'MediumSecurity'   => MediumSecurity,
-    'HighSecurity'     => HighSecurity,
+    "NoSecurity" => NoSecurity,
+    "AlmostNoSecurity" => AlmostNoSecurity,
+    "LowSecurity" => LowSecurity,
+    "MediumSecurity" => MediumSecurity,
+    "HighSecurity" => HighSecurity,
     # SigningPolicy is not intended for use by `gem -P` so do not list it
-  }
-
+  }.freeze
 end
-

data/lib/rubygems/security/policy.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
-require 'rubygems/user_interaction'
+
+require_relative "../user_interaction"
 
 ##
 # A Gem::Security::Policy object encapsulates the settings for verifying
@@ -8,7 +9,6 @@ require 'rubygems/user_interaction'
 # Gem::Security::Policies.
 
 class Gem::Security::Policy
-
   include Gem::UserInteraction
 
   attr_reader :name
@@ -24,9 +24,7 @@ class Gem::Security::Policy
   # Create a new Gem::Security::Policy object with the given mode and
   # options.
 
-  def initialize name, policy = {}, opt = {}
-    require 'openssl'
-
+  def initialize(name, policy = {}, opt = {})
     @name = name
 
     @opt = opt
@@ -55,9 +53,9 @@ class Gem::Security::Policy
   # Verifies each certificate in +chain+ has signed the following certificate
   # and is valid for the given +time+.
 
-  def check_chain chain, time
-    raise Gem::Security::Exception, 'missing signing chain' unless chain
-    raise Gem::Security::Exception, 'empty signing chain' if chain.empty?
+  def check_chain(chain, time)
+    raise Gem::Security::Exception, "missing signing chain" unless chain
+    raise Gem::Security::Exception, "empty signing chain" if chain.empty?
 
     begin
       chain.each_cons 2 do |issuer, cert|
@@ -74,9 +72,9 @@ class Gem::Security::Policy
   # Verifies that +data+ matches the +signature+ created by +public_key+ and
   # the +digest+ algorithm.
 
-  def check_data public_key, digest, signature, data
+  def check_data(public_key, digest, signature, data)
     raise Gem::Security::Exception, "invalid signature" unless
-      public_key.verify digest.new, signature, data.digest
+      public_key.verify digest, signature, data.digest
 
     true
   end
@@ -85,22 +83,22 @@ class Gem::Security::Policy
   # Ensures that +signer+ is valid for +time+ and was signed by the +issuer+.
   # If the +issuer+ is +nil+ no verification is performed.
 
-  def check_cert signer, issuer, time
-    raise Gem::Security::Exception, 'missing signing certificate' unless
+  def check_cert(signer, issuer, time)
+    raise Gem::Security::Exception, "missing signing certificate" unless
       signer
 
     message = "certificate #{signer.subject}"
 
-    if not_before = signer.not_before and not_before > time then
+    if (not_before = signer.not_before) && not_before > time
       raise Gem::Security::Exception,
             "#{message} not valid before #{not_before}"
     end
 
-    if not_after = signer.not_after and not_after < time then
+    if (not_after = signer.not_after) && not_after < time
       raise Gem::Security::Exception, "#{message} not valid after #{not_after}"
     end
 
-    if issuer and not signer.verify issuer.public_key then
+    if issuer && !signer.verify(issuer.public_key)
       raise Gem::Security::Exception,
             "#{message} was not issued by #{issuer.subject}"
     end
@@ -111,16 +109,16 @@ class Gem::Security::Policy
   ##
   # Ensures the public key of +key+ matches the public key in +signer+
 
-  def check_key signer, key
-    unless signer and key then
+  def check_key(signer, key)
+    unless signer && key
       return true unless @only_signed
 
-      raise Gem::Security::Exception, 'missing key or signature'
+      raise Gem::Security::Exception, "missing key or signature"
     end
 
     raise Gem::Security::Exception,
       "certificate #{signer.subject} does not match the signing key" unless
-        signer.public_key.to_pem == key.public_key.to_pem
+        signer.check_private_key(key)
 
     true
   end
@@ -129,17 +127,17 @@ class Gem::Security::Policy
   # Ensures the root certificate in +chain+ is self-signed and valid for
   # +time+.
 
-  def check_root chain, time
-    raise Gem::Security::Exception, 'missing signing chain' unless chain
+  def check_root(chain, time)
+    raise Gem::Security::Exception, "missing signing chain" unless chain
 
     root = chain.first
 
-    raise Gem::Security::Exception, 'missing root certificate' unless root
+    raise Gem::Security::Exception, "missing root certificate" unless root
 
     raise Gem::Security::Exception,
-          "root certificate #{root.subject} is not self-signed " +
+          "root certificate #{root.subject} is not self-signed " \
           "(issuer #{root.issuer})" if
-      root.issuer.to_s != root.subject.to_s # HACK to_s is for ruby 1.8
+      root.issuer != root.subject
 
     check_cert root, root, time
   end
@@ -148,16 +146,16 @@ class Gem::Security::Policy
   # Ensures the root of +chain+ has a trusted certificate in +trust_dir+ and
   # the digests of the two certificates match according to +digester+
 
-  def check_trust chain, digester, trust_dir
-    raise Gem::Security::Exception, 'missing signing chain' unless chain
+  def check_trust(chain, digester, trust_dir)
+    raise Gem::Security::Exception, "missing signing chain" unless chain
 
     root = chain.first
 
-    raise Gem::Security::Exception, 'missing root certificate' unless root
+    raise Gem::Security::Exception, "missing root certificate" unless root
 
     path = Gem::Security.trust_dir.cert_path root
 
-    unless File.exist? path then
+    unless File.exist? path
       message = "root cert #{root.subject} is not trusted".dup
 
       message << " (root of signing cert #{chain.last.subject})" if
@@ -167,13 +165,13 @@ class Gem::Security::Policy
     end
 
     save_cert = OpenSSL::X509::Certificate.new File.read path
-    save_dgst = digester.digest save_cert.public_key.to_s
+    save_dgst = digester.digest save_cert.public_key.to_pem
 
-    pkey_str = root.public_key.to_s
+    pkey_str = root.public_key.to_pem
     cert_dgst = digester.digest pkey_str
 
     raise Gem::Security::Exception,
-          "trusted root certificate #{root.subject} checksum " +
+          "trusted root certificate #{root.subject} checksum " \
           "does not match signing root certificate checksum" unless
       save_dgst == cert_dgst
 
@@ -183,9 +181,9 @@ class Gem::Security::Policy
   ##
   # Extracts the email or subject from +certificate+
 
-  def subject certificate # :nodoc:
+  def subject(certificate) # :nodoc:
     certificate.extensions.each do |extension|
-      next unless extension.oid == 'subjectAltName'
+      next unless extension.oid == "subjectAltName"
 
       return extension.value
     end
@@ -194,11 +192,8 @@ class Gem::Security::Policy
   end
 
   def inspect # :nodoc:
-    ("[Policy: %s - data: %p signer: %p chain: %p root: %p " +
-     "signed-only: %p trusted-only: %p]") % [
-      @name, @verify_chain, @verify_data, @verify_root, @verify_signer,
-      @only_signed, @only_trusted,
-    ]
+    format("[Policy: %s - data: %p signer: %p chain: %p root: %p " \
+     "signed-only: %p trusted-only: %p]", @name, @verify_chain, @verify_data, @verify_root, @verify_signer, @only_signed, @only_trusted)
   end
 
   ##
@@ -208,13 +203,12 @@ class Gem::Security::Policy
   #
   # If +key+ is given it is used to validate the signing certificate.
 
-  def verify chain, key = nil, digests = {}, signatures = {},
-             full_name = '(unknown)'
-    if signatures.empty? then
-      if @only_signed then
+  def verify(chain, key = nil, digests = {}, signatures = {}, full_name = "(unknown)")
+    if signatures.empty?
+      if @only_signed
         raise Gem::Security::Exception,
           "unsigned gems are not allowed by the #{name} policy"
-      elsif digests.empty? then
+      elsif digests.empty?
         # lack of signatures is irrelevant if there is nothing to check
         # against
       else
@@ -224,17 +218,17 @@ class Gem::Security::Policy
     end
 
     opt       = @opt
-    digester  = Gem::Security::DIGEST_ALGORITHM
+    digester  = Gem::Security.create_digest
     trust_dir = opt[:trust_dir]
     time      = Time.now
 
-    _, signer_digests = digests.find do |algorithm, file_digests|
+    _, signer_digests = digests.find do |_algorithm, file_digests|
       file_digests.values.first.name == Gem::Security::DIGEST_NAME
     end
 
-    if @verify_data then
-      raise Gem::Security::Exception, 'no digests provided (probable bug)' if
-        signer_digests.nil? or signer_digests.empty?
+    if @verify_data
+      raise Gem::Security::Exception, "no digests provided (probable bug)" if
+        signer_digests.nil? || signer_digests.empty?
     else
       signer_digests = {}
     end
@@ -249,9 +243,9 @@ class Gem::Security::Policy
 
     check_root chain, time if @verify_root
 
-    if @only_trusted then
+    if @only_trusted
       check_trust chain, digester, trust_dir
-    elsif signatures.empty? and digests.empty? then
+    elsif signatures.empty? && digests.empty?
       # trust is irrelevant if there's no signatures to verify
     else
       alert_warning "#{subject signer} is not trusted for #{full_name}"
@@ -280,7 +274,7 @@ class Gem::Security::Policy
   # Extracts the certificate chain from the +spec+ and calls #verify to ensure
   # the signatures and certificate chain is valid according to the policy..
 
-  def verify_signatures spec, digests, signatures
+  def verify_signatures(spec, digests, signatures)
     chain = spec.cert_chain.map do |cert_pem|
       OpenSSL::X509::Certificate.new cert_pem
     end
@@ -290,6 +284,5 @@ class Gem::Security::Policy
     true
   end
 
-  alias to_s name # :nodoc:
-
+  alias_method :to_s, :name # :nodoc:
 end