rubygems-update 3.3.18 → 3.6.2

data/lib/rubygems/source/specific_file.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # A source representing a single .gem file.  This is used for installation of
 # local gems.
@@ -33,7 +34,6 @@ class Gem::Source::SpecificFile < Gem::Source
   def fetch_spec(name) # :nodoc:
     return @spec if name == @name
     raise Gem::Exception, "Unable to find '#{name}'"
-    @spec
   end
 
   def download(spec, dir = nil) # :nodoc:
@@ -42,9 +42,11 @@ class Gem::Source::SpecificFile < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[SpecificFile:', ']' do
-      q.breakable
-      q.text @path
+    q.object_group(self) do
+      q.group 2, "[SpecificFile:", "]" do
+        q.breakable
+        q.text @path
+      end
     end
   end
 

data/lib/rubygems/source/vendor.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # This represents a vendored source that is similar to an installed gem.
 
@@ -18,8 +19,6 @@ class Gem::Source::Vendor < Gem::Source::Installed
       0
     when Gem::Source then
       1
-    else
-      nil
     end
   end
 end

data/lib/rubygems/source.rb

@@ -12,9 +12,9 @@ class Gem::Source
   include Gem::Text
 
   FILES = { # :nodoc:
-    :released   => 'specs',
-    :latest     => 'latest_specs',
-    :prerelease => 'prerelease_specs',
+    released: "specs",
+    latest: "latest_specs",
+    prerelease: "prerelease_specs",
   }.freeze
 
   ##
@@ -44,25 +44,23 @@ class Gem::Source
          Gem::Source::Vendor then
       -1
     when Gem::Source then
-      if !@uri
+      unless @uri
         return 0 unless other.uri
         return 1
       end
 
-      return -1 if !other.uri
+      return -1 unless other.uri
 
       # Returning 1 here ensures that when sorting a list of sources, the
       # original ordering of sources supplied by the user is preserved.
       return 1 unless @uri.to_s == other.uri.to_s
 
       0
-    else
-      nil
     end
   end
 
   def ==(other) # :nodoc:
-    self.class === other and @uri == other.uri
+    self.class === other && @uri == other.uri
   end
 
   alias_method :eql?, :== # :nodoc:
@@ -71,7 +69,7 @@ class Gem::Source
   # Returns a Set that can fetch specifications from this source.
 
   def dependency_resolver_set # :nodoc:
-    return Gem::Resolver::IndexSet.new self if 'file' == uri.scheme
+    return Gem::Resolver::IndexSet.new self if uri.scheme == "file"
 
     fetch_uri = if uri.host == "rubygems.org"
       index_uri = uri.dup
@@ -81,7 +79,7 @@ class Gem::Source
       uri
     end
 
-    bundler_api_uri = enforce_trailing_slash(fetch_uri)
+    bundler_api_uri = enforce_trailing_slash(fetch_uri) + "versions"
 
     begin
       fetcher = Gem::RemoteFetcher.fetcher
@@ -102,8 +100,7 @@ class Gem::Source
 
   def cache_dir(uri)
     # Correct for windows paths
-    escaped_path = uri.path.sub(/^\/([a-z]):\//i, '/\\1-/')
-    escaped_path.tap(&Gem::UNTAINT)
+    escaped_path = uri.path.sub(%r{^/([a-z]):/}i, '/\\1-/')
 
     File.join Gem.spec_cache_dir, "#{uri.host}%#{uri.port}", File.dirname(escaped_path)
   end
@@ -137,11 +134,16 @@ class Gem::Source
 
     if File.exist? local_spec
       spec = Gem.read_binary local_spec
-      spec = Marshal.load(spec) rescue nil
+      Gem.load_safe_marshal
+      spec = begin
+               Gem::SafeMarshal.safe_load(spec)
+             rescue StandardError
+               nil
+             end
       return spec if spec
     end
 
-    source_uri.path << '.rz'
+    source_uri.path << ".rz"
 
     spec = fetcher.fetch_path source_uri
     spec = Gem::Util.inflate spec
@@ -150,13 +152,14 @@ class Gem::Source
       require "fileutils"
       FileUtils.mkdir_p cache_dir
 
-      File.open local_spec, 'wb' do |io|
+      File.open local_spec, "wb" do |io|
         io.write spec
       end
     end
 
+    Gem.load_safe_marshal
     # TODO: Investigate setting Gem::Specification#loaded_from to a URI
-    Marshal.load spec
+    Gem::SafeMarshal.safe_load spec
   end
 
   ##
@@ -186,8 +189,9 @@ class Gem::Source
 
     spec_dump = fetcher.cache_update_path spec_path, local_file, update_cache?
 
+    Gem.load_safe_marshal
     begin
-      Gem::NameTuple.from_list Marshal.load(spec_dump)
+      Gem::NameTuple.from_list Gem::SafeMarshal.safe_load(spec_dump)
     rescue ArgumentError
       if update_cache? && !retried
         FileUtils.rm local_file
@@ -209,14 +213,16 @@ class Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, '[Remote:', ']' do
-      q.breakable
-      q.text @uri.to_s
-
-      if api = uri
+    q.object_group(self) do
+      q.group 2, "[Remote:", "]" do
         q.breakable
-        q.text 'API URI: '
-        q.text api.to_s
+        q.text @uri.to_s
+
+        if api = uri
+          q.breakable
+          q.text "API URI: "
+          q.text api.to_s
+        end
       end
     end
   end
@@ -229,13 +235,13 @@ class Gem::Source
   private
 
   def enforce_trailing_slash(uri)
-    uri.merge(uri.path.gsub(/\/+$/, '') + '/')
+    uri.merge(uri.path.gsub(%r{/+$}, "") + "/")
   end
 end
 
-require_relative 'source/git'
-require_relative 'source/installed'
-require_relative 'source/specific_file'
-require_relative 'source/local'
-require_relative 'source/lock'
-require_relative 'source/vendor'
+require_relative "source/git"
+require_relative "source/installed"
+require_relative "source/specific_file"
+require_relative "source/local"
+require_relative "source/lock"
+require_relative "source/vendor"

data/lib/rubygems/source_list.rb

@@ -36,7 +36,7 @@ class Gem::SourceList
 
     list.replace ary
 
-    return list
+    list
   end
 
   def initialize_copy(other) # :nodoc:
@@ -44,15 +44,15 @@ class Gem::SourceList
   end
 
   ##
-  # Appends +obj+ to the source list which may be a Gem::Source, URI or URI
+  # Appends +obj+ to the source list which may be a Gem::Source, Gem::URI or URI
   # String.
 
   def <<(obj)
     src = case obj
-    when Gem::Source
-      obj
-    else
-      Gem::Source.new(obj)
+          when Gem::Source
+            obj
+          else
+            Gem::Source.new(obj)
     end
 
     @sources << src unless @sources.include?(src)
@@ -126,7 +126,7 @@ class Gem::SourceList
   # Gem::Source or a source URI.
 
   def include?(other)
-    if other.kind_of? Gem::Source
+    if other.is_a? Gem::Source
       @sources.include? other
     else
       @sources.find {|x| x.uri.to_s == other.to_s }
@@ -137,7 +137,7 @@ class Gem::SourceList
   # Deletes +source+ from the source list which may be a Gem::Source or a URI.
 
   def delete(source)
-    if source.kind_of? Gem::Source
+    if source.is_a? Gem::Source
       @sources.delete source
     else
       @sources.delete_if {|x| x.uri.to_s == source.to_s }

data/lib/rubygems/spec_fetcher.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
-require_relative 'remote_fetcher'
-require_relative 'user_interaction'
-require_relative 'errors'
-require_relative 'text'
-require_relative 'name_tuple'
+
+require_relative "remote_fetcher"
+require_relative "user_interaction"
+require_relative "errors"
+require_relative "text"
+require_relative "name_tuple"
 
 ##
 # SpecFetcher handles metadata updates from remote gem repositories.
@@ -68,9 +69,9 @@ class Gem::SpecFetcher
     @prerelease_specs = {}
 
     @caches = {
-      :latest => @latest_specs,
-      :prerelease => @prerelease_specs,
-      :released => @specs,
+      latest: @latest_specs,
+      prerelease: @prerelease_specs,
+      released: @specs,
     }
 
     @fetcher = Gem::RemoteFetcher.fetcher
@@ -91,14 +92,14 @@ class Gem::SpecFetcher
 
     list.each do |source, specs|
       if dependency.name.is_a?(String) && specs.respond_to?(:bsearch)
-        start_index = (0 ... specs.length).bsearch {|i| specs[i].name >= dependency.name }
-        end_index   = (0 ... specs.length).bsearch {|i| specs[i].name > dependency.name }
-        specs = specs[start_index ... end_index] if start_index && end_index
+        start_index = (0...specs.length).bsearch {|i| specs[i].name >= dependency.name }
+        end_index   = (0...specs.length).bsearch {|i| specs[i].name > dependency.name }
+        specs = specs[start_index...end_index] if start_index && end_index
       end
 
       found[source] = specs.select do |tup|
         if dependency.match?(tup)
-          if matching_platform and !Gem::Platform.match_gem?(tup.platform, tup.name)
+          if matching_platform && !Gem::Platform.match_gem?(tup.platform, tup.name)
             pm = (
               rejected_specs[dependency] ||= \
                 Gem::PlatformMismatch.new(tup.name, tup.version))
@@ -123,7 +124,7 @@ class Gem::SpecFetcher
 
     tuples = tuples.sort_by {|x| x[0].version }
 
-    return [tuples, errors]
+    [tuples, errors]
   end
 
   ##
@@ -154,16 +155,14 @@ class Gem::SpecFetcher
 
     specs = []
     tuples.each do |tup, source|
-      begin
-        spec = source.fetch_spec(tup)
-      rescue Gem::RemoteFetcher::FetchError => e
-        errors << Gem::SourceFetchProblem.new(source, e)
-      else
-        specs << [spec, source]
-      end
+      spec = source.fetch_spec(tup)
+    rescue Gem::RemoteFetcher::FetchError => e
+      errors << Gem::SourceFetchProblem.new(source, e)
+    else
+      specs << [spec, source]
     end
 
-    return [specs, errors]
+    [specs, errors]
   end
 
   ##
@@ -171,32 +170,64 @@ class Gem::SpecFetcher
   # alternative gem names.
 
   def suggest_gems_from_name(gem_name, type = :latest, num_results = 5)
-    gem_name        = gem_name.downcase.tr('_-', '')
-    max             = gem_name.size / 2
-    names           = available_specs(type).first.values.flatten(1)
+    gem_name = gem_name.downcase.tr("_-", "")
+
+    # All results for 3-character-or-shorter (minus hyphens/underscores) gem
+    # names get rejected, so we just return an empty array immediately instead.
+    return [] if gem_name.length <= 3
 
-    matches = names.map do |n|
+    max   = gem_name.size / 2
+    names = available_specs(type).first.values.flatten(1)
+
+    min_length = gem_name.length - max
+    max_length = gem_name.length + max
+
+    gem_name_with_postfix = "#{gem_name}ruby"
+    gem_name_with_prefix = "ruby#{gem_name}"
+
+    matches = names.filter_map do |n|
+      len = n.name.length
+      # If the gem doesn't support the current platform, bail early.
       next unless n.match_platform?
-      [n.name, 0] if n.name.downcase.tr('_-', '').include?(gem_name)
-    end.compact
-
-    if matches.length < num_results
-      matches += names.map do |n|
-        next unless n.match_platform?
-        distance = levenshtein_distance gem_name, n.name.downcase.tr('_-', '')
-        next if distance >= max
-        return [n.name] if distance == 0
-        [n.name, distance]
-      end.compact
+
+      # If the length is min_length or shorter, we've done `max` deletions.
+      # This would be rejected later, so we skip it for performance.
+      next if len <= min_length
+
+      # The candidate name, normalized the same as gem_name.
+      normalized_name = n.name.downcase
+      normalized_name.tr!("_-", "")
+
+      # If the gem is "{NAME}-ruby" and "ruby-{NAME}", we want to return it.
+      # But we already removed hyphens, so we check "{NAME}ruby" and "ruby{NAME}".
+      next [n.name, 0] if normalized_name == gem_name_with_postfix
+      next [n.name, 0] if normalized_name == gem_name_with_prefix
+
+      # If the length is max_length or longer, we've done `max` insertions.
+      # This would be rejected later, so we skip it for performance.
+      next if len >= max_length
+
+      # If we found an exact match (after stripping underscores and hyphens),
+      # that's our most likely candidate.
+      # Return it immediately, and skip the rest of the loop.
+      return [n.name] if normalized_name == gem_name
+
+      distance = levenshtein_distance gem_name, normalized_name
+
+      # Skip current candidate, if the edit distance is greater than allowed.
+      next if distance >= max
+
+      # If all else fails, return the name and the calculated distance.
+      [n.name, distance]
     end
 
     matches = if matches.empty? && type != :prerelease
       suggest_gems_from_name gem_name, :prerelease
     else
-      matches.uniq.sort_by {|name, dist| dist }
+      matches.uniq.sort_by {|_name, dist| dist }
     end
 
-    matches.map {|name, dist| name }.uniq.first(num_results)
+    matches.map {|name, _dist| name }.uniq.first(num_results)
   end
 
   ##
@@ -214,34 +245,32 @@ class Gem::SpecFetcher
     list = {}
 
     @sources.each_source do |source|
-      begin
-        names = case type
-        when :latest
-          tuples_for source, :latest
-        when :released
-          tuples_for source, :released
-        when :complete
-          names =
-            tuples_for(source, :prerelease, true) +
-            tuples_for(source, :released)
-
-          names.sort
-        when :abs_latest
-          names =
-            tuples_for(source, :prerelease, true) +
-            tuples_for(source, :latest)
-
-          names.sort
-        when :prerelease
-          tuples_for(source, :prerelease)
-        else
-          raise Gem::Exception, "Unknown type - :#{type}"
-        end
-      rescue Gem::RemoteFetcher::FetchError => e
-        errors << Gem::SourceFetchProblem.new(source, e)
-      else
-        list[source] = names
+      names = case type
+              when :latest
+                tuples_for source, :latest
+              when :released
+                tuples_for source, :released
+              when :complete
+                names =
+                  tuples_for(source, :prerelease, true) +
+                  tuples_for(source, :released)
+
+                names.sort
+              when :abs_latest
+                names =
+                  tuples_for(source, :prerelease, true) +
+                  tuples_for(source, :latest)
+
+                names.sort
+              when :prerelease
+                tuples_for(source, :prerelease)
+              else
+                raise Gem::Exception, "Unknown type - :#{type}"
       end
+    rescue Gem::RemoteFetcher::FetchError => e
+      errors << Gem::SourceFetchProblem.new(source, e)
+    else
+      list[source] = names
     end
 
     [list, errors]
@@ -253,7 +282,7 @@ class Gem::SpecFetcher
 
   def tuples_for(source, type, gracefully_ignore=false) # :nodoc:
     @caches[type][source.uri] ||=
-      source.load_specs(type).sort_by {|tup| tup.name }
+      source.load_specs(type).sort_by(&:name)
   rescue Gem::RemoteFetcher::FetchError
     raise unless gracefully_ignore
     []