rubygems-update 3.3.26 → 3.4.18

data/lib/rubygems/gemcutter_utilities/webauthn_listener.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require_relative "webauthn_listener/response"
+
+##
+# The WebauthnListener class retrieves an OTP after a user successfully WebAuthns with the Gem host.
+# An instance opens a socket using the TCPServer instance given and listens for a request from the Gem host.
+# The request should be a GET request to the root path and contains the OTP code in the form
+# of a query parameter `code`. The listener will return the code which will be used as the OTP for
+# API requests.
+#
+# Types of responses sent by the listener after receiving a request:
+#   - 200 OK: OTP code was successfully retrieved
+#   - 204 No Content: If the request was an OPTIONS request
+#   - 400 Bad Request: If the request did not contain a query parameter `code`
+#   - 404 Not Found: The request was not to the root path
+#   - 405 Method Not Allowed: OTP code was not retrieved because the request was not a GET/OPTIONS request
+#
+# Example usage:
+#
+#   thread = Gem::WebauthnListener.listener_thread("https://rubygems.example", server)
+#   thread.join
+#   otp = thread[:otp]
+#   error = thread[:error]
+#
+
+module Gem::GemcutterUtilities
+  class WebauthnListener
+    attr_reader :host
+
+    def initialize(host)
+      @host = host
+    end
+
+    def self.listener_thread(host, server)
+      Thread.new do
+        thread = Thread.current
+        thread.abort_on_exception = true
+        thread.report_on_exception = false
+        thread[:otp] = new(host).wait_for_otp_code(server)
+      rescue Gem::WebauthnVerificationError => e
+        thread[:error] = e
+      ensure
+        server.close
+      end
+    end
+
+    def wait_for_otp_code(server)
+      loop do
+        socket = server.accept
+        request_line = socket.gets
+
+        method, req_uri, _protocol = request_line.split(" ")
+        req_uri = URI.parse(req_uri)
+
+        responder = SocketResponder.new(socket)
+
+        unless root_path?(req_uri)
+          responder.send(NotFoundResponse.for(host))
+          raise Gem::WebauthnVerificationError, "Page at #{req_uri.path} not found."
+        end
+
+        case method.upcase
+        when "OPTIONS"
+          responder.send(NoContentResponse.for(host))
+          next # will be GET
+        when "GET"
+          if otp = parse_otp_from_uri(req_uri)
+            responder.send(OkResponse.for(host))
+            return otp
+          end
+          responder.send(BadRequestResponse.for(host))
+          raise Gem::WebauthnVerificationError, "Did not receive OTP from #{host}."
+        else
+          responder.send(MethodNotAllowedResponse.for(host))
+          raise Gem::WebauthnVerificationError, "Invalid HTTP method #{method.upcase} received."
+        end
+      end
+    end
+
+    private
+
+    def root_path?(uri)
+      uri.path == "/"
+    end
+
+    def parse_otp_from_uri(uri)
+      require "cgi"
+
+      return if uri.query.nil?
+      CGI.parse(uri.query).dig("code", 0)
+    end
+
+    class SocketResponder
+      def initialize(socket)
+        @socket = socket
+      end
+
+      def send(response)
+        @socket.print response.to_s
+        @socket.close
+      end
+    end
+  end
+end

data/lib/rubygems/gemcutter_utilities/webauthn_poller.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+##
+# The WebauthnPoller class retrieves an OTP after a user successfully WebAuthns. An instance
+# polls the Gem host for the OTP code. The polling request (api/v1/webauthn_verification/<webauthn_token>/status.json)
+# is sent to the Gem host every 5 seconds and will timeout after 5 minutes. If the status field in the json response
+# is "success", the code field will contain the OTP code.
+#
+# Example usage:
+#
+#   thread = Gem::WebauthnPoller.poll_thread(
+#     {},
+#     "RubyGems.org",
+#     "https://rubygems.org/api/v1/webauthn_verification/odow34b93t6aPCdY",
+#     { email: "email@example.com", password: "password" }
+#   )
+#   thread.join
+#   otp = thread[:otp]
+#   error = thread[:error]
+#
+
+module Gem::GemcutterUtilities
+  class WebauthnPoller
+    include Gem::GemcutterUtilities
+    TIMEOUT_IN_SECONDS = 300
+
+    attr_reader :options, :host
+
+    def initialize(options, host)
+      @options = options
+      @host = host
+    end
+
+    def self.poll_thread(options, host, webauthn_url, credentials)
+      Thread.new do
+        thread = Thread.current
+        thread.abort_on_exception = true
+        thread.report_on_exception = false
+        thread[:otp] = new(options, host).poll_for_otp(webauthn_url, credentials)
+      rescue Gem::WebauthnVerificationError, Timeout::Error => e
+        thread[:error] = e
+      end
+    end
+
+    def poll_for_otp(webauthn_url, credentials)
+      Timeout.timeout(TIMEOUT_IN_SECONDS) do
+        loop do
+          response = webauthn_verification_poll_response(webauthn_url, credentials)
+          raise Gem::WebauthnVerificationError, response.message unless response.is_a?(Net::HTTPSuccess)
+
+          require "json"
+          parsed_response = JSON.parse(response.body)
+          case parsed_response["status"]
+          when "pending"
+            sleep 5
+          when "success"
+            return parsed_response["code"]
+          else
+            raise Gem::WebauthnVerificationError, parsed_response.fetch("message", "Invalid response from server")
+          end
+        end
+      end
+    end
+
+    private
+
+    def webauthn_verification_poll_response(webauthn_url, credentials)
+      webauthn_token = %r{(?<=\/)[^\/]+(?=$)}.match(webauthn_url)[0]
+      rubygems_api_request(:get, "api/v1/webauthn_verification/#{webauthn_token}/status.json") do |request|
+        if credentials.empty?
+          request.add_field "Authorization", api_key
+        else
+          request.basic_auth credentials[:email], credentials[:password]
+        end
+      end
+    end
+  end
+end

data/lib/rubygems/gemcutter_utilities.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
+
 require_relative "remote_fetcher"
 require_relative "text"
+require_relative "gemcutter_utilities/webauthn_listener"
+require_relative "gemcutter_utilities/webauthn_poller"
 
 ##
 # Utility methods for using the RubyGems API.
@@ -82,7 +85,7 @@ module Gem::GemcutterUtilities
   #
   # If +allowed_push_host+ metadata is present, then it will only allow that host.
 
-  def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, &block)
+  def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, credentials: {}, &block)
     require "net/http"
 
     self.host = host if host
@@ -105,7 +108,7 @@ module Gem::GemcutterUtilities
     response = request_with_otp(method, uri, &block)
 
     if mfa_unauthorized?(response)
-      ask_otp
+      fetch_otp(credentials)
       response = request_with_otp(method, uri, &block)
     end
 
@@ -167,11 +170,12 @@ module Gem::GemcutterUtilities
     mfa_params   = get_mfa_params(profile)
     all_params   = scope_params.merge(mfa_params)
     warning      = profile["warning"]
+    credentials  = { email: email, password: password }
 
     say "#{warning}\n" if warning
 
     response = rubygems_api_request(:post, "api/v1/api_key",
-                                    sign_in_host, scope: scope) do |request|
+                                    sign_in_host, credentials: credentials, scope: scope) do |request|
       request.basic_auth email, password
       request["OTP"] = otp if otp
       request.body = URI.encode_www_form({ name: key_name }.merge(all_params))
@@ -250,9 +254,52 @@ module Gem::GemcutterUtilities
     end
   end
 
-  def ask_otp
-    say "You have enabled multi-factor authentication. Please enter OTP code."
-    options[:otp] = ask "Code: "
+  def fetch_otp(credentials)
+    options[:otp] = if webauthn_url = webauthn_verification_url(credentials)
+      server = TCPServer.new 0
+      port = server.addr[1].to_s
+
+      url_with_port = "#{webauthn_url}?port=#{port}"
+      say "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option."
+
+      threads = [WebauthnListener.listener_thread(host, server), WebauthnPoller.poll_thread(options, host, webauthn_url, credentials)]
+      otp_thread = wait_for_otp_thread(*threads)
+
+      threads.each(&:join)
+
+      if error = otp_thread[:error]
+        alert_error error.message
+        terminate_interaction(1)
+      end
+
+      say "You are verified with a security device. You may close the browser window."
+      otp_thread[:otp]
+    else
+      say "You have enabled multi-factor authentication. Please enter OTP code."
+      ask "Code: "
+    end
+  end
+
+  def wait_for_otp_thread(*threads)
+    loop do
+      threads.each do |otp_thread|
+        return otp_thread unless otp_thread.alive?
+      end
+      sleep 0.1
+    end
+  ensure
+    threads.each(&:exit)
+  end
+
+  def webauthn_verification_url(credentials)
+    response = rubygems_api_request(:post, "api/v1/webauthn_verification") do |request|
+      if credentials.empty?
+        request.add_field "Authorization", api_key
+      else
+        request.basic_auth credentials[:email], credentials[:password]
+      end
+    end
+    response.is_a?(Net::HTTPSuccess) ? response.body : nil
   end
 
   def pretty_host(host)

data/lib/rubygems/indexer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 require_relative "package"
 require "tmpdir"
@@ -397,7 +398,7 @@ class Gem::Indexer
       dst_name = File.join @dest_directory, file # REFACTOR: duped above
 
       FileUtils.mv src_name, dst_name, :verbose => verbose,
-                   :force => true
+                                       :force => true
 
       File.utime newest_mtime, newest_mtime, dst_name
     end

data/lib/rubygems/install_default_message.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 require_relative "user_interaction"
 

data/lib/rubygems/install_message.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "../rubygems"
 require_relative "user_interaction"
 

data/lib/rubygems/install_update_options.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/installer.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.
@@ -234,8 +235,8 @@ class Gem::Installer
       io.gets # blankline
 
       # TODO detect a specially formatted comment instead of trying
-      # to run a regexp against Ruby code.
-      next unless io.gets =~ /This file was generated by RubyGems/
+      # to find a string inside Ruby code.
+      next unless io.gets.to_s.include?("This file was generated by RubyGems")
 
       ruby_executable = true
       existing = io.read.slice(%r{
@@ -342,6 +343,8 @@ class Gem::Installer
 
     Gem::Specification.add_spec(spec)
 
+    load_plugin
+
     run_post_install_hooks
 
     spec
@@ -388,7 +391,7 @@ class Gem::Installer
   # we'll be installing into.
 
   def installed_specs
-    @specs ||= begin
+    @installed_specs ||= begin
       specs = []
 
       Gem::Util.glob_files_in_dir("*.gemspec", File.join(gem_home, "specifications")).each do |path|
@@ -649,9 +652,9 @@ class Gem::Installer
 
   def process_options # :nodoc:
     @options = {
-      :bin_dir      => nil,
-      :env_shebang  => false,
-      :force        => false,
+      :bin_dir => nil,
+      :env_shebang => false,
+      :force => false,
       :only_install_dir => false,
       :post_install_message => true,
     }.merge options
@@ -1002,4 +1005,17 @@ TEXT
       ""
     end
   end
+
+  def load_plugin
+    specs = Gem::Specification.find_all_by_name(spec.name)
+    # If old version already exists, this plugin isn't loaded
+    # immediately. It's for avoiding a case that multiple versions
+    # are loaded at the same time.
+    return unless specs.size == 1
+
+    plugin_files = spec.plugins.map do |plugin|
+      File.join(@plugins_dir, "#{spec.name}_plugin#{File.extname(plugin)}")
+    end
+    Gem.load_plugin_files(plugin_files)
+  end
 end

data/lib/rubygems/local_remote_options.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/mock_gem_ui.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "user_interaction"
 
 ##

data/lib/rubygems/name_tuple.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 #
 # Represents a gem of name +name+ at +version+ of +platform+. These

data/lib/rubygems/optparse/lib/optparse.rb

@@ -425,7 +425,7 @@
 # If you have any questions, file a ticket at http://bugs.ruby-lang.org.
 #
 class Gem::OptionParser
-  Gem::OptionParser::Version = "0.2.0"
+  Gem::OptionParser::Version = "0.3.0"
 
   # :stopdoc:
   NoArgument = [NO_ARGUMENT = :NONE, nil].freeze
@@ -765,15 +765,15 @@ class Gem::OptionParser
     end
 
     #
-    # Switch that takes an argument, which does not begin with '-'.
+    # Switch that takes an argument, which does not begin with '-' or is '-'.
     #
     class PlacedArgument < self
 
       #
-      # Returns nil if argument is not present or begins with '-'.
+      # Returns nil if argument is not present or begins with '-' and is not '-'.
       #
       def parse(arg, argv, &error)
-        if !(val = arg) and (argv.empty? or /\A-/ =~ (val = argv[0]))
+        if !(val = arg) and (argv.empty? or /\A-./ =~ (val = argv[0]))
           return nil, block, nil
         end
         opt = (val = parse_arg(val, &error))[1]
@@ -1148,6 +1148,7 @@ XXX
     @summary_indent = indent
     @default_argv = ARGV
     @require_exact = false
+    @raise_unknown = true
     add_officious
     yield self if block_given?
   end
@@ -1225,6 +1226,9 @@ XXX
   # abbreviated long option as short option).
   attr_accessor :require_exact
 
+  # Whether to raise at unknown option.
+  attr_accessor :raise_unknown
+
   #
   # Heading banner preceding summary.
   #
@@ -1502,7 +1506,7 @@ XXX
         style = notwice(default_style.guess(arg = o), style, 'style')
         default_pattern, conv = search(:atype, Object) unless default_pattern
       else
-        desc.push(o)
+        desc.push(o) if o && !o.empty?
       end
     end
 
@@ -1639,9 +1643,11 @@ XXX
           begin
             sw, = complete(:long, opt, true)
             if require_exact && !sw.long.include?(arg)
+              throw :terminate, arg unless raise_unknown
               raise InvalidOption, arg
             end
           rescue ParseError
+            throw :terminate, arg unless raise_unknown
             raise $!.set_option(arg, true)
           end
           begin
@@ -1673,6 +1679,7 @@ XXX
               end
             end
           rescue ParseError
+            throw :terminate, arg unless raise_unknown
             raise $!.set_option(arg, true)
           end
           begin
@@ -1862,12 +1869,7 @@ XXX
     end
     all_candidates.select! {|cand| cand.is_a?(String) }
     checker = DidYouMean::SpellChecker.new(dictionary: all_candidates)
-    suggestions = all_candidates & checker.correct(opt)
-    if DidYouMean.respond_to?(:formatter)
-      DidYouMean.formatter.message_for(suggestions)
-    else
-       "\nDid you mean?  #{suggestions.join("\n               ")}"
-    end
+    DidYouMean.formatter.message_for(all_candidates & checker.correct(opt))
   end
 
   def candidate(word)
@@ -1908,10 +1910,13 @@ XXX
   # directory ~/.options, then the basename with '.options' suffix
   # under XDG and Haiku standard places.
   #
-  def load(filename = nil)
+  # The optional +into+ keyword argument works exactly like that accepted in
+  # method #parse.
+  #
+  def load(filename = nil, into: nil)
     unless filename
       basename = File.basename($0, '.*')
-      return true if load(File.expand_path(basename, '~/.options')) rescue nil
+      return true if load(File.expand_path(basename, '~/.options'), into: into) rescue nil
       basename << ".options"
       return [
         # XDG
@@ -1923,11 +1928,11 @@ XXX
         '~/config/settings',
       ].any? {|dir|
         next if !dir or dir.empty?
-        load(File.expand_path(basename, dir)) rescue nil
+        load(File.expand_path(basename, dir), into: into) rescue nil
       }
     end
     begin
-      parse(*IO.readlines(filename).each {|s| s.chomp!})
+      parse(*File.readlines(filename, chomp: true), into: into)
       true
     rescue Errno::ENOENT, Errno::ENOTDIR
       false

data/lib/rubygems/package/digest_io.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # IO wrapper that creates digests of contents written to the IO it wraps.
 

data/lib/rubygems/package/file_source.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # The primary source of gems is a file on disk, including all usages
 # internal to rubygems.

data/lib/rubygems/package/io_source.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 ##
 # Supports reading and writing gems from/to a generic IO object.  This is
 # useful for other applications built on top of rubygems, such as

data/lib/rubygems/package/old.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright 2006 by Chad Fowler, Rich Kilmer, Jim Weirich and others.
 # All rights reserved.

data/lib/rubygems/package/source.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
+
 class Gem::Package::Source # :nodoc:
 end

data/lib/rubygems/package/tar_header.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 #--
 # Copyright (C) 2004 Mauricio Julio Fernández Pradier
 # See LICENSE.txt for additional licensing information.
@@ -103,22 +104,22 @@ class Gem::Package::TarHeader
 
     fields = header.unpack UNPACK_FORMAT
 
-    new :name     => fields.shift,
-        :mode     => strict_oct(fields.shift),
-        :uid      => oct_or_256based(fields.shift),
-        :gid      => oct_or_256based(fields.shift),
-        :size     => strict_oct(fields.shift),
-        :mtime    => strict_oct(fields.shift),
+    new :name => fields.shift,
+        :mode => strict_oct(fields.shift),
+        :uid => oct_or_256based(fields.shift),
+        :gid => oct_or_256based(fields.shift),
+        :size => strict_oct(fields.shift),
+        :mtime => strict_oct(fields.shift),
         :checksum => strict_oct(fields.shift),
         :typeflag => fields.shift,
         :linkname => fields.shift,
-        :magic    => fields.shift,
-        :version  => strict_oct(fields.shift),
-        :uname    => fields.shift,
-        :gname    => fields.shift,
+        :magic => fields.shift,
+        :version => strict_oct(fields.shift),
+        :uname => fields.shift,
+        :gname => fields.shift,
         :devmajor => strict_oct(fields.shift),
         :devminor => strict_oct(fields.shift),
-        :prefix   => fields.shift,
+        :prefix => fields.shift,
 
         :empty => empty
   end
@@ -208,7 +209,7 @@ class Gem::Package::TarHeader
   private
 
   def calculate_checksum(header)
-    header.unpack("C*").inject {|a, b| a + b }
+    header.sum(0)
   end
 
   def header(checksum = @checksum)