rubygems-update 3.0.3 → 3.4.7

data/test/rubygems/test_gem_commands_sources_command.rb

@@ -1,21 +1,26 @@
 # frozen_string_literal: true
-require 'rubygems/test_case'
-require 'rubygems/commands/sources_command'
+require_relative "helper"
+require "rubygems/commands/sources_command"
 
 class TestGemCommandsSourcesCommand < Gem::TestCase
-
   def setup
     super
 
-    spec_fetcher
-
     @cmd = Gem::Commands::SourcesCommand.new
 
     @new_repo = "http://beta-gems.example.com"
+
+    @old_https_proxy_config = Gem.configuration[:http_proxy]
+  end
+
+  def teardown
+    Gem.configuration[:http_proxy] = @old_https_proxy_config
+
+    super
   end
 
   def test_initialize_proxy
-    assert @cmd.handles?(['--http-proxy', 'http://proxy.example.com'])
+    assert @cmd.handles?(["--http-proxy", "http://proxy.example.com"])
   end
 
   def test_execute
@@ -32,17 +37,17 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_add
     spec_fetcher do |fetcher|
-      fetcher.spec 'a', 1
+      fetcher.spec "a", 1
     end
 
-    specs = Gem::Specification.map { |spec|
+    specs = Gem::Specification.map do |spec|
       [spec.name, spec.version, spec.original_platform]
-    }
+    end
 
     specs_dump_gz = StringIO.new
     Zlib::GzipWriter.wrap specs_dump_gz do |io|
@@ -65,19 +70,124 @@ class TestGemCommandsSourcesCommand < Gem::TestCase
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
+  end
+
+  def test_execute_add_allow_typo_squatting_source
+    rubygems_org = "https://rubyems.org"
+
+    spec_fetcher do |fetcher|
+      fetcher.spec("a", 1)
+    end
+
+    specs = Gem::Specification.map do |spec|
+      [spec.name, spec.version, spec.original_platform]
+    end
+
+    specs_dump_gz = StringIO.new
+    Zlib::GzipWriter.wrap(specs_dump_gz) do |io|
+      Marshal.dump(specs, io)
+    end
+
+    @fetcher.data["#{rubygems_org}/specs.#{@marshal_version}.gz"] = specs_dump_gz.string
+    @cmd.handle_options %W[--add #{rubygems_org}]
+    ui = Gem::MockGemUi.new("y")
+
+    use_ui ui do
+      @cmd.execute
+    end
+
+    expected = "https://rubyems.org is too similar to https://rubygems.org\n\nDo you want to add this source? [yn]  https://rubyems.org added to sources\n"
+
+    assert_equal expected, ui.output
+
+    source = Gem::Source.new(rubygems_org)
+    assert Gem.sources.include?(source)
+
+    assert_empty ui.error
+  end
+
+  def test_execute_add_allow_typo_squatting_source_forced
+    rubygems_org = "https://rubyems.org"
+
+    spec_fetcher do |fetcher|
+      fetcher.spec("a", 1)
+    end
+
+    specs = Gem::Specification.map do |spec|
+      [spec.name, spec.version, spec.original_platform]
+    end
+
+    specs_dump_gz = StringIO.new
+    Zlib::GzipWriter.wrap(specs_dump_gz) do |io|
+      Marshal.dump(specs, io)
+    end
+
+    @fetcher.data["#{rubygems_org}/specs.#{@marshal_version}.gz"] = specs_dump_gz.string
+    @cmd.handle_options %W[--force --add #{rubygems_org}]
+
+    @cmd.execute
+
+    expected = "https://rubyems.org added to sources\n"
+    assert_equal expected, ui.output
+
+    source = Gem::Source.new(rubygems_org)
+    assert Gem.sources.include?(source)
+
+    assert_empty ui.error
+  end
+
+  def test_execute_add_deny_typo_squatting_source
+    rubygems_org = "https://rubyems.org"
+
+    spec_fetcher do |fetcher|
+      fetcher.spec("a", 1)
+    end
+
+    specs = Gem::Specification.map do |spec|
+      [spec.name, spec.version, spec.original_platform]
+    end
+
+    specs_dump_gz = StringIO.new
+    Zlib::GzipWriter.wrap(specs_dump_gz) do |io|
+      Marshal.dump(specs, io)
+    end
+
+    @fetcher.data["#{rubygems_org}/specs.#{@marshal_version}.gz"] =
+      specs_dump_gz.string
+
+    @cmd.handle_options %W[--add #{rubygems_org}]
+
+    ui = Gem::MockGemUi.new("n")
+
+    use_ui ui do
+      assert_raise Gem::MockGemUi::TermError do
+        @cmd.execute
+      end
+    end
+
+    expected = "https://rubyems.org is too similar to https://rubygems.org\n\nDo you want to add this source? [yn]  "
+
+    assert_equal expected, ui.output
+
+    source = Gem::Source.new(rubygems_org)
+    refute Gem.sources.include?(source)
+
+    assert_empty ui.error
   end
 
   def test_execute_add_nonexistent_source
+    spec_fetcher
+
     uri = "http://beta-gems.example.com/specs.#{@marshal_version}.gz"
     @fetcher.data[uri] = proc do
-      raise Gem::RemoteFetcher::FetchError.new('it died', uri)
+      raise Gem::RemoteFetcher::FetchError.new("it died", uri)
     end
 
     @cmd.handle_options %w[--add http://beta-gems.example.com]
 
     use_ui @ui do
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -88,10 +198,62 @@ Error fetching http://beta-gems.example.com:
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
+  end
+
+  def test_execute_add_existent_source_invalid_uri
+    spec_fetcher
+
+    uri = "https://u:p@example.com/specs.#{@marshal_version}.gz"
+
+    @cmd.handle_options %w[--add https://u:p@example.com]
+    @fetcher.data[uri] = proc do
+      raise Gem::RemoteFetcher::FetchError.new("it died", uri)
+    end
+
+    use_ui @ui do
+      assert_raise Gem::MockGemUi::TermError do
+        @cmd.execute
+      end
+    end
+
+    expected = <<-EOF
+Error fetching https://u:REDACTED@example.com:
+\tit died (https://u:REDACTED@example.com/specs.#{@marshal_version}.gz)
+    EOF
+
+    assert_equal expected, @ui.output
+    assert_equal "", @ui.error
+  end
+
+  def test_execute_add_existent_source_invalid_uri_with_error_by_chance_including_the_uri_password
+    spec_fetcher
+
+    uri = "https://u:secret@example.com/specs.#{@marshal_version}.gz"
+
+    @cmd.handle_options %w[--add https://u:secret@example.com]
+    @fetcher.data[uri] = proc do
+      raise Gem::RemoteFetcher::FetchError.new("it secretly died", uri)
+    end
+
+    use_ui @ui do
+      assert_raise Gem::MockGemUi::TermError do
+        @cmd.execute
+      end
+    end
+
+    expected = <<-EOF
+Error fetching https://u:REDACTED@example.com:
+\tit secretly died (https://u:REDACTED@example.com/specs.#{@marshal_version}.gz)
+    EOF
+
+    assert_equal expected, @ui.output
+    assert_equal "", @ui.error
   end
 
   def test_execute_add_redundant_source
+    spec_fetcher
+
     @cmd.handle_options %W[--add #{@gem_repo}]
 
     use_ui @ui do
@@ -105,10 +267,12 @@ source #{@gem_repo} already present in the cache
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_add_redundant_source_trailing_slash
+    spec_fetcher
+
     # Remove pre-existing gem source (w/ slash)
     repo_with_slash = "http://gems.example.com/"
     @cmd.handle_options %W[--remove #{repo_with_slash}]
@@ -123,7 +287,7 @@ source #{@gem_repo} already present in the cache
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
 
     # Re-add pre-existing gem source (w/o slash)
     repo_without_slash = "http://gems.example.com"
@@ -140,7 +304,7 @@ http://gems.example.com added to sources
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
 
     # Re-add original gem source (w/ slash)
     @cmd.handle_options %W[--add #{repo_with_slash}]
@@ -157,19 +321,19 @@ source http://gems.example.com/ already present in the cache
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_add_http_rubygems_org
-    http_rubygems_org = 'http://rubygems.org'
+    http_rubygems_org = "http://rubygems.org/"
 
     spec_fetcher do |fetcher|
-      fetcher.spec 'a', 1
+      fetcher.spec "a", 1
     end
 
-    specs = Gem::Specification.map { |spec|
+    specs = Gem::Specification.map do |spec|
       [spec.name, spec.version, spec.original_platform]
-    }
+    end
 
     specs_dump_gz = StringIO.new
     Zlib::GzipWriter.wrap specs_dump_gz do |io|
@@ -184,7 +348,75 @@ source http://gems.example.com/ already present in the cache
     ui = Gem::MockGemUi.new "n"
 
     use_ui ui do
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
+        @cmd.execute
+      end
+    end
+
+    assert_equal [@gem_repo], Gem.sources
+
+    expected = <<-EXPECTED
+    EXPECTED
+
+    assert_equal expected, @ui.output
+    assert_empty @ui.error
+  end
+
+  def test_execute_add_http_rubygems_org_forced
+    rubygems_org = "http://rubygems.org"
+
+    spec_fetcher do |fetcher|
+      fetcher.spec("a", 1)
+    end
+
+    specs = Gem::Specification.map do |spec|
+      [spec.name, spec.version, spec.original_platform]
+    end
+
+    specs_dump_gz = StringIO.new
+    Zlib::GzipWriter.wrap(specs_dump_gz) do |io|
+      Marshal.dump(specs, io)
+    end
+
+    @fetcher.data["#{rubygems_org}/specs.#{@marshal_version}.gz"] = specs_dump_gz.string
+    @cmd.handle_options %W[--force --add #{rubygems_org}]
+
+    @cmd.execute
+
+    expected = "http://rubygems.org added to sources\n"
+    assert_equal expected, ui.output
+
+    source = Gem::Source.new(rubygems_org)
+    assert Gem.sources.include?(source)
+
+    assert_empty ui.error
+  end
+
+  def test_execute_add_https_rubygems_org
+    https_rubygems_org = "https://rubygems.org/"
+
+    spec_fetcher do |fetcher|
+      fetcher.spec "a", 1
+    end
+
+    specs = Gem::Specification.map do |spec|
+      [spec.name, spec.version, spec.original_platform]
+    end
+
+    specs_dump_gz = StringIO.new
+    Zlib::GzipWriter.wrap specs_dump_gz do |io|
+      Marshal.dump specs, io
+    end
+
+    @fetcher.data["#{https_rubygems_org}/specs.#{@marshal_version}.gz"] =
+      specs_dump_gz.string
+
+    @cmd.handle_options %W[--add #{https_rubygems_org}]
+
+    ui = Gem::MockGemUi.new "n"
+
+    use_ui ui do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -202,7 +434,7 @@ source http://gems.example.com/ already present in the cache
     @cmd.handle_options %w[--add beta-gems.example.com]
 
     use_ui @ui do
-      assert_raises Gem::MockGemUi::TermError do
+      assert_raise Gem::MockGemUi::TermError do
         @cmd.execute
       end
     end
@@ -214,7 +446,7 @@ beta-gems.example.com is not a URI
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_clear_all
@@ -229,10 +461,10 @@ beta-gems.example.com is not a URI
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
 
     dir = Gem.spec_cache_dir
-    refute File.exist?(dir), 'cache dir removed'
+    refute File.exist?(dir), "cache dir removed"
   end
 
   def test_execute_list
@@ -249,7 +481,7 @@ beta-gems.example.com is not a URI
     EOF
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_remove
@@ -262,10 +494,12 @@ beta-gems.example.com is not a URI
     expected = "#{@gem_repo} removed from sources\n"
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_remove_no_network
+    spec_fetcher
+
     @cmd.handle_options %W[--remove #{@gem_repo}]
 
     @fetcher.data["#{@gem_repo}Marshal.#{Gem.marshal_version}"] = proc do
@@ -279,14 +513,14 @@ beta-gems.example.com is not a URI
     expected = "#{@gem_repo} removed from sources\n"
 
     assert_equal expected, @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
 
   def test_execute_update
     @cmd.handle_options %w[--update]
 
     spec_fetcher do |fetcher|
-      fetcher.gem 'a', 1
+      fetcher.gem "a", 1
     end
 
     use_ui @ui do
@@ -294,7 +528,6 @@ beta-gems.example.com is not a URI
     end
 
     assert_equal "source cache successfully updated\n", @ui.output
-    assert_equal '', @ui.error
+    assert_equal "", @ui.error
   end
-
 end