rubygems-update 2.6.11 → 2.7.11

data/test/rubygems/test_gem_gemcutter_utilities.rb

@@ -31,7 +31,7 @@ class TestGemGemcutterUtilities < Gem::TestCase
 
     FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
 
-    open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, 'w' do |f|
       f.write keys.to_yaml
     end
 
@@ -46,7 +46,7 @@ class TestGemGemcutterUtilities < Gem::TestCase
     keys = { :rubygems_api_key => 'KEY' }
     FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
 
-    open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, 'w' do |f|
       f.write keys.to_yaml
     end
 
@@ -59,7 +59,7 @@ class TestGemGemcutterUtilities < Gem::TestCase
     keys = { :rubygems_api_key => 'KEY', :other => 'OTHER' }
     FileUtils.mkdir_p File.dirname Gem.configuration.credentials_path
 
-    open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, 'w' do |f|
       f.write keys.to_yaml
     end
 
@@ -163,7 +163,7 @@ class TestGemGemcutterUtilities < Gem::TestCase
     other_api_key = 'f46dbb18bb6a9c97cdc61b5b85c186a17403cdcbf'
 
     FileUtils.mkdir_p File.dirname(Gem.configuration.credentials_path)
-    open Gem.configuration.credentials_path, 'w' do |f|
+    File.open Gem.configuration.credentials_path, 'w' do |f|
       f.write Hash[:other_api_key, other_api_key].to_yaml
     end
     util_sign_in [api_key, 200, 'OK']

data/test/rubygems/test_gem_indexer.rb

@@ -39,8 +39,7 @@ class TestGemIndexer < Gem::TestCase
 
   def test_initialize
     assert_equal @tempdir, @indexer.dest_directory
-    assert_equal File.join(Dir.tmpdir, "gem_generate_index_#{$$}"),
-                 @indexer.directory
+    assert_match %r{#{Dir.mktmpdir('gem_generate_index').match(/.*-/)}}, @indexer.directory
 
     indexer = Gem::Indexer.new @tempdir
     assert indexer.build_modern

data/test/rubygems/test_gem_install_update_options.rb

@@ -119,11 +119,14 @@ class TestGemInstallUpdateOptions < Gem::InstallerTestCase
   end
 
   def test_security_policy_unknown
+    skip 'openssl is missing' unless defined?(OpenSSL::SSL)
+
     @cmd.add_install_update_options
 
-    assert_raises OptionParser::InvalidArgument do
+    e = assert_raises OptionParser::InvalidArgument do
       @cmd.handle_options %w[-P UnknownSecurity]
     end
+    assert_includes e.message, "UnknownSecurity"
   end
 
   def test_user_install_enabled
@@ -140,6 +143,8 @@ class TestGemInstallUpdateOptions < Gem::InstallerTestCase
   def test_user_install_disabled_read_only
     if win_platform?
       skip('test_user_install_disabled_read_only test skipped on MS Windows')
+    elsif Process.uid.zero?
+      skip('test_user_install_disabled_read_only test skipped in root privilege')
     else
       @cmd.handle_options %w[--no-user-install]
 

data/test/rubygems/test_gem_installer.rb

@@ -21,7 +21,7 @@ class TestGemInstaller < Gem::InstallerTestCase
     super
     common_installer_setup
 
-    if __name__ =~ /^test_install(_|$)/ then
+    if (self.class.method_defined?(:__name__) ? __name__ : name) =~ /\Atest_install(_|\Z)/
       FileUtils.rm_r @spec.gem_dir
       FileUtils.rm_r @user_spec.gem_dir
     end
@@ -34,7 +34,7 @@ class TestGemInstaller < Gem::InstallerTestCase
 
     super
 
-    Gem.configuration = @config
+    Gem.configuration = instance_variable_defined?(:@config) ? @config : nil
   end
 
   def test_app_script_text
@@ -62,7 +62,12 @@ if ARGV.first
   end
 end
 
+if Gem.respond_to?(:activate_bin_path)
 load Gem.activate_bin_path('a', 'executable', version)
+else
+gem "a", version
+load Gem.bin_path("a", "executable", version)
+end
     EOF
 
     wrapper = @installer.app_script_text 'executable'
@@ -82,7 +87,7 @@ load Gem.activate_bin_path('a', 'executable', version)
     end
 
     util_make_exec
-    @installer.gem_dir = util_gem_dir @spec
+    @installer.gem_dir = @spec.gem_dir
     @installer.wrappers = true
     @installer.generate_bin
 
@@ -135,7 +140,7 @@ load Gem.activate_bin_path('a', 'executable', version)
       s.require_path = 'lib'
     end
 
-    open File.join(util_inst_bindir, 'executable'), 'w' do |io|
+    File.open File.join(util_inst_bindir, 'executable'), 'w' do |io|
      io.write <<-EXEC
 #!/usr/local/bin/ruby
 #
@@ -299,7 +304,7 @@ gem 'other', version
   def test_extract_files
     @installer.extract_files
 
-    assert_path_exists File.join util_gem_dir, 'bin/executable'
+    assert_path_exists File.join @spec.gem_dir, 'bin/executable'
   end
 
   def test_generate_bin_bindir
@@ -309,12 +314,12 @@ gem 'other', version
     @spec.bindir = '.'
 
     exec_file = @installer.formatted_program_filename 'executable'
-    exec_path = File.join util_gem_dir(@spec), exec_file
+    exec_path = File.join @spec.gem_dir, exec_file
     File.open exec_path, 'w' do |f|
       f.puts '#!/usr/bin/ruby'
     end
 
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
 
@@ -350,7 +355,7 @@ gem 'other', version
   def test_generate_bin_script
     @installer.wrappers = true
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
     assert File.directory? util_inst_bindir
@@ -366,7 +371,7 @@ gem 'other', version
     @installer.format_executable = true
     @installer.wrappers = true
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     Gem::Installer.exec_format = 'foo-%s-bar'
     @installer.generate_bin
@@ -380,7 +385,7 @@ gem 'other', version
   def test_generate_bin_script_format_disabled
     @installer.wrappers = true
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     Gem::Installer.exec_format = 'foo-%s-bar'
     @installer.generate_bin
@@ -432,6 +437,8 @@ gem 'other', version
 
     if win_platform?
       skip('test_generate_bin_script_no_perms skipped on MS Windows')
+    elsif Process.uid.zero?
+      skip('test_generate_bin_script_no_perms skipped in root privilege')
     else
       FileUtils.chmod 0000, util_inst_bindir
 
@@ -469,10 +476,10 @@ gem 'other', version
   def test_generate_bin_script_wrappers
     @installer.wrappers = true
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
     installed_exec = File.join(util_inst_bindir, 'executable')
 
-    real_exec = File.join util_gem_dir, 'bin', 'executable'
+    real_exec = File.join @spec.gem_dir, 'bin', 'executable'
 
     # fake --no-wrappers for previous install
     unless Gem.win_platform? then
@@ -496,13 +503,13 @@ gem 'other', version
 
     @installer.wrappers = false
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
     assert_equal true, File.directory?(util_inst_bindir)
     installed_exec = File.join util_inst_bindir, 'executable'
     assert_equal true, File.symlink?(installed_exec)
-    assert_equal(File.join(util_gem_dir, 'bin', 'executable'),
+    assert_equal(File.join(@spec.gem_dir, 'bin', 'executable'),
                  File.readlink(installed_exec))
   end
 
@@ -518,12 +525,14 @@ gem 'other', version
   def test_generate_bin_symlink_no_perms
     @installer.wrappers = false
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     Dir.mkdir util_inst_bindir
 
     if win_platform?
       skip('test_generate_bin_symlink_no_perms skipped on MS Windows')
+    elsif Process.uid.zero?
+      skip('test_user_install_disabled_read_only test skipped in root privilege')
     else
       FileUtils.chmod 0000, util_inst_bindir
 
@@ -540,11 +549,11 @@ gem 'other', version
 
     @installer.wrappers = false
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
     installed_exec = File.join(util_inst_bindir, 'executable')
-    assert_equal(File.join(util_gem_dir, 'bin', 'executable'),
+    assert_equal(File.join(@spec.gem_dir, 'bin', 'executable'),
                  File.readlink(installed_exec))
 
     @spec = Gem::Specification.new do |s|
@@ -557,7 +566,7 @@ gem 'other', version
     end
 
     util_make_exec
-    @installer.gem_dir = util_gem_dir @spec
+    @installer.gem_dir = @spec.gem_dir
     @installer.generate_bin
     installed_exec = File.join(util_inst_bindir, 'executable')
     assert_equal(@spec.bin_file('executable'),
@@ -570,11 +579,11 @@ gem 'other', version
 
     @installer.wrappers = false
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
     installed_exec = File.join(util_inst_bindir, 'executable')
-    assert_equal(File.join(util_gem_dir, 'bin', 'executable'),
+    assert_equal(File.join(@spec.gem_dir, 'bin', 'executable'),
                  File.readlink(installed_exec))
 
     spec = Gem::Specification.new do |s|
@@ -590,12 +599,12 @@ gem 'other', version
     one = @spec.dup
     one.version = 1
     @installer = Gem::Installer.for_spec spec
-    @installer.gem_dir = util_gem_dir one
+    @installer.gem_dir = one.gem_dir
 
     @installer.generate_bin
 
     installed_exec = File.join util_inst_bindir, 'executable'
-    expected = File.join util_gem_dir, 'bin', 'executable'
+    expected = File.join @spec.gem_dir, 'bin', 'executable'
     assert_equal(expected,
                  File.readlink(installed_exec),
                  "Ensure symlink not moved")
@@ -606,7 +615,7 @@ gem 'other', version
 
     @installer.wrappers = true
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
 
@@ -625,7 +634,7 @@ gem 'other', version
 
     util_installer @spec, @gemhome
     @installer.wrappers = false
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     @installer.generate_bin
 
@@ -643,7 +652,7 @@ gem 'other', version
     File.const_set(:ALT_SEPARATOR, '\\')
     @installer.wrappers = false
     util_make_exec
-    @installer.gem_dir = util_gem_dir
+    @installer.gem_dir = @spec.gem_dir
 
     use_ui @ui do
       @installer.generate_bin
@@ -654,7 +663,7 @@ gem 'other', version
     assert_path_exists installed_exec
 
     if symlink_supported?
-      assert_send([File, :symlink?, installed_exec])
+      assert File.symlink?(installed_exec)
       return
     end
 
@@ -1416,10 +1425,11 @@ gem 'other', version
   def test_pre_install_checks_ruby_version
     use_ui @ui do
       installer = Gem::Installer.at old_ruby_required
-      e = assert_raises Gem::InstallError do
+      e = assert_raises Gem::RuntimeRequirementNotMetError do
         installer.pre_install_checks
       end
-      assert_equal 'old_ruby_required requires Ruby version = 1.4.6.',
+      rv = Gem.ruby_api_version
+      assert_equal "old_ruby_required requires Ruby version = 1.4.6. The current ruby version is #{rv}.",
                    e.message
     end
   end
@@ -1435,14 +1445,141 @@ gem 'other', version
 
     use_ui @ui do
       @installer = Gem::Installer.at gem
-      e = assert_raises Gem::InstallError do
+      e = assert_raises Gem::RuntimeRequirementNotMetError do
         @installer.pre_install_checks
       end
-      assert_equal 'old_rubygems_required requires RubyGems version < 0. ' +
+      rgv = Gem::VERSION
+      assert_equal "old_rubygems_required requires RubyGems version < 0. The current RubyGems version is #{rgv}. " +
         "Try 'gem update --system' to update RubyGems itself.", e.message
     end
   end
 
+  def test_pre_install_checks_malicious_name
+    spec = util_spec '../malicious', '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate; end
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal '#<Gem::Specification name=../malicious version=1> has an invalid name', e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_name_before_eval
+    spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message
+    end
+    refute defined?(::Object::FROM_EVAL)
+  end
+
+  def test_pre_install_checks_malicious_require_paths_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.require_paths = ["malicious\n``"]
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_extensions_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.extensions = ["malicious\n``"]
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_specification_version_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.specification_version = "malicious\n``"
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_dependencies_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.add_dependency "b\nfoo", '> 5'
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      @installer.ignore_dependencies = true
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message
+    end
+  end
+
   def test_shebang
     util_make_exec @spec, "#!/usr/bin/ruby"
 
@@ -1714,7 +1851,7 @@ gem 'other', version
 
     @installer.wrappers = true
     @installer.options[:install_as_default] = true
-    @installer.gem_dir = util_gem_dir @spec
+    @installer.gem_dir = @spec.gem_dir
     @installer.generate_bin
 
     use_ui @ui do