rubygems-update 2.7.6 → 2.7.11

data/test/rubygems/test_gem_commands_uninstall_command.rb

@@ -238,7 +238,7 @@ class TestGemCommandsUninstallCommand < Gem::InstallerTestCase
     @cmd.handle_options %w[]
 
     assert_equal false,                    @cmd.options[:check_dev]
-    assert_equal nil,                      @cmd.options[:install_dir]
+    assert_nil                             @cmd.options[:install_dir]
     assert_equal true,                     @cmd.options[:user_install]
     assert_equal Gem::Requirement.default, @cmd.options[:version]
     assert_equal false,                    @cmd.options[:vendor]

data/test/rubygems/test_gem_dependency.rb

@@ -358,7 +358,7 @@ class TestGemDependency < Gem::TestCase
         dep.to_specs
       end
 
-      assert_match "Could not find 'bundler' (3.5) required by reason.\nTo update to the lastest version installed on your system, run `bundle update --bundler`.\nTo install the missing version, run `gem install bundler:3.5`\n", e.message
+      assert_match "Could not find 'bundler' (3.5) required by reason.\nTo update to the latest version installed on your system, run `bundle update --bundler`.\nTo install the missing version, run `gem install bundler:3.5`\n", e.message
     end
 
     Gem::BundlerVersionFinder.stub(:bundler_version_with_reason, ["2.0.0.pre.1", "reason"]) do

data/test/rubygems/test_gem_ext_rake_builder.rb

@@ -16,11 +16,9 @@ class TestGemExtRakeBuilder < Gem::TestCase
   def test_class_build
     create_temp_mkrf_file('task :default')
     output = []
-    realdir = nil # HACK /tmp vs. /private/tmp
 
     build_rake_in do |rake|
       Dir.chdir @ext do
-        realdir = Dir.pwd
         Gem::Ext::RakeBuilder.build 'mkrf_conf.rb', nil, @dest_path, output
       end
 
@@ -38,11 +36,9 @@ class TestGemExtRakeBuilder < Gem::TestCase
   def test_class_build_with_args
     create_temp_mkrf_file('task :default')
     output = []
-    realdir = nil # HACK /tmp vs. /private/tmp
 
     build_rake_in do |rake|
       Dir.chdir @ext do
-        realdir = Dir.pwd
         non_empty_args_list = ['']
         Gem::Ext::RakeBuilder.build 'mkrf_conf.rb', nil, @dest_path, output, non_empty_args_list
       end

data/test/rubygems/test_gem_install_update_options.rb

@@ -119,6 +119,8 @@ class TestGemInstallUpdateOptions < Gem::InstallerTestCase
   end
 
   def test_security_policy_unknown
+    skip 'openssl is missing' unless defined?(OpenSSL::SSL)
+
     @cmd.add_install_update_options
 
     e = assert_raises OptionParser::InvalidArgument do

data/test/rubygems/test_gem_installer.rb

@@ -21,7 +21,7 @@ class TestGemInstaller < Gem::InstallerTestCase
     super
     common_installer_setup
 
-    if __name__ =~ /^test_install(_|$)/ then
+    if (self.class.method_defined?(:__name__) ? __name__ : name) =~ /\Atest_install(_|\Z)/
       FileUtils.rm_r @spec.gem_dir
       FileUtils.rm_r @user_spec.gem_dir
     end
@@ -34,7 +34,7 @@ class TestGemInstaller < Gem::InstallerTestCase
 
     super
 
-    Gem.configuration = @config
+    Gem.configuration = instance_variable_defined?(:@config) ? @config : nil
   end
 
   def test_app_script_text
@@ -663,7 +663,7 @@ gem 'other', version
     assert_path_exists installed_exec
 
     if symlink_supported?
-      assert_send([File, :symlink?, installed_exec])
+      assert File.symlink?(installed_exec)
       return
     end
 
@@ -1474,6 +1474,112 @@ gem 'other', version
     end
   end
 
+  def test_pre_install_checks_malicious_name_before_eval
+    spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message
+    end
+    refute defined?(::Object::FROM_EVAL)
+  end
+
+  def test_pre_install_checks_malicious_require_paths_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.require_paths = ["malicious\n``"]
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_extensions_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.extensions = ["malicious\n``"]
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_specification_version_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.specification_version = "malicious\n``"
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message
+    end
+  end
+
+  def test_pre_install_checks_malicious_dependencies_before_eval
+    spec = util_spec "malicious", '1'
+    def spec.full_name # so the spec is buildable
+      "malicious-1"
+    end
+    def spec.validate(*args); end
+    spec.add_dependency "b\nfoo", '> 5'
+
+    util_build_gem spec
+
+    gem = File.join(@gemhome, 'cache', spec.file_name)
+
+    use_ui @ui do
+      @installer = Gem::Installer.at gem
+      @installer.ignore_dependencies = true
+      e = assert_raises Gem::InstallError do
+        @installer.pre_install_checks
+      end
+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message
+    end
+  end
+
   def test_shebang
     util_make_exec @spec, "#!/usr/bin/ruby"
 

data/test/rubygems/test_gem_package.rb

@@ -480,6 +480,42 @@ class TestGemPackage < Gem::Package::TarTestCase
                  "#{destination_subdir} is not allowed", e.message)
   end
 
+  def test_extract_symlink_parent_doesnt_delete_user_dir
+    skip if RUBY_VERSION <= "1.8.7"
+
+    package = Gem::Package.new @gem
+
+    # Extract into a subdirectory of @destination; if this test fails it writes
+    # a file outside destination_subdir, but we want the file to remain inside
+    # @destination so it will be cleaned up.
+    destination_subdir = File.join @destination, 'subdir'
+    FileUtils.mkdir_p destination_subdir
+
+    destination_user_dir = File.join @destination, 'user'
+    destination_user_subdir = File.join destination_user_dir, 'dir'
+    FileUtils.mkdir_p destination_user_subdir
+
+    tgz_io = util_tar_gz do |tar|
+      tar.add_symlink 'link', destination_user_dir, 16877
+      tar.add_symlink 'link/dir', '.', 16877
+    end
+
+    e = assert_raises(Gem::Package::PathError, Errno::EACCES) do
+      package.extract_tar_gz tgz_io, destination_subdir
+    end
+
+    assert_path_exists destination_user_subdir
+
+    if Gem::Package::PathError === e
+      assert_equal("installing into parent path #{destination_user_subdir} of " +
+                  "#{destination_subdir} is not allowed", e.message)
+    elsif win_platform?
+      skip "symlink - must be admin with no UAC on Windows"
+    else
+      raise e
+    end
+  end
+
   def test_extract_tar_gz_directory
     package = Gem::Package.new @gem
 
@@ -524,6 +560,21 @@ class TestGemPackage < Gem::Package::TarTestCase
     assert_path_exists extracted
   end
 
+  if Gem.win_platform?
+    def test_extract_tar_gz_case_insensitive
+      package = Gem::Package.new @gem
+
+      tgz_io = util_tar_gz do |tar|
+        tar.add_file 'foo/file.rb', 0644 do |io| io.write 'hi' end
+      end
+
+      package.extract_tar_gz tgz_io, @destination.upcase
+
+      extracted = File.join @destination, 'foo/file.rb'
+      assert_path_exists extracted
+    end
+  end
+
   def test_install_location
     package = Gem::Package.new @gem
 
@@ -607,7 +658,7 @@ class TestGemPackage < Gem::Package::TarTestCase
   end
 
   def test_load_spec
-    entry = StringIO.new Gem.gzip @spec.to_yaml
+    entry = StringIO.new Gem::Util.gzip @spec.to_yaml
     def entry.full_name() 'metadata.gz' end
 
     package = Gem::Package.new 'nonexistent.gem'
@@ -637,7 +688,7 @@ class TestGemPackage < Gem::Package::TarTestCase
     data_tgz = data_tgz.string
 
     gem = util_tar do |tar|
-      metadata_gz = Gem.gzip @spec.to_yaml
+      metadata_gz = Gem::Util.gzip @spec.to_yaml
 
       tar.add_file 'metadata.gz', 0444 do |io|
         io.write metadata_gz
@@ -684,7 +735,7 @@ class TestGemPackage < Gem::Package::TarTestCase
     data_tgz = data_tgz.string
 
     gem = util_tar do |tar|
-      metadata_gz = Gem.gzip @spec.to_yaml
+      metadata_gz = Gem::Util.gzip @spec.to_yaml
 
       tar.add_file 'metadata.gz', 0444 do |io|
         io.write metadata_gz
@@ -721,7 +772,7 @@ class TestGemPackage < Gem::Package::TarTestCase
 
   def test_verify_corrupt
     tf = Tempfile.open 'corrupt' do |io|
-      data = Gem.gzip 'a' * 10
+      data = Gem::Util.gzip 'a' * 10
       io.write \
         tar_file_header('metadata.gz', "\000x", 0644, data.length, Time.now)
       io.write data
@@ -845,7 +896,7 @@ class TestGemPackage < Gem::Package::TarTestCase
         build.add_contents gem
 
         # write bogus data.tar.gz to foil signature
-        bogus_data = Gem.gzip 'hello'
+        bogus_data = Gem::Util.gzip 'hello'
         fake_signer = Class.new do
           def digest_name; 'SHA512'; end
           def digest_algorithm; Digest(:SHA512); end
@@ -903,6 +954,40 @@ class TestGemPackage < Gem::Package::TarTestCase
     end
 
     assert_equal "package is corrupt, exception while verifying: whatever (ArgumentError) in #{@gem}", e.message
+
+    valid_metadata = ["metadata", "metadata.gz"]
+    valid_metadata.each do |vm|
+      $spec_loaded = false
+      $good_name = vm
+
+      entry = Object.new
+      def entry.full_name() $good_name end
+
+      package = Gem::Package.new(@gem)
+      package.instance_variable_set(:@files, [])
+      def package.load_spec(entry) $spec_loaded = true end
+
+      package.verify_entry(entry)
+
+      assert $spec_loaded
+    end
+
+    invalid_metadata = ["metadataxgz", "foobar\nmetadata", "metadata\nfoobar"]
+    invalid_metadata.each do |vm|
+      $spec_loaded = false
+      $bad_name = vm
+
+      entry = Object.new
+      def entry.full_name() $bad_name  end
+
+      package = Gem::Package.new(@gem)
+      package.instance_variable_set(:@files, [])
+      def package.load_spec(entry) $spec_loaded = true end
+
+      package.verify_entry(entry)
+
+      refute $spec_loaded
+    end
   end
 
   def test_spec

data/test/rubygems/test_gem_package_tar_header.rb

@@ -158,8 +158,9 @@ group\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000
       header_s[124, 12] = val
       io = TempIO.new header_s
       assert_raises ArgumentError do
-        new_header = Gem::Package::TarHeader.from io
+        Gem::Package::TarHeader.from io
       end
+      io.close! if io.respond_to? :close!
     end
   end
 

data/test/rubygems/test_gem_remote_fetcher.rb

@@ -9,6 +9,10 @@ rescue LoadError => e
                e.message =~ / -- openssl$/
 end
 
+unless defined?(OpenSSL::SSL) then
+  warn 'Skipping Gem::Request tests.  openssl not found.'
+end
+
 require 'rubygems/remote_fetcher'
 require 'rubygems/package'
 require 'minitest/mock'
@@ -541,7 +545,7 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     @fetcher = fetcher
 
     def fetcher.fetch_http(uri, mtime, head = nil)
-      Gem.gzip 'foo'
+      Gem::Util.gzip 'foo'
     end
 
     assert_equal 'foo', fetcher.fetch_path(@uri + 'foo.gz')
@@ -1067,4 +1071,4 @@ PeIQQkFng2VVot/WAQbv3ePqWq07g1BBcwIBAg==
     assert_equal "/home/skillet", @fetcher.correct_for_windows_path(path)
   end
 
-end
+end if defined?(OpenSSL::SSL)

data/test/rubygems/test_gem_request.rb

@@ -4,6 +4,10 @@ require 'rubygems/request'
 require 'ostruct'
 require 'base64'
 
+unless defined?(OpenSSL::SSL) then
+  warn 'Skipping Gem::Request tests.  openssl not found.'
+end
+
 class TestGemRequest < Gem::TestCase
 
   CA_CERT_FILE     = cert_path 'ca'
@@ -491,5 +495,4 @@ ERROR:  Certificate  is an invalid CA certificate
     end
   end
 
-end
-
+end if defined?(OpenSSL::SSL)

data/test/rubygems/test_gem_requirement.rb

@@ -28,6 +28,8 @@ class TestGemRequirement < Gem::TestCase
     assert_requirement_equal "= 2", "2"
     assert_requirement_equal "= 2", ["2"]
     assert_requirement_equal "= 2", v(2)
+    assert_requirement_equal "2.0", "2"
+    assert_requirement_equal ["= 2", ">= 2"], [">= 2", "= 2"]
   end
 
   def test_create
@@ -69,6 +71,7 @@ class TestGemRequirement < Gem::TestCase
     assert_equal ['=', Gem::Version.new(1)], Gem::Requirement.parse('= 1')
     assert_equal ['>', Gem::Version.new(1)], Gem::Requirement.parse('> 1')
     assert_equal ['=', Gem::Version.new(1)], Gem::Requirement.parse("=\n1")
+    assert_equal ['=', Gem::Version.new(1)], Gem::Requirement.parse('1.0')
 
     assert_equal ['=', Gem::Version.new(2)],
       Gem::Requirement.parse(Gem::Version.new('2'))
@@ -226,6 +229,8 @@ class TestGemRequirement < Gem::TestCase
     assert_satisfied_by "0.2.33",      "= 0.2.33"
     assert_satisfied_by "0.2.34",      "> 0.2.33"
     assert_satisfied_by "1.0",         "= 1.0"
+    assert_satisfied_by "1.0.0",       "= 1.0"
+    assert_satisfied_by "1.0",         "= 1.0.0"
     assert_satisfied_by "1.0",         "1.0"
     assert_satisfied_by "1.8.2",       "> 1.8.0"
     assert_satisfied_by "1.112",       "> 1.111"
@@ -313,6 +318,7 @@ class TestGemRequirement < Gem::TestCase
   def test_satisfied_by_boxed
     refute_satisfied_by "1.3",   "~> 1.4"
     assert_satisfied_by "1.4",   "~> 1.4"
+    assert_satisfied_by "1.4.0", "~> 1.4"
     assert_satisfied_by "1.5",   "~> 1.4"
     refute_satisfied_by "2.0",   "~> 1.4"
 

data/test/rubygems/test_gem_resolver_api_specification.rb

@@ -141,5 +141,29 @@ class TestGemResolverAPISpecification < Gem::TestCase
     assert_equal 'a-1', spec.full_name
   end
 
+  def test_spec_jruby_platform
+    spec_fetcher do |fetcher|
+      fetcher.gem 'j', 1 do |spec|
+        spec.platform = 'jruby'
+      end
+    end
+
+    dep_uri = URI(@gem_repo) + 'api/v1/dependencies'
+    set = Gem::Resolver::APISet.new dep_uri
+    data = {
+      :name         => 'j',
+      :number       => '1',
+      :platform     => 'jruby',
+      :dependencies => [],
+    }
+
+    api_spec = Gem::Resolver::APISpecification.new set, data
+
+    spec = api_spec.spec
+
+    assert_kind_of Gem::Specification, spec
+    assert_equal 'j-1-java', spec.full_name
+  end
+
 end