rubygems-update 2.6.1 → 3.5.0

data/lib/rubygems/source/local.rb

@@ -1,20 +1,21 @@
 # frozen_string_literal: true
+
 ##
 # The local source finds gems in the current directory for fulfilling
 # dependencies.
 
 class Gem::Source::Local < Gem::Source
-
   def initialize # :nodoc:
     @specs   = nil
     @api_uri = nil
     @uri     = nil
+    @load_specs_names = {}
   end
 
   ##
   # Local sorts before Gem::Source and after Gem::Source::Installed
 
-  def <=> other
+  def <=>(other)
     case other
     when Gem::Source::Installed,
          Gem::Source::Lock then
@@ -23,28 +24,27 @@ class Gem::Source::Local < Gem::Source
       0
     when Gem::Source then
       1
-    else
-      nil
     end
   end
 
   def inspect # :nodoc:
-    keys = @specs ? @specs.keys.sort : 'NOT LOADED'
-    "#<%s specs: %p>" % [self.class, keys]
+    keys = @specs ? @specs.keys.sort : "NOT LOADED"
+    format("#<%s specs: %p>", self.class, keys)
   end
 
-  def load_specs type # :nodoc:
-    names = []
+  def load_specs(type) # :nodoc:
+    @load_specs_names[type] ||= begin
+      names = []
 
-    @specs = {}
+      @specs = {}
 
-    Dir["*.gem"].each do |file|
-      begin
+      Dir["*.gem"].each do |file|
         pkg = Gem::Package.new(file)
+        spec = pkg.spec
       rescue SystemCallError, Gem::Package::FormatError
         # ignore
       else
-        tup = pkg.spec.name_tuple
+        tup = spec.name_tuple
         @specs[tup] = [File.expand_path(file), pkg]
 
         case type
@@ -59,7 +59,7 @@ class Gem::Source::Local < Gem::Source
         when :latest
           tup = pkg.spec.name_tuple
 
-          cur = names.find { |x| x.name == tup.name }
+          cur = names.find {|x| x.name == tup.name }
           if !cur
             names << tup
           elsif cur.version < tup.version
@@ -70,35 +70,33 @@ class Gem::Source::Local < Gem::Source
           names << pkg.spec.name_tuple
         end
       end
-    end
 
-    names
+      names
+    end
   end
 
-  def find_gem gem_name, version = Gem::Requirement.default, # :nodoc:
-               prerelease = false
+  def find_gem(gem_name, version = Gem::Requirement.default, prerelease = false) # :nodoc:
     load_specs :complete
 
     found = []
 
     @specs.each do |n, data|
-      if n.name == gem_name
-        s = data[1].spec
-
-        if version.satisfied_by?(s.version)
-          if prerelease
-            found << s
-          elsif !s.version.prerelease?
-            found << s
-          end
+      next unless n.name == gem_name
+      s = data[1].spec
+
+      if version.satisfied_by?(s.version)
+        if prerelease
+          found << s
+        elsif !s.version.prerelease? || version.prerelease?
+          found << s
         end
       end
     end
 
-    found.max_by { |s| s.version }
+    found.max_by(&:version)
   end
 
-  def fetch_spec name # :nodoc:
+  def fetch_spec(name) # :nodoc:
     load_specs :complete
 
     if data = @specs[name]
@@ -108,23 +106,22 @@ class Gem::Source::Local < Gem::Source
     end
   end
 
-  def download spec, cache_dir = nil # :nodoc:
+  def download(spec, cache_dir = nil) # :nodoc:
     load_specs :complete
 
-    @specs.each do |name, data|
+    @specs.each do |_name, data|
       return data[0] if data[1].spec == spec
     end
 
     raise Gem::Exception, "Unable to find file for '#{spec.full_name}'"
   end
 
-  def pretty_print q # :nodoc:
-    q.group 2, '[Local gems:', ']' do
+  def pretty_print(q) # :nodoc:
+    q.group 2, "[Local gems:", "]" do
       q.breakable
       q.seplist @specs.keys do |v|
         q.text v.full_name
       end
     end
   end
-
 end

data/lib/rubygems/source/lock.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
+
 ##
 # A Lock source wraps an installed gem's source and sorts before other sources
 # during dependency resolution.  This allows RubyGems to prefer gems from
 # dependency lock files.
 
 class Gem::Source::Lock < Gem::Source
-
   ##
   # The wrapped Gem::Source
 
@@ -15,35 +15,35 @@ class Gem::Source::Lock < Gem::Source
   # Creates a new Lock source that wraps +source+ and moves it earlier in the
   # sort list.
 
-  def initialize source
+  def initialize(source)
     @wrapped = source
   end
 
-  def <=> other # :nodoc:
+  def <=>(other) # :nodoc:
     case other
     when Gem::Source::Lock then
       @wrapped <=> other.wrapped
     when Gem::Source then
       1
-    else
-      nil
     end
   end
 
-  def == other # :nodoc:
-    0 == (self <=> other)
+  def ==(other) # :nodoc:
+    (self <=> other) == 0
+  end
+
+  def hash # :nodoc:
+    @wrapped.hash ^ 3
   end
 
   ##
   # Delegates to the wrapped source's fetch_spec method.
 
-  def fetch_spec name_tuple
+  def fetch_spec(name_tuple)
     @wrapped.fetch_spec name_tuple
   end
 
   def uri # :nodoc:
     @wrapped.uri
   end
-
 end
-

data/lib/rubygems/source/specific_file.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
+
 ##
 # A source representing a single .gem file.  This is used for installation of
 # local gems.
 
 class Gem::Source::SpecificFile < Gem::Source
-
   ##
   # The path to the gem for this specific file.
 
@@ -27,23 +27,22 @@ class Gem::Source::SpecificFile < Gem::Source
 
   attr_reader :spec
 
-  def load_specs *a # :nodoc:
+  def load_specs(*a) # :nodoc:
     [@name]
   end
 
-  def fetch_spec name # :nodoc:
+  def fetch_spec(name) # :nodoc:
     return @spec if name == @name
     raise Gem::Exception, "Unable to find '#{name}'"
-    @spec
   end
 
-  def download spec, dir = nil # :nodoc:
+  def download(spec, dir = nil) # :nodoc:
     return @path if spec == @spec
     raise Gem::Exception, "Unable to download '#{spec.full_name}'"
   end
 
-  def pretty_print q # :nodoc:
-    q.group 2, '[SpecificFile:', ']' do
+  def pretty_print(q) # :nodoc:
+    q.group 2, "[SpecificFile:", "]" do
       q.breakable
       q.text @path
     end
@@ -59,7 +58,7 @@ class Gem::Source::SpecificFile < Gem::Source
   #
   # Otherwise Gem::Source#<=> is used.
 
-  def <=> other
+  def <=>(other)
     case other
     when Gem::Source::SpecificFile then
       return nil if @spec.name != other.spec.name
@@ -69,5 +68,4 @@ class Gem::Source::SpecificFile < Gem::Source
       super
     end
   end
-
 end

data/lib/rubygems/source/vendor.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
+
 ##
 # This represents a vendored source that is similar to an installed gem.
 
 class Gem::Source::Vendor < Gem::Source::Installed
-
   ##
   # Creates a new Vendor source for a gem that was unpacked at +path+.
 
-  def initialize path
+  def initialize(path)
     @uri = path
   end
 
-  def <=> other
+  def <=>(other)
     case other
     when Gem::Source::Lock then
       -1
@@ -19,10 +19,6 @@ class Gem::Source::Vendor < Gem::Source::Installed
       0
     when Gem::Source then
       1
-    else
-      nil
     end
   end
-
 end
-

data/lib/rubygems/source.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
-require 'uri'
-require 'fileutils'
 
+require_relative "text"
 ##
 # A Source knows how to list and fetch gems from a RubyGems marshal index.
 #
@@ -9,14 +8,14 @@ require 'fileutils'
 # bundler dependency API and so-forth.
 
 class Gem::Source
-
   include Comparable
+  include Gem::Text
 
   FILES = { # :nodoc:
-    :released   => 'specs',
-    :latest     => 'latest_specs',
-    :prerelease => 'prerelease_specs',
-  }
+    released: "specs",
+    latest: "latest_specs",
+    prerelease: "prerelease_specs",
+  }.freeze
 
   ##
   # The URI this source will fetch gems from.
@@ -27,24 +26,9 @@ class Gem::Source
   # Creates a new Source which will use the index located at +uri+.
 
   def initialize(uri)
-    begin
-      unless uri.kind_of? URI
-        uri = URI.parse(uri.to_s)
-      end
-    rescue URI::InvalidURIError
-      raise if Gem::Source == self.class
-    end
-
-    @uri = uri
-    @api_uri = nil
-  end
-
-  ##
-  # Use an SRV record on the host to look up the true endpoint for the index.
-
-  def api_uri # :nodoc:
-    require 'rubygems/remote_fetcher'
-    @api_uri ||= Gem::RemoteFetcher.fetcher.api_endpoint uri
+    require_relative "uri"
+    @uri = Gem::Uri.parse!(uri)
+    @update_cache = nil
   end
 
   ##
@@ -60,21 +44,23 @@ class Gem::Source
          Gem::Source::Vendor then
       -1
     when Gem::Source then
-      if !@uri
+      unless @uri
         return 0 unless other.uri
         return 1
       end
 
-      return -1 if !other.uri
+      return -1 unless other.uri
 
-      @uri.to_s <=> other.uri.to_s
-    else
-      nil
+      # Returning 1 here ensures that when sorting a list of sources, the
+      # original ordering of sources supplied by the user is preserved.
+      return 1 unless @uri.to_s == other.uri.to_s
+
+      0
     end
   end
 
-  def == other # :nodoc:
-    self.class === other and @uri == other.uri
+  def ==(other) # :nodoc:
+    self.class === other && @uri == other.uri
   end
 
   alias_method :eql?, :== # :nodoc:
@@ -83,9 +69,17 @@ class Gem::Source
   # Returns a Set that can fetch specifications from this source.
 
   def dependency_resolver_set # :nodoc:
-    return Gem::Resolver::IndexSet.new self if 'file' == api_uri.scheme
+    return Gem::Resolver::IndexSet.new self if uri.scheme == "file"
 
-    bundler_api_uri = api_uri + './api/v1/dependencies'
+    fetch_uri = if uri.host == "rubygems.org"
+      index_uri = uri.dup
+      index_uri.host = "index.rubygems.org"
+      index_uri
+    else
+      uri
+    end
+
+    bundler_api_uri = enforce_trailing_slash(fetch_uri)
 
     begin
       fetcher = Gem::RemoteFetcher.fetcher
@@ -93,11 +87,7 @@ class Gem::Source
     rescue Gem::RemoteFetcher::FetchError
       Gem::Resolver::IndexSet.new self
     else
-      if response.respond_to? :uri then
-        Gem::Resolver::APISet.new response.uri
-      else
-        Gem::Resolver::APISet.new bundler_api_uri
-      end
+      Gem::Resolver::APISet.new response.uri + "./info/"
     end
   end
 
@@ -110,8 +100,7 @@ class Gem::Source
 
   def cache_dir(uri)
     # Correct for windows paths
-    escaped_path = uri.path.sub(/^\/([a-z]):\//i, '/\\1-/')
-    escaped_path.untaint
+    escaped_path = uri.path.sub(%r{^/([a-z]):/}i, '/\\1-/')
 
     File.join Gem.spec_cache_dir, "#{uri.host}%#{uri.port}", File.dirname(escaped_path)
   end
@@ -120,7 +109,8 @@ class Gem::Source
   # Returns true when it is possible and safe to update the cache directory.
 
   def update_cache?
-    @update_cache ||=
+    return @update_cache unless @update_cache.nil?
+    @update_cache =
       begin
         File.stat(Gem.user_home).uid == Process.uid
       rescue Errno::ENOENT
@@ -131,38 +121,45 @@ class Gem::Source
   ##
   # Fetches a specification for the given +name_tuple+.
 
-  def fetch_spec name_tuple
+  def fetch_spec(name_tuple)
     fetcher = Gem::RemoteFetcher.fetcher
 
     spec_file_name = name_tuple.spec_name
 
-    uri = api_uri + "#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}"
+    source_uri = enforce_trailing_slash(uri) + "#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}"
 
-    cache_dir = cache_dir uri
+    cache_dir = cache_dir source_uri
 
     local_spec = File.join cache_dir, spec_file_name
 
-    if File.exist? local_spec then
+    if File.exist? local_spec
       spec = Gem.read_binary local_spec
-      spec = Marshal.load(spec) rescue nil
+      Gem.load_safe_marshal
+      spec = begin
+               Gem::SafeMarshal.safe_load(spec)
+             rescue StandardError
+               nil
+             end
       return spec if spec
     end
 
-    uri.path << '.rz'
+    source_uri.path << ".rz"
 
-    spec = fetcher.fetch_path uri
-    spec = Gem.inflate spec
+    spec = fetcher.fetch_path source_uri
+    spec = Gem::Util.inflate spec
 
-    if update_cache? then
+    if update_cache?
+      require "fileutils"
       FileUtils.mkdir_p cache_dir
 
-      open local_spec, 'wb' do |io|
+      File.open local_spec, "wb" do |io|
         io.write spec
       end
     end
 
+    Gem.load_safe_marshal
     # TODO: Investigate setting Gem::Specification#loaded_from to a URI
-    Marshal.load spec
+    Gem::SafeMarshal.safe_load spec
   end
 
   ##
@@ -180,17 +177,21 @@ class Gem::Source
     file       = FILES[type]
     fetcher    = Gem::RemoteFetcher.fetcher
     file_name  = "#{file}.#{Gem.marshal_version}"
-    spec_path  = api_uri + "#{file_name}.gz"
+    spec_path  = enforce_trailing_slash(uri) + "#{file_name}.gz"
     cache_dir  = cache_dir spec_path
     local_file = File.join(cache_dir, file_name)
     retried    = false
 
-    FileUtils.mkdir_p cache_dir if update_cache?
+    if update_cache?
+      require "fileutils"
+      FileUtils.mkdir_p cache_dir
+    end
 
     spec_dump = fetcher.cache_update_path spec_path, local_file, update_cache?
 
+    Gem.load_safe_marshal
     begin
-      Gem::NameTuple.from_list Marshal.load(spec_dump)
+      Gem::NameTuple.from_list Gem::SafeMarshal.safe_load(spec_dump)
     rescue ArgumentError
       if update_cache? && !retried
         FileUtils.rm local_file
@@ -208,28 +209,37 @@ class Gem::Source
 
   def download(spec, dir=Dir.pwd)
     fetcher = Gem::RemoteFetcher.fetcher
-    fetcher.download spec, api_uri.to_s, dir
+    fetcher.download spec, uri.to_s, dir
   end
 
-  def pretty_print q # :nodoc:
-    q.group 2, '[Remote:', ']' do
+  def pretty_print(q) # :nodoc:
+    q.group 2, "[Remote:", "]" do
       q.breakable
       q.text @uri.to_s
 
-      if api = api_uri
+      if api = uri
         q.breakable
-        q.text 'API URI: '
+        q.text "API URI: "
         q.text api.to_s
       end
     end
   end
 
-end
+  def typo_squatting?(host, distance_threshold=4)
+    return if @uri.host.nil?
+    levenshtein_distance(@uri.host, host).between? 1, distance_threshold
+  end
+
+  private
 
-require 'rubygems/source/git'
-require 'rubygems/source/installed'
-require 'rubygems/source/specific_file'
-require 'rubygems/source/local'
-require 'rubygems/source/lock'
-require 'rubygems/source/vendor'
+  def enforce_trailing_slash(uri)
+    uri.merge(uri.path.gsub(%r{/+$}, "") + "/")
+  end
+end
 
+require_relative "source/git"
+require_relative "source/installed"
+require_relative "source/specific_file"
+require_relative "source/local"
+require_relative "source/lock"
+require_relative "source/vendor"

data/lib/rubygems/source_list.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'rubygems/source'
 
 ##
 # The SourceList represents the sources rubygems has been configured to use.
@@ -15,7 +14,6 @@ require 'rubygems/source'
 # The most common way to get a SourceList is Gem.sources.
 
 class Gem::SourceList
-
   include Enumerable
 
   ##
@@ -38,7 +36,7 @@ class Gem::SourceList
 
     list.replace ary
 
-    return list
+    list
   end
 
   def initialize_copy(other) # :nodoc:
@@ -51,13 +49,11 @@ class Gem::SourceList
 
   def <<(obj)
     src = case obj
-          when URI
-            Gem::Source.new(obj)
           when Gem::Source
             obj
           else
-            Gem::Source.new(URI.parse(obj))
-          end
+            Gem::Source.new(obj)
+    end
 
     @sources << src unless @sources.include?(src)
     src
@@ -88,7 +84,7 @@ class Gem::SourceList
   # Yields each source URI in the list.
 
   def each
-    @sources.each { |s| yield s.uri.to_s }
+    @sources.each {|s| yield s.uri.to_s }
   end
 
   ##
@@ -105,7 +101,7 @@ class Gem::SourceList
     @sources.empty?
   end
 
-  def == other # :nodoc:
+  def ==(other) # :nodoc:
     to_a == other
   end
 
@@ -113,7 +109,7 @@ class Gem::SourceList
   # Returns an Array of source URI Strings.
 
   def to_a
-    @sources.map { |x| x.uri.to_s }
+    @sources.map {|x| x.uri.to_s }
   end
 
   alias_method :to_ary, :to_a
@@ -130,21 +126,21 @@ class Gem::SourceList
   # Gem::Source or a source URI.
 
   def include?(other)
-    if other.kind_of? Gem::Source
+    if other.is_a? Gem::Source
       @sources.include? other
     else
-      @sources.find { |x| x.uri.to_s == other.to_s }
+      @sources.find {|x| x.uri.to_s == other.to_s }
     end
   end
 
   ##
   # Deletes +source+ from the source list which may be a Gem::Source or a URI.
 
-  def delete source
-    if source.kind_of? Gem::Source
+  def delete(source)
+    if source.is_a? Gem::Source
       @sources.delete source
     else
-      @sources.delete_if { |x| x.uri.to_s == source.to_s }
+      @sources.delete_if {|x| x.uri.to_s == source.to_s }
     end
   end
 end