rubygems-update 2.6.11 → 2.7.11

data/lib/rubygems/safe_yaml.rb

@@ -0,0 +1,51 @@
+module Gem
+
+  ###
+  # This module is used for safely loading YAML specs from a gem.  The
+  # `safe_load` method defined on this module is specifically designed for
+  # loading Gem specifications.  For loading other YAML safely, please see
+  # Psych.safe_load
+
+  module SafeYAML
+    WHITELISTED_CLASSES = %w(
+      Symbol
+      Time
+      Date
+      Gem::Dependency
+      Gem::Platform
+      Gem::Requirement
+      Gem::Specification
+      Gem::Version
+      Gem::Version::Requirement
+      YAML::Syck::DefaultKey
+      Syck::DefaultKey
+    )
+
+    WHITELISTED_SYMBOLS = %w(
+      development
+      runtime
+    )
+
+    if ::YAML.respond_to? :safe_load
+      def self.safe_load input
+        ::YAML.safe_load(input, WHITELISTED_CLASSES, WHITELISTED_SYMBOLS, true)
+      end
+
+      def self.load input
+        ::YAML.safe_load(input, [::Symbol])
+      end
+    else
+      unless Gem::Deprecate.skip
+        warn "YAML safe loading is not available. Please upgrade psych to a version that supports safe loading (>= 2.0)."
+      end
+
+      def self.safe_load input, *args
+        ::YAML.load input
+      end
+
+      def self.load input
+        ::YAML.load input
+      end
+    end
+  end
+end

data/lib/rubygems/security.rb

@@ -340,16 +340,23 @@ module Gem::Security
   # Digest algorithm used to sign gems
 
   DIGEST_ALGORITHM =
-    if defined?(OpenSSL::Digest::SHA1) then
+    if defined?(OpenSSL::Digest::SHA256) then
+      OpenSSL::Digest::SHA256
+    elsif defined?(OpenSSL::Digest::SHA1) then
       OpenSSL::Digest::SHA1
+    else
+      require 'digest'
+      Digest::SHA512
     end
 
   ##
   # Used internally to select the signing digest from all computed digests
 
   DIGEST_NAME = # :nodoc:
-    if DIGEST_ALGORITHM then
+    if DIGEST_ALGORITHM.method_defined? :name then
       DIGEST_ALGORITHM.new.name
+    else
+      DIGEST_ALGORITHM.name[/::([^:]+)\z/, 1]
     end
 
   ##
@@ -363,7 +370,7 @@ module Gem::Security
   ##
   # Length of keys created by KEY_ALGORITHM
 
-  KEY_LENGTH = 2048
+  KEY_LENGTH = 3072
 
   ##
   # Cipher used to encrypt the key pair used to sign gems.
@@ -371,10 +378,15 @@ module Gem::Security
 
   KEY_CIPHER = OpenSSL::Cipher.new('AES-256-CBC') if defined?(OpenSSL::Cipher)
 
+  ##
+  # One day in seconds
+
+  ONE_DAY = 86400
+
   ##
   # One year in seconds
 
-  ONE_YEAR = 86400 * 365
+  ONE_YEAR = ONE_DAY * 365
 
   ##
   # The default set of extensions are:
@@ -455,7 +467,7 @@ module Gem::Security
 
   ##
   # Creates a new key pair of the specified +length+ and +algorithm+.  The
-  # default is a 2048 bit RSA key.
+  # default is a 3072 bit RSA key.
 
   def self.create_key length = KEY_LENGTH, algorithm = KEY_ALGORITHM
     algorithm.new length
@@ -571,7 +583,7 @@ module Gem::Security
   def self.write pemmable, path, permissions = 0600, passphrase = nil, cipher = KEY_CIPHER
     path = File.expand_path path
 
-    open path, 'wb', permissions do |io|
+    File.open path, 'wb', permissions do |io|
       if passphrase and cipher
         io.write pemmable.to_pem cipher, passphrase
       else

data/lib/rubygems/security/trust_dir.rb

@@ -93,7 +93,7 @@ class Gem::Security::TrustDir
 
     destination = cert_path certificate
 
-    open destination, 'wb', @permissions[:trusted_cert] do |io|
+    File.open destination, 'wb', @permissions[:trusted_cert] do |io|
       io.write certificate.to_pem
     end
   end

data/lib/rubygems/security_option.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+#--
+# Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
+# All rights reserved.
+# See LICENSE.txt for permissions.
+#++
+
+require 'rubygems'
+
+# forward-declare
+
+module Gem::Security # :nodoc:
+  class Policy # :nodoc:
+  end
+end
+
+##
+# Mixin methods for security option for Gem::Commands
+
+module Gem::SecurityOption
+  def add_security_option
+    # TODO: use @parser.accept
+    OptionParser.accept Gem::Security::Policy do |value|
+      require 'rubygems/security'
+
+      raise OptionParser::InvalidArgument, 'OpenSSL not installed' unless
+        defined?(Gem::Security::HighSecurity)
+
+      policy = Gem::Security::Policies[value]
+      unless policy
+        valid = Gem::Security::Policies.keys.sort
+        raise OptionParser::InvalidArgument, "#{value} (#{valid.join ', '} are valid)"
+      end
+      policy
+    end
+
+    add_option(:"Install/Update", '-P', '--trust-policy POLICY',
+               Gem::Security::Policy,
+               'Specify gem trust policy') do |value, options|
+      options[:security_policy] = value
+    end
+  end
+end

data/lib/rubygems/server.rb

@@ -492,7 +492,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     specs = Marshal.dump specs
 
     if req.path =~ /\.gz$/ then
-      specs = Gem.gzip specs
+      specs = Gem::Util.gzip specs
       res['content-type'] = 'application/x-gzip'
     else
       res['content-type'] = 'application/octet-stream'
@@ -553,7 +553,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     specs = Marshal.dump specs
 
     if req.path =~ /\.gz$/ then
-      specs = Gem.gzip specs
+      specs = Gem::Util.gzip specs
       res['content-type'] = 'application/x-gzip'
     else
       res['content-type'] = 'application/octet-stream'
@@ -573,19 +573,11 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     add_date res
 
     case req.request_uri.path
-    when %r|^/quick/(Marshal.#{Regexp.escape Gem.marshal_version}/)?(.*?)-([0-9.]+[^-]*?)(-.*?)?\.gemspec\.rz$| then
-      marshal_format, name, version, platform = $1, $2, $3, $4
-      specs = Gem::Specification.find_all_by_name name, version
+    when %r|^/quick/(Marshal.#{Regexp.escape Gem.marshal_version}/)?(.*?)\.gemspec\.rz$| then
+      marshal_format, full_name = $1, $2
+      specs = Gem::Specification.find_all_by_full_name(full_name)
 
-      selector = [name, version, platform].map(&:inspect).join ' '
-
-      platform = if platform then
-                   Gem::Platform.new platform.sub(/^-/, '')
-                 else
-                   Gem::Platform::RUBY
-                 end
-
-      specs = specs.select { |s| s.platform == platform }
+      selector = full_name.inspect
 
       if specs.empty? then
         res.status = 404
@@ -631,6 +623,18 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
       executables = nil if executables.empty?
       executables.last["is_last"] = true if executables
 
+      # Pre-process spec homepage for safety reasons
+      begin
+        homepage_uri = URI.parse(spec.homepage)
+        if [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+          homepage_uri = spec.homepage
+        else
+          homepage_uri = "."
+        end
+      rescue URI::InvalidURIError
+        homepage_uri = "."
+      end
+
       specs << {
         "authors"             => spec.authors.sort.join(", "),
         "date"                => spec.date.to_s,
@@ -640,7 +644,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
         "only_one_executable" => (executables && executables.size == 1),
         "full_name"           => spec.full_name,
         "has_deps"            => !deps.empty?,
-        "homepage"            => spec.homepage,
+        "homepage"            => homepage_uri,
         "name"                => spec.name,
         "rdoc_installed"      => Gem::RDoc.new(spec).rdoc_installed?,
         "ri_installed"        => Gem::RDoc.new(spec).ri_installed?,
@@ -657,7 +661,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
       "only_one_executable" => true,
       "full_name" => "rubygems-#{Gem::VERSION}",
       "has_deps" => false,
-      "homepage" => "http://docs.rubygems.org/",
+      "homepage" => "http://guides.rubygems.org/",
       "name" => 'rubygems',
       "ri_installed" => true,
       "summary" => "RubyGems itself",
@@ -848,7 +852,7 @@ div.method-source-code pre { color: #ffdead; overflow: hidden; }
     specs = Marshal.dump specs
 
     if req.path =~ /\.gz$/ then
-      specs = Gem.gzip specs
+      specs = Gem::Util.gzip specs
       res['content-type'] = 'application/x-gzip'
     else
       res['content-type'] = 'application/octet-stream'

data/lib/rubygems/source.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
-require 'uri'
-require 'fileutils'
+autoload :FileUtils, 'fileutils'
+autoload :URI, 'uri'
 
 ##
 # A Source knows how to list and fetch gems from a RubyGems marshal index.
@@ -67,7 +67,11 @@ class Gem::Source
 
       return -1 if !other.uri
 
-      @uri.to_s <=> other.uri.to_s
+      # Returning 1 here ensures that when sorting a list of sources, the
+      # original ordering of sources supplied by the user is preserved.
+      return 1 unless @uri.to_s == other.uri.to_s
+
+      0
     else
       nil
     end
@@ -151,12 +155,12 @@ class Gem::Source
     uri.path << '.rz'
 
     spec = fetcher.fetch_path uri
-    spec = Gem.inflate spec
+    spec = Gem::Util.inflate spec
 
     if update_cache? then
       FileUtils.mkdir_p cache_dir
 
-      open local_spec, 'wb' do |io|
+      File.open local_spec, 'wb' do |io|
         io.write spec
       end
     end
@@ -232,4 +236,3 @@ require 'rubygems/source/specific_file'
 require 'rubygems/source/local'
 require 'rubygems/source/lock'
 require 'rubygems/source/vendor'
-

data/lib/rubygems/source/git.rb

@@ -1,5 +1,4 @@
 # frozen_string_literal: true
-require 'digest'
 require 'rubygems/util'
 
 ##
@@ -226,6 +225,8 @@ class Gem::Source::Git < Gem::Source
   # A hash for the git gem based on the git repository URI.
 
   def uri_hash # :nodoc:
+    require 'digest' # required here to avoid deadlocking in Gem.activate_bin_path (because digest is a gem on 2.5+)
+
     normalized =
       if @repository =~ %r%^\w+://(\w+@)?% then
         uri = URI(@repository).normalize.to_s.sub %r%/$%,''

data/lib/rubygems/source/local.rb

@@ -9,6 +9,7 @@ class Gem::Source::Local < Gem::Source
     @specs   = nil
     @api_uri = nil
     @uri     = nil
+    @load_specs_names = {}
   end
 
   ##
@@ -34,45 +35,47 @@ class Gem::Source::Local < Gem::Source
   end
 
   def load_specs type # :nodoc:
-    names = []
-
-    @specs = {}
-
-    Dir["*.gem"].each do |file|
-      begin
-        pkg = Gem::Package.new(file)
-      rescue SystemCallError, Gem::Package::FormatError
-        # ignore
-      else
-        tup = pkg.spec.name_tuple
-        @specs[tup] = [File.expand_path(file), pkg]
-
-        case type
-        when :released
-          unless pkg.spec.version.prerelease?
-            names << pkg.spec.name_tuple
-          end
-        when :prerelease
-          if pkg.spec.version.prerelease?
-            names << pkg.spec.name_tuple
-          end
-        when :latest
-          tup = pkg.spec.name_tuple
+    @load_specs_names[type] ||= begin
+      names = []
 
-          cur = names.find { |x| x.name == tup.name }
-          if !cur
-            names << tup
-          elsif cur.version < tup.version
-            names.delete cur
-            names << tup
-          end
+      @specs = {}
+
+      Dir["*.gem"].each do |file|
+        begin
+          pkg = Gem::Package.new(file)
+        rescue SystemCallError, Gem::Package::FormatError
+          # ignore
         else
-          names << pkg.spec.name_tuple
+          tup = pkg.spec.name_tuple
+          @specs[tup] = [File.expand_path(file), pkg]
+
+          case type
+          when :released
+            unless pkg.spec.version.prerelease?
+              names << pkg.spec.name_tuple
+            end
+          when :prerelease
+            if pkg.spec.version.prerelease?
+              names << pkg.spec.name_tuple
+            end
+          when :latest
+            tup = pkg.spec.name_tuple
+
+            cur = names.find { |x| x.name == tup.name }
+            if !cur
+              names << tup
+            elsif cur.version < tup.version
+              names.delete cur
+              names << tup
+            end
+          else
+            names << pkg.spec.name_tuple
+          end
         end
       end
-    end
 
-    names
+      names
+    end
   end
 
   def find_gem gem_name, version = Gem::Requirement.default, # :nodoc:
@@ -88,7 +91,7 @@ class Gem::Source::Local < Gem::Source
         if version.satisfied_by?(s.version)
           if prerelease
             found << s
-          elsif !s.version.prerelease?
+          elsif !s.version.prerelease? || version.prerelease?
             found << s
           end
         end

data/lib/rubygems/source/lock.rb

@@ -34,6 +34,10 @@ class Gem::Source::Lock < Gem::Source
     0 == (self <=> other)
   end
 
+  def hash # :nodoc:
+    @wrapped.hash ^ 3
+  end
+
   ##
   # Delegates to the wrapped source's fetch_spec method.
 
@@ -46,4 +50,3 @@ class Gem::Source::Lock < Gem::Source
   end
 
 end
-

data/lib/rubygems/source_local.rb

@@ -2,5 +2,7 @@
 require 'rubygems/source'
 require 'rubygems/source_local'
 
-# TODO warn upon require, this file is deprecated.
+unless Gem::Deprecate.skip
+  Kernel.warn "#{Gem.location_of_caller(3).join(':')}: Warning: Requiring rubygems/source_local is deprecated; please use rubygems/source/local instead."
+end
 

data/lib/rubygems/source_specific_file.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 require 'rubygems/source/specific_file'
 
-# TODO warn upon require, this file is deprecated.
-
+unless Gem::Deprecate.skip
+  Kernel.warn "#{Gem.location_of_caller(3).join(':')}: Warning: Requiring rubygems/source_specific_file is deprecated; please use rubygems/source/specific_file instead."
+end