rubygems-update 2.6.3 → 2.7.7

data/test/rubygems/test_gem_server.rb

@@ -100,7 +100,7 @@ class TestGemServer < Gem::TestCase
     specs_dir = File.join dir, 'specifications'
     FileUtils.mkdir_p specs_dir
 
-    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+    File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
       io.write spec.to_ruby
     end
 
@@ -127,7 +127,7 @@ class TestGemServer < Gem::TestCase
     assert_match %r| \d\d:\d\d:\d\d |, @res['date']
     assert_equal 'application/x-gzip', @res['content-type']
     assert_equal [['a', Gem::Version.new(2), Gem::Platform::RUBY]],
-                 Marshal.load(Gem.gunzip(@res.body))
+                 Marshal.load(Gem::Util.gunzip(@res.body))
   end
 
   def test_listen
@@ -177,7 +177,7 @@ class TestGemServer < Gem::TestCase
     assert_match %r| \d\d:\d\d:\d\d |, @res['date']
     assert_equal 'application/x-gzip', @res['content-type']
     assert_equal [['a', v('3.a'), Gem::Platform::RUBY]],
-                 Marshal.load(Gem.gunzip(@res.body))
+                 Marshal.load(Gem::Util.gunzip(@res.body))
   end
 
   def test_quick_gemdirs
@@ -198,7 +198,7 @@ class TestGemServer < Gem::TestCase
 
     FileUtils.mkdir_p specs_dir
 
-    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+    File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
       io.write spec.to_ruby
     end
 
@@ -222,7 +222,7 @@ class TestGemServer < Gem::TestCase
     assert_equal 404, @res.status, @res.body
     assert_match %r| \d\d:\d\d:\d\d |, @res['date']
     assert_equal 'text/plain', @res['content-type']
-    assert_equal 'No gems found matching "z" "9" nil', @res.body
+    assert_equal 'No gems found matching "z-9"', @res.body
     assert_equal 404, @res.status
   end
 
@@ -236,7 +236,7 @@ class TestGemServer < Gem::TestCase
     assert @res['date']
     assert_equal 'application/x-deflate', @res['content-type']
 
-    spec = Marshal.load Gem.inflate(@res.body)
+    spec = Marshal.load Gem::Util.inflate(@res.body)
     assert_equal 'a', spec.name
     assert_equal Gem::Version.new(1), spec.version
   end
@@ -253,7 +253,7 @@ class TestGemServer < Gem::TestCase
     assert @res['date']
     assert_equal 'application/x-deflate', @res['content-type']
 
-    spec = Marshal.load Gem.inflate(@res.body)
+    spec = Marshal.load Gem::Util.inflate(@res.body)
     assert_equal 'a', spec.name
     assert_equal Gem::Version.new(1), spec.version
     assert_equal Gem::Platform.local, spec.platform
@@ -269,7 +269,7 @@ class TestGemServer < Gem::TestCase
     assert @res['date']
     assert_equal 'application/x-deflate', @res['content-type']
 
-    spec = Marshal.load Gem.inflate(@res.body)
+    spec = Marshal.load Gem::Util.inflate(@res.body)
     assert_equal 'a', spec.name
     assert_equal v('3.a'), spec.version
   end
@@ -286,11 +286,28 @@ class TestGemServer < Gem::TestCase
     assert @res['date']
     assert_equal 'application/x-deflate', @res['content-type']
 
-    spec = Marshal.load Gem.inflate(@res.body)
+    spec = Marshal.load Gem::Util.inflate(@res.body)
     assert_equal 'a-b', spec.name
     assert_equal v('3.a'), spec.version
   end
 
+  def test_quick_marshal_a_b_1_3_a_gemspec_rz
+    quick_gem 'a-b-1', '3.a'
+
+    data = StringIO.new "GET /quick/Marshal.#{Gem.marshal_version}/a-b-1-3.a.gemspec.rz HTTP/1.0\r\n\r\n"
+    @req.parse data
+
+    @server.quick @req, @res
+
+    assert_equal 200, @res.status, @res.body
+    assert @res['date']
+    assert_equal 'application/x-deflate', @res['content-type']
+
+    spec = Marshal.load Gem::Util.inflate(@res.body)
+    assert_equal 'a-b-1', spec.name
+    assert_equal v('3.a'), spec.version
+  end
+
   def test_rdoc
     data = StringIO.new "GET /rdoc?q=a HTTP/1.0\r\n\r\n"
     @req.parse data
@@ -322,7 +339,7 @@ class TestGemServer < Gem::TestCase
     specs_dir = File.join dir, 'specifications'
     FileUtils.mkdir_p specs_dir
 
-    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+    File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
       io.write spec.to_ruby
     end
 
@@ -336,6 +353,171 @@ class TestGemServer < Gem::TestCase
     assert_match 'z 9', @res.body
   end
 
+
+  def test_xss_homepage_fix_289313
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'xsshomepagegem', 1
+    spec.homepage = "javascript:confirm(document.domain)"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'xsshomepagegem 1', @res.body
+
+    # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a 
+    # valid HTTP/HTTPS URL and could be unsafe in an HTML context.  We would prefer to throw an exception here,
+    # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be 
+    # validated in future versions of Gem::Specification.
+    #
+    # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
+    #
+    # Variant #1 - rdoc not installed
+    #
+    #   <b>xsshomepagegem 1</b>
+    #
+    #
+    #  <span title="rdoc not installed">[rdoc]</span>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    #
+    # Variant #2 - rdoc installed
+    #
+    #   <b>xsshomepagegem 1</b>
+    #
+    #
+    #  <a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    regex_match = /xsshomepagegem 1<\/b>\s+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>)\s+<a href="\." title="\.">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
+  def test_invalid_homepage
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'invalidhomepagegem', 1
+    spec.homepage = "notavalidhomepageurl"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'invalidhomepagegem 1', @res.body
+
+    # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a 
+    # valid HTTP/HTTPS URL and could be unsafe in an HTML context.  We would prefer to throw an exception here,
+    # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be 
+    # validated in future versions of Gem::Specification.
+    #
+    # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
+    #
+    # Variant #1 - rdoc not installed
+    #
+    #   <b>invalidhomepagegem 1</b>
+    #
+    #
+    #  <span title="rdoc not installed">[rdoc]</span>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    #
+    # Variant #2 - rdoc installed
+    #
+    #   <b>invalidhomepagegem 1</b>
+    #
+    #
+    #  <a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>
+    #
+    #
+    #
+    #  <a href="." title=".">[www]</a>
+    regex_match = /invalidhomepagegem 1<\/b>\s+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>)\s+<a href="\." title="\.">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
+  def test_valid_homepage_http
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'validhomepagegemhttp', 1
+    spec.homepage = "http://rubygems.org"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'validhomepagegemhttp 1', @res.body
+
+    regex_match = /validhomepagegemhttp 1<\/b>\s+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttp-1\/">\[rdoc\]<\/a>)\s+<a href="http:\/\/rubygems\.org" title="http:\/\/rubygems\.org">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
+  def test_valid_homepage_https
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    dir = "#{@gemhome}2"
+
+    spec = util_spec 'validhomepagegemhttps', 1
+    spec.homepage = "https://rubygems.org"
+
+    specs_dir = File.join dir, 'specifications'
+    FileUtils.mkdir_p specs_dir
+
+    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+      io.write spec.to_ruby
+    end
+
+    server = Gem::Server.new dir, process_based_port, false
+
+    @req.parse data
+
+    server.root @req, @res
+
+    assert_equal 200, @res.status
+    assert_match 'validhomepagegemhttps 1', @res.body
+
+    regex_match = /validhomepagegemhttps 1<\/b>\s+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttps-1\/">\[rdoc\]<\/a>)\s+<a href="https:\/\/rubygems\.org" title="https:\/\/rubygems\.org">\[www\]<\/a>/
+    assert_match regex_match, @res.body
+  end
+
   def test_specs
     data = StringIO.new "GET /specs.#{Gem.marshal_version} HTTP/1.0\r\n\r\n"
     @req.parse data
@@ -361,7 +543,7 @@ class TestGemServer < Gem::TestCase
     specs_dir = File.join dir, 'specifications'
     FileUtils.mkdir_p specs_dir
 
-    open File.join(specs_dir, spec.spec_name), 'w' do |io|
+    File.open File.join(specs_dir, spec.spec_name), 'w' do |io|
       io.write spec.to_ruby
     end
 
@@ -389,7 +571,23 @@ class TestGemServer < Gem::TestCase
     assert_equal [['a', Gem::Version.new(1), Gem::Platform::RUBY],
                   ['a', Gem::Version.new(2), Gem::Platform::RUBY],
                   ['a', v('3.a'), Gem::Platform::RUBY]],
-                 Marshal.load(Gem.gunzip(@res.body))
+                 Marshal.load(Gem::Util.gunzip(@res.body))
+  end
+
+  def test_uri_encode
+    url_safe = @server.uri_encode 'http://rubyonrails.org/">malicious_content</a>'
+    assert_equal url_safe, 'http://rubyonrails.org/%22%3Emalicious_content%3C/a%3E'
+  end
+
+  # Regression test for issue #1793: incorrect URL encoding.
+  # Checking that no URLs have had '://' incorrectly encoded
+  def test_regression_1793
+    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
+    @req.parse data
+
+    @server.root @req, @res
+
+    refute_match %r|%3A%2F%2F|, @res.body
   end
 
   def util_listen

data/test/rubygems/test_gem_source.rb

@@ -110,7 +110,7 @@ class TestGemSource < Gem::TestCase
 
     cache_file = File.join cache_dir, a1.spec_name
 
-    open cache_file, 'wb' do |io|
+    File.open cache_file, 'wb' do |io|
       Marshal.dump a1, io
     end
 
@@ -163,7 +163,7 @@ class TestGemSource < Gem::TestCase
 
     cache_file = File.join cache_dir, "latest_specs.#{Gem.marshal_version}"
 
-    open cache_file, 'wb' do |io|
+    File.open cache_file, 'wb' do |io|
       Marshal.dump latest_specs, io
     end
 
@@ -187,7 +187,7 @@ class TestGemSource < Gem::TestCase
 
     cache_file = File.join cache_dir, "latest_specs.#{Gem.marshal_version}"
 
-    open cache_file, 'wb' do |io|
+    File.open cache_file, 'wb' do |io|
       # Setup invalid data in the cache:
       io.write Marshal.dump(latest_specs)[0, 10]
     end
@@ -228,6 +228,15 @@ class TestGemSource < Gem::TestCase
     assert_equal(-1, remote.   <=>(no_uri),    'remote <=> no_uri')
   end
 
+  def test_spaceship_order_is_preserved_when_uri_differs
+    sourceA = Gem::Source.new "http://example.com/a"
+    sourceB = Gem::Source.new "http://example.com/b"
+
+    assert_equal( 0, sourceA. <=>(sourceA), 'sourceA <=> sourceA')
+    assert_equal( 1, sourceA. <=>(sourceB), 'sourceA <=> sourceB')
+    assert_equal( 1, sourceB. <=>(sourceA), 'sourceB <=> sourceA')
+  end
+
   def test_update_cache_eh
     assert @source.update_cache?
   end

data/test/rubygems/test_gem_source_fetch_problem.rb

@@ -16,5 +16,13 @@ class TestGemSourceFetchProblem < Gem::TestCase
     assert_equal 'test', e.message
   end
 
+  def test_password_redacted
+    source = Gem::Source.new 'https://username:secret@gemsource.com'
+    error  = RuntimeError.new 'test'
+
+    sf = Gem::SourceFetchProblem.new source, error
+
+    refute_match sf.wordy, 'secret'
+  end
 end
 

data/test/rubygems/test_gem_source_git.rb

@@ -229,7 +229,7 @@ class TestGemSourceGit < Gem::TestCase
       Dir.chdir 'b' do
         b = Gem::Specification.new 'b', 1
 
-        open 'b.gemspec', 'w' do |io|
+        File.open 'b.gemspec', 'w' do |io|
           io.write b.to_ruby
         end
 

data/test/rubygems/test_gem_spec_fetcher.rb

@@ -169,6 +169,26 @@ class TestGemSpecFetcher < Gem::TestCase
     assert_equal "bad news from the internet (#{@gem_repo})", sfp.error.message
   end
 
+  def test_suggest_gems_from_name_latest
+    spec_fetcher do|fetcher|
+      fetcher.spec 'example', 1
+      fetcher.spec 'other-example', 1
+    end
+
+    suggestions = @sf.suggest_gems_from_name('examplw')
+    assert_equal ['example'], suggestions
+  end
+
+  def test_suggest_gems_from_name_prerelease
+    spec_fetcher do|fetcher|
+      fetcher.spec 'example', '1.a'
+      fetcher.spec 'other-example', 1
+    end
+
+    suggestions = @sf.suggest_gems_from_name('examplw')
+    assert_equal ['example'], suggestions
+  end
+
   def test_available_specs_latest
     spec_fetcher do |fetcher|
       fetcher.spec 'a', 1