rubygems-update 3.0.3 → 3.4.12

data/lib/rubygems/util.rb

@@ -1,20 +1,26 @@
 # frozen_string_literal: true
+require_relative "deprecate"
+
 ##
 # This module contains various utility methods as module methods.
 
 module Gem::Util
 
-  @silent_mutex = nil
-
   ##
   # Zlib::GzipReader wrapper that unzips +data+.
 
   def self.gunzip(data)
-    require 'zlib'
-    require 'stringio'
-    data = StringIO.new(data, 'r')
+    require "zlib"
+    require "stringio"
+    data = StringIO.new(data, "r")
+
+    gzip_reader = begin
+                    Zlib::GzipReader.new(data)
+                  rescue Zlib::GzipFile::Error => e
+                    raise e.class, e.inspect, e.backtrace
+                  end
 
-    unzipped = Zlib::GzipReader.new(data).read
+    unzipped = gzip_reader.read
     unzipped.force_encoding Encoding::BINARY
     unzipped
   end
@@ -23,12 +29,14 @@ module Gem::Util
   # Zlib::GzipWriter wrapper that zips +data+.
 
   def self.gzip(data)
-    require 'zlib'
-    require 'stringio'
-    zipped = StringIO.new(String.new, 'w')
+    require "zlib"
+    require "stringio"
+    zipped = StringIO.new(String.new, "w")
     zipped.set_encoding Encoding::BINARY
 
-    Zlib::GzipWriter.wrap zipped do |io| io.write data end
+    Zlib::GzipWriter.wrap zipped do |io|
+      io.write data
+    end
 
     zipped.string
   end
@@ -37,67 +45,35 @@ module Gem::Util
   # A Zlib::Inflate#inflate wrapper
 
   def self.inflate(data)
-    require 'zlib'
+    require "zlib"
     Zlib::Inflate.inflate data
   end
 
   ##
-  # This calls IO.popen where it accepts an array for a +command+ (Ruby 1.9+)
-  # and implements an IO.popen-like behavior where it does not accept an array
-  # for a command.
+  # This calls IO.popen and reads the result
 
   def self.popen(*command)
     IO.popen command, &:read
-  rescue TypeError # ruby 1.8 only supports string command
-    r, w = IO.pipe
-
-    pid = fork do
-      STDIN.close
-      STDOUT.reopen w
-
-      exec(*command)
-    end
-
-    w.close
-
-    begin
-      return r.read
-    ensure
-      Process.wait pid
-    end
   end
 
   ##
   # Invokes system, but silences all output.
 
   def self.silent_system(*command)
-    opt = {:out => IO::NULL, :err => [:child, :out]}
+    opt = { :out => IO::NULL, :err => [:child, :out] }
     if Hash === command.last
       opt.update(command.last)
       cmds = command[0...-1]
     else
       cmds = command.dup
     end
-    return system(*(cmds << opt))
-  rescue TypeError
-    @silent_mutex ||= Mutex.new
-
-    @silent_mutex.synchronize do
-      begin
-        stdout = STDOUT.dup
-        stderr = STDERR.dup
-
-        STDOUT.reopen IO::NULL, 'w'
-        STDERR.reopen IO::NULL, 'w'
-
-        return system(*command)
-      ensure
-        STDOUT.reopen stdout
-        STDERR.reopen stderr
-        stdout.close
-        stderr.close
-      end
-    end
+    system(*(cmds << opt))
+  end
+
+  class << self
+    extend Gem::Deprecate
+
+    rubygems_deprecate :silent_system
   end
 
   ##
@@ -110,7 +86,7 @@ module Gem::Util
     loop do
       Dir.chdir here, &block rescue Errno::EACCES
 
-      new_here = File.expand_path('..', here)
+      new_here = File.expand_path("..", here)
       return if new_here == here # toplevel
       here = new_here
     end
@@ -121,10 +97,18 @@ module Gem::Util
   # returning absolute paths to the matching files.
 
   def self.glob_files_in_dir(glob, base_path)
-    if RUBY_VERSION >= "2.5"
-      Dir.glob(glob, base: base_path).map! {|f| File.expand_path(f, base_path) }
+    Dir.glob(glob, base: base_path).map! {|f| File.expand_path(f, base_path) }
+  end
+
+  ##
+  # Corrects +path+ (usually returned by `URI.parse().path` on Windows), that
+  # comes with a leading slash.
+
+  def self.correct_for_windows_path(path)
+    if path[0].chr == "/" && path[1].chr =~ /[a-z]/i && path[2].chr == ":"
+      path[1..-1]
     else
-      Dir.glob(File.expand_path(glob, base_path))
+      path
     end
   end
 

data/lib/rubygems/validator.rb

@@ -5,41 +5,17 @@
 # See LICENSE.txt for permissions.
 #++
 
-require 'rubygems/package'
-require 'rubygems/installer'
+require_relative "package"
+require_relative "installer"
 
 ##
 # Validator performs various gem file and gem database validation
 
 class Gem::Validator
-
   include Gem::UserInteraction
 
   def initialize # :nodoc:
-    require 'find'
-  end
-
-  ##
-  # Given a gem file's contents, validates against its own MD5 checksum
-  # gem_data:: [String] Contents of the gem file
-
-  def verify_gem(gem_data)
-    # TODO remove me? The code here only validate an MD5SUM that was
-    # in some old formatted gems, but hasn't been for a long time.
-  end
-
-  ##
-  # Given the path to a gem file, validates against its own MD5 checksum
-  #
-  # gem_path:: [String] Path to gem file
-
-  def verify_gem_file(gem_path)
-    File.open gem_path, Gem.binary_mode do |file|
-      gem_data = file.read
-      verify_gem gem_data
-    end
-  rescue Errno::ENOENT, Errno::EINVAL
-    raise Gem::VerificationError, "missing gem file #{gem_path}"
+    require "find"
   end
 
   private
@@ -48,9 +24,9 @@ class Gem::Validator
     installed_files = []
 
     Find.find gem_directory do |file_name|
-      fn = file_name[gem_directory.size..file_name.size-1].sub(/^\//, "")
+      fn = file_name[gem_directory.size..file_name.size - 1].sub(/^\//, "")
       installed_files << fn unless
-        fn =~ /CVS/ || fn.empty? || File.directory?(file_name)
+        fn.empty? || fn.include?("CVS") || File.directory?(file_name)
     end
 
     installed_files
@@ -83,7 +59,7 @@ class Gem::Validator
   # TODO needs further cleanup
 
   def alien(gems=[])
-    errors = Hash.new { |h,k| h[k] = {} }
+    errors = Hash.new {|h,k| h[k] = {} }
 
     Gem::Specification.each do |spec|
       next unless gems.include? spec.name unless gems.empty?
@@ -105,24 +81,26 @@ class Gem::Validator
       end
 
       begin
-        verify_gem_file(gem_path)
+        unless File.readable?(gem_path)
+          raise Gem::VerificationError, "missing gem file #{gem_path}"
+        end
 
         good, gone, unreadable = nil, nil, nil, nil
 
         File.open gem_path, Gem.binary_mode do |file|
           package = Gem::Package.new gem_path
 
-          good, gone = package.contents.partition { |file_name|
+          good, gone = package.contents.partition do |file_name|
             File.exist? File.join(gem_directory, file_name)
-          }
+          end
 
           gone.sort.each do |path|
             errors[gem_name][path] = "Missing file"
           end
 
-          good, unreadable = good.partition { |file_name|
+          good, unreadable = good.partition do |file_name|
             File.readable? File.join(gem_directory, file_name)
-          }
+          end
 
           unreadable.sort.each do |path|
             errors[gem_name][path] = "Unreadable file"
@@ -132,11 +110,11 @@ class Gem::Validator
             begin
               next unless data # HACK `gem check -a mkrf`
 
-              source = File.join gem_directory, entry['path']
+              source = File.join gem_directory, entry["path"]
 
               File.open source, Gem.binary_mode do |f|
                 unless f.read == data
-                  errors[gem_name][entry['path']] = "Modified from original"
+                  errors[gem_name][entry["path"]] = "Modified from original"
                 end
               end
             end

data/lib/rubygems/version.rb

@@ -1,4 +1,7 @@
 # frozen_string_literal: true
+
+require_relative "deprecate"
+
 ##
 # The Version class processes string versions into comparable
 # values. A version string should normally be a series of numbers
@@ -150,11 +153,9 @@
 # a zero to give a sensible result.
 
 class Gem::Version
-  autoload :Requirement, 'rubygems/requirement'
-
   include Comparable
 
-  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?'.freeze # :nodoc:
+  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*(-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?' # :nodoc:
   ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/.freeze # :nodoc:
 
   ##
@@ -170,9 +171,7 @@ class Gem::Version
   # True if the +version+ string matches RubyGems' requirements.
 
   def self.correct?(version)
-    unless Gem::Deprecate.skip
-      warn "nil versions are discouraged and will be deprecated in Rubygems 4" if version.nil?
-    end
+    nil_versions_are_discouraged! if version.nil?
 
     !!(version.to_s =~ ANCHORED_VERSION_PATTERN)
   end
@@ -186,9 +185,11 @@ class Gem::Version
   #   ver3 = Version.create(nil)        # -> nil
 
   def self.create(input)
-    if self === input  # check yourself before you wreck yourself
+    if self === input # check yourself before you wreck yourself
       input
     elsif input.nil?
+      nil_versions_are_discouraged!
+
       nil
     else
       new input
@@ -196,6 +197,8 @@ class Gem::Version
   end
 
   @@all = {}
+  @@bump = {}
+  @@release = {}
 
   def self.new(version) # :nodoc:
     return super unless Gem::Version == self
@@ -203,6 +206,14 @@ class Gem::Version
     @@all[version] ||= super
   end
 
+  def self.nil_versions_are_discouraged!
+    unless Gem::Deprecate.skip
+      warn "nil versions are discouraged and will be deprecated in Rubygems 4"
+    end
+  end
+
+  private_class_method :nil_versions_are_discouraged!
+
   ##
   # Constructs a Version from the +version+ string.  A version string is a
   # series of digits or ASCII letters separated by dots.
@@ -226,14 +237,14 @@ class Gem::Version
   # Pre-release (alpha) parts, e.g, 5.3.1.b.2 => 5.4, are ignored.
 
   def bump
-    @bump ||= begin
-                segments = self.segments
-                segments.pop while segments.any? { |s| String === s }
-                segments.pop if segments.size > 1
-
-                segments[-1] = segments[-1].succ
-                self.class.new segments.join(".")
-              end
+    @@bump[self] ||= begin
+                       segments = self.segments
+                       segments.pop while segments.any? {|s| String === s }
+                       segments.pop if segments.size > 1
+
+                       segments[-1] = segments[-1].succ
+                       self.class.new segments.join(".")
+                     end
   end
 
   ##
@@ -241,7 +252,7 @@ class Gem::Version
   # same precision. Version "1.0" is not the same as version "1".
 
   def eql?(other)
-    self.class === other and @version == other._version
+    self.class === other && @version == other._version
   end
 
   def hash # :nodoc:
@@ -261,7 +272,7 @@ class Gem::Version
   # string for backwards (RubyGems 1.3.5 and earlier) compatibility.
 
   def marshal_dump
-    [version]
+    [@version]
   end
 
   ##
@@ -273,7 +284,7 @@ class Gem::Version
   end
 
   def yaml_initialize(tag, map) # :nodoc:
-    @version = map['version']
+    @version = map["version"]
     @segments = nil
     @hash = nil
   end
@@ -283,7 +294,7 @@ class Gem::Version
   end
 
   def encode_with(coder) # :nodoc:
-    coder.add 'version', @version
+    coder.add "version", @version
   end
 
   ##
@@ -305,13 +316,13 @@ class Gem::Version
   # Non-prerelease versions return themselves.
 
   def release
-    @release ||= if prerelease?
-                   segments = self.segments
-                   segments.pop while segments.any? { |s| String === s }
-                   self.class.new segments.join('.')
-                 else
-                   self
-                 end
+    @@release[self] ||= if prerelease?
+      segments = self.segments
+      segments.pop while segments.any? {|s| String === s }
+      self.class.new segments.join(".")
+    else
+      self
+    end
   end
 
   def segments # :nodoc:
@@ -324,7 +335,7 @@ class Gem::Version
   def approximate_recommendation
     segments = self.segments
 
-    segments.pop    while segments.any? { |s| String === s }
+    segments.pop    while segments.any? {|s| String === s }
     segments.pop    while segments.size > 2
     segments.push 0 while segments.size < 2
 
@@ -337,14 +348,16 @@ class Gem::Version
   # Compares this version with +other+ returning -1, 0, or 1 if the
   # other version is larger, the same, or smaller than this
   # one. Attempts to compare to something that's not a
-  # <tt>Gem::Version</tt> return +nil+.
+  # <tt>Gem::Version</tt> or a valid version String return +nil+.
 
   def <=>(other)
+    return self <=> self.class.new(other) if (String === other) && self.class.correct?(other)
+
     return unless Gem::Version === other
     return 0 if @version == other._version || canonical_segments == other.canonical_segments
 
-    lhsegments = _segments
-    rhsegments = other._segments
+    lhsegments = canonical_segments
+    rhsegments = other.canonical_segments
 
     lhsize = lhsegments.size
     rhsize = rhsegments.size
@@ -373,6 +386,12 @@ class Gem::Version
       end.reduce(&:concat)
   end
 
+  def freeze
+    prerelease?
+    canonical_segments
+    super
+  end
+
   protected
 
   def _version
@@ -391,7 +410,7 @@ class Gem::Version
 
   def _split_segments
     string_start = _segments.index {|s| s.is_a?(String) }
-    string_segments  = segments
+    string_segments = segments
     numeric_segments = string_segments.slice!(0, string_start || string_segments.size)
     return numeric_segments, string_segments
   end

data/lib/rubygems/version_option.rb

@@ -5,7 +5,7 @@
 # See LICENSE.txt for permissions.
 #++
 
-require 'rubygems'
+require_relative "../rubygems"
 
 ##
 # Mixin methods for --version and --platform Gem::Command options.
@@ -16,7 +16,7 @@ module Gem::VersionOption
   # Add the --platform option to the option parser.
 
   def add_platform_option(task = command, *wrap)
-    OptionParser.accept Gem::Platform do |value|
+    Gem::OptionParser.accept Gem::Platform do |value|
       if value == Gem::Platform::RUBY
         value
       else
@@ -24,7 +24,7 @@ module Gem::VersionOption
       end
     end
 
-    add_option('--platform PLATFORM', Gem::Platform,
+    add_option("--platform PLATFORM", Gem::Platform,
                "Specify the platform of gem to #{task}", *wrap) do
                  |value, options|
       unless options[:added_platform]
@@ -51,11 +51,11 @@ module Gem::VersionOption
   # Add the --version option to the option parser.
 
   def add_version_option(task = command, *wrap)
-    OptionParser.accept Gem::Requirement do |value|
+    Gem::OptionParser.accept Gem::Requirement do |value|
       Gem::Requirement.new(*value.split(/\s*,\s*/))
     end
 
-    add_option('-v', '--version VERSION', Gem::Requirement,
+    add_option("-v", "--version VERSION", Gem::Requirement,
                "Specify version of gem to #{task}", *wrap) do
                  |value, options|
       # Allow handling for multiple --version operators
@@ -73,4 +73,10 @@ module Gem::VersionOption
     end
   end
 
+  ##
+  # Extract platform given on the command line
+
+  def get_platform_from_requirements(requirements)
+    Gem.platforms[1].to_s if requirements.key? :added_platform
+  end
 end

data/lib/rubygems/webauthn_listener/response.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+
+##
+# The WebauthnListener Response class is used by the WebauthnListener to create
+# responses to be sent to the Gem host. It creates a Net::HTTPResponse instance
+# when initialized and can be converted to the appropriate format to be sent by a socket using `to_s`.
+# Net::HTTPResponse instances cannot be directly sent over a socket.
+#
+# Types of response classes:
+#   - OkResponse
+#   - NoContentResponse
+#   - BadRequestResponse
+#   - NotFoundResponse
+#   - MethodNotAllowedResponse
+#
+# Example usage:
+#
+#   server = TCPServer.new(0)
+#   socket = server.accept
+#
+#   response = OkResponse.for("https://rubygems.example")
+#   socket.print response.to_s
+#   socket.close
+#
+
+class Gem::WebauthnListener
+  class Response
+    attr_reader :http_response
+
+    def self.for(host)
+      new(host)
+    end
+
+    def initialize(host)
+      @host = host
+
+      build_http_response
+    end
+
+    def to_s
+      status_line = "HTTP/#{@http_response.http_version} #{@http_response.code} #{@http_response.message}\r\n"
+      headers = @http_response.to_hash.map {|header, value| "#{header}: #{value.join(", ")}\r\n" }.join + "\r\n"
+      body = @http_response.body ? "#{@http_response.body}\n" : ""
+
+      status_line + headers + body
+    end
+
+    private
+
+    # Must be implemented in subclasses
+    def code
+      raise NotImplementedError
+    end
+
+    def reason_phrase
+      raise NotImplementedError
+    end
+
+    def body; end
+
+    def build_http_response
+      response_class = Net::HTTPResponse::CODE_TO_OBJ[code.to_s]
+      @http_response = response_class.new("1.1", code, reason_phrase)
+      @http_response.instance_variable_set(:@read, true)
+
+      add_connection_header
+      add_access_control_headers
+      add_body
+    end
+
+    def add_connection_header
+      @http_response["connection"] = "close"
+    end
+
+    def add_access_control_headers
+      @http_response["access-control-allow-origin"] = @host
+      @http_response["access-control-allow-methods"] = "POST"
+      @http_response["access-control-allow-headers"] = %w[Content-Type Authorization x-csrf-token]
+    end
+
+    def add_body
+      return unless body
+      @http_response["content-type"] = "text/plain"
+      @http_response["content-length"] = body.bytesize
+      @http_response.instance_variable_set(:@body, body)
+    end
+  end
+
+  class OkResponse < Response
+    private
+
+    def code
+      200
+    end
+
+    def reason_phrase
+      "OK"
+    end
+
+    def body
+      "success"
+    end
+  end
+
+  class NoContentResponse < Response
+    private
+
+    def code
+      204
+    end
+
+    def reason_phrase
+      "No Content"
+    end
+  end
+
+  class BadRequestResponse < Response
+    private
+
+    def code
+      400
+    end
+
+    def reason_phrase
+      "Bad Request"
+    end
+
+    def body
+      "missing code parameter"
+    end
+  end
+
+  class NotFoundResponse < Response
+    private
+
+    def code
+      404
+    end
+
+    def reason_phrase
+      "Not Found"
+    end
+  end
+
+  class MethodNotAllowedResponse < Response
+    private
+
+    def code
+      405
+    end
+
+    def reason_phrase
+      "Method Not Allowed"
+    end
+
+    def add_access_control_headers
+      super
+      @http_response["allow"] = %w[GET OPTIONS]
+    end
+  end
+end