rubygems-update 3.3.26 → 3.4.18

data/test/rubygems/test_gem_util.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/util"
 

data/test/rubygems/test_gem_version.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/version"
 
@@ -43,7 +44,7 @@ class TestGemVersion < Gem::TestCase
 
     assert_equal v("5.1"), Gem::Version.create("5.1")
 
-    ver = "1.1".freeze
+    ver = "1.1"
     assert_equal v("1.1"), Gem::Version.create(ver)
   end
 
@@ -88,7 +89,7 @@ class TestGemVersion < Gem::TestCase
   end
 
   def test_initialize
-    ["1.0", "1.0 ", " 1.0 ", "1.0\n", "\n1.0\n", "1.0".freeze].each do |good|
+    ["1.0", "1.0 ", " 1.0 ", "1.0\n", "\n1.0\n", "1.0"].each do |good|
       assert_version_equal "1.0", good
     end
 

data/test/rubygems/test_gem_version_option.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems/command"
 require "rubygems/version_option"

data/test/rubygems/test_kernel.rb

@@ -1,26 +1,19 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
-class TestKernel < Gem::TestCase
+class TestGemKernel < Gem::TestCase
   def setup
     super
 
-    @old_path = $:.dup
-
     util_make_gems
 
     without_any_upwards_gemfiles
   end
 
-  def teardown
-    super
-
-    $:.replace @old_path
-  end
-
   def test_gem
     assert gem("a", "= 1"), "Should load"
-    assert $:.any? {|p| %r{a-1/lib} =~ p }
+    assert $:.any? {|p| p.include?("a-1/lib") }
   end
 
   def test_gem_default
@@ -50,13 +43,13 @@ class TestKernel < Gem::TestCase
   def test_gem_redundant
     assert gem("a", "= 1"), "Should load"
     refute gem("a", "= 1"), "Should not load"
-    assert_equal 1, $:.select {|p| %r{a-1/lib} =~ p }.size
+    assert_equal 1, $:.select {|p| p.include?("a-1/lib") }.size
   end
 
   def test_gem_overlapping
     assert gem("a", "= 1"), "Should load"
     refute gem("a", ">= 1"), "Should not load"
-    assert_equal 1, $:.select {|p| %r{a-1/lib} =~ p }.size
+    assert_equal 1, $:.select {|p| p.include?("a-1/lib") }.size
   end
 
   def test_gem_prerelease
@@ -83,13 +76,13 @@ class TestKernel < Gem::TestCase
     assert_match(/activated a-1/, ex.message)
     assert_equal "a", ex.name
 
-    assert $:.any? {|p| %r{a-1/lib} =~ p }
-    refute $:.any? {|p| %r{a-2/lib} =~ p }
+    assert $:.any? {|p| p.include?("a-1/lib") }
+    refute $:.any? {|p| p.include?("a-2/lib") }
   end
 
   def test_gem_not_adding_bin
     assert gem("a", "= 1"), "Should load"
-    refute $:.any? {|p| %r{a-1/bin} =~ p }
+    refute $:.any? {|p| p.include?("a-1/bin") }
   end
 
   def test_gem_failing_inside_require_doesnt_cause_double_exceptions
@@ -114,16 +107,18 @@ class TestKernel < Gem::TestCase
     quick_gem "bundler", "2.a"
 
     assert gem("bundler")
-    assert $:.any? {|p| %r{bundler-1/lib} =~ p }
+    assert $:.any? {|p| p.include?("bundler-1/lib") }
   end
 
   def test_gem_bundler_inferred_bundler_version
+    require "rubygems/bundler_version_finder"
+
     Gem::BundlerVersionFinder.stub(:bundler_version, Gem::Version.new("1")) do
       quick_gem "bundler", "1"
       quick_gem "bundler", "2.a"
 
       assert gem("bundler", ">= 0.a")
-      assert $:.any? {|p| %r{bundler-1/lib} =~ p }
+      assert $:.any? {|p| p.include?("bundler-1/lib") }
     end
   end
 end

data/test/rubygems/test_project_sanity.rb

@@ -3,13 +3,36 @@
 require_relative "helper"
 require "open3"
 
-class TestProjectSanity < Gem::TestCase
+class TestGemProjectSanity < Gem::TestCase
+  def setup
+  end
+
+  def teardown
+  end
+
   def test_manifest_is_up_to_date
-    pend unless File.exist?(File.expand_path("../../Rakefile", __dir__))
+    pend unless File.exist?("#{root}/Rakefile")
 
     _, status = Open3.capture2e("rake check_manifest")
 
-    assert status.success?, "Expected Manifest.txt to be up to date, but it's not. Run `rake update_manifest` to sync it."
+    unless status.success?
+      original_contents = File.read("#{root}/Manifest.txt")
+
+      # Update the manifest to see if it fixes the problem
+      Open3.capture2e("rake update_manifest")
+
+      out, status = Open3.capture2e("rake check_manifest")
+
+      # If `rake update_manifest` fixed the problem, that was the original
+      # issue, otherwise it was an unknown error, so print the error output
+      if status.success?
+        File.write("#{root}/Manifest.txt", original_contents)
+
+        raise "Expected Manifest.txt to be up to date, but it's not. Run `rake update_manifest` to sync it."
+      else
+        raise "There was an error running `rake check_manifest`: #{out}"
+      end
+    end
   end
 
   def test_require_rubygems_package
@@ -17,4 +40,10 @@ class TestProjectSanity < Gem::TestCase
 
     assert status.success?, err
   end
+
+  private
+
+  def root
+    File.expand_path("../..", __dir__)
+  end
 end

data/test/rubygems/test_remote_fetch_error.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 
-class TestRemoteFetchError < Gem::TestCase
+class TestGemRemoteFetchError < Gem::TestCase
   def test_password_redacted
     error = Gem::RemoteFetcher::FetchError.new("There was an error fetching", "https://user:secret@gemsource.org")
     refute_match %r{secret}, error.to_s

data/test/rubygems/test_require.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require_relative "helper"
 require "rubygems"
 
@@ -596,79 +597,93 @@ class TestGemRequire < Gem::TestCase
     assert_empty unresolved_names
   end
 
-  # uplevel is 2.5+ only
-  if RUBY_VERSION >= "2.5"
-    ["", "Kernel."].each do |prefix|
-      define_method "test_no_kernel_require_in_#{prefix.tr(".", "_")}warn_with_uplevel" do
-        Dir.mktmpdir("warn_test") do |dir|
-          File.write(dir + "/sub.rb", "#{prefix}warn 'uplevel', 'test', uplevel: 1\n")
-          File.write(dir + "/main.rb", "require 'sub'\n")
-          _, err = capture_subprocess_io do
-            system(*ruby_with_rubygems_in_load_path, "-w", "--disable=gems", "-C", dir, "-I", dir, "main.rb")
-          end
-          assert_match(/main\.rb:1: warning: uplevel\ntest\n$/, err)
-          _, err = capture_subprocess_io do
-            system(*ruby_with_rubygems_in_load_path, "-w", "--enable=gems", "-C", dir, "-I", dir, "main.rb")
-          end
-          assert_match(/main\.rb:1: warning: uplevel\ntest\n$/, err)
+  ["", "Kernel."].each do |prefix|
+    define_method "test_no_kernel_require_in_#{prefix.tr(".", "_")}warn_with_uplevel" do
+      Dir.mktmpdir("warn_test") do |dir|
+        File.write(dir + "/sub.rb", "#{prefix}warn 'uplevel', 'test', uplevel: 1\n")
+        File.write(dir + "/main.rb", "require 'sub'\n")
+        _, err = capture_subprocess_io do
+          system(*ruby_with_rubygems_in_load_path, "-w", "--disable=gems", "-C", dir, "-I", dir, "main.rb")
         end
-      end
-
-      define_method "test_no_other_behavioral_changes_with_#{prefix.tr(".", "_")}warn" do
-        Dir.mktmpdir("warn_test") do |dir|
-          File.write(dir + "/main.rb", "#{prefix}warn({x:1}, {y:2}, [])\n")
-          _, err = capture_subprocess_io do
-            system(*ruby_with_rubygems_in_load_path, "-w", "--disable=gems", "-C", dir, "main.rb")
-          end
-          assert_match(/{:x=>1}\n{:y=>2}\n$/, err)
-          _, err = capture_subprocess_io do
-            system(*ruby_with_rubygems_in_load_path, "-w", "--enable=gems", "-C", dir, "main.rb")
-          end
-          assert_match(/{:x=>1}\n{:y=>2}\n$/, err)
+        assert_match(/main\.rb:1: warning: uplevel\ntest\n$/, err)
+        _, err = capture_subprocess_io do
+          system(*ruby_with_rubygems_in_load_path, "-w", "--enable=gems", "-C", dir, "-I", dir, "main.rb")
         end
+        assert_match(/main\.rb:1: warning: uplevel\ntest\n$/, err)
       end
     end
 
-    def test_no_crash_when_overriding_warn_with_warning_module
+    define_method "test_no_other_behavioral_changes_with_#{prefix.tr(".", "_")}warn" do
       Dir.mktmpdir("warn_test") do |dir|
-        File.write(dir + "/main.rb", "module Warning; def warn(str); super; end; end; warn 'Foo Bar'")
+        File.write(dir + "/main.rb", "#{prefix}warn({x:1}, {y:2}, [])\n")
         _, err = capture_subprocess_io do
           system(*ruby_with_rubygems_in_load_path, "-w", "--disable=gems", "-C", dir, "main.rb")
         end
-        assert_match(/Foo Bar\n$/, err)
+        assert_match(/{:x=>1}\n{:y=>2}\n$/, err)
         _, err = capture_subprocess_io do
           system(*ruby_with_rubygems_in_load_path, "-w", "--enable=gems", "-C", dir, "main.rb")
         end
-        assert_match(/Foo Bar\n$/, err)
+        assert_match(/{:x=>1}\n{:y=>2}\n$/, err)
       end
     end
+  end
 
-    def test_expected_backtrace_location_when_inheriting_from_basic_object_and_including_kernel
-      Dir.mktmpdir("warn_test") do |dir|
-        File.write(dir + "/main.rb", "\nrequire 'sub'\n")
-        File.write(dir + "/sub.rb", <<-'RUBY')
-          require 'rubygems'
-          class C < BasicObject
-            include ::Kernel
-            def deprecated
-              warn "This is a deprecated method", uplevel: 2
-            end
-          end
-          C.new.deprecated
-        RUBY
+  def test_no_crash_when_overriding_warn_with_warning_module
+    Dir.mktmpdir("warn_test") do |dir|
+      File.write(dir + "/main.rb", "module Warning; def warn(str); super; end; end; warn 'Foo Bar'")
+      _, err = capture_subprocess_io do
+        system(*ruby_with_rubygems_in_load_path, "-w", "--disable=gems", "-C", dir, "main.rb")
+      end
+      assert_match(/Foo Bar\n$/, err)
+      _, err = capture_subprocess_io do
+        system(*ruby_with_rubygems_in_load_path, "-w", "--enable=gems", "-C", dir, "main.rb")
+      end
+      assert_match(/Foo Bar\n$/, err)
+    end
+  end
 
-        _, err = capture_subprocess_io do
-          system(*ruby_with_rubygems_in_load_path, "-w", "--disable=gems", "-C", dir, "-I", dir, "main.rb")
-        end
-        assert_match(/main\.rb:2: warning: This is a deprecated method$/, err)
-        _, err = capture_subprocess_io do
-          system(*ruby_with_rubygems_in_load_path, "-w", "--enable=gems", "-C", dir, "-I", dir, "main.rb")
+  def test_expected_backtrace_location_when_inheriting_from_basic_object_and_including_kernel
+    Dir.mktmpdir("warn_test") do |dir|
+      File.write(dir + "/main.rb", "\nrequire 'sub'\n")
+      File.write(dir + "/sub.rb", <<-'RUBY')
+        require 'rubygems'
+        class C < BasicObject
+          include ::Kernel
+          def deprecated
+            warn "This is a deprecated method", uplevel: 2
+          end
         end
-        assert_match(/main\.rb:2: warning: This is a deprecated method$/, err)
+        C.new.deprecated
+      RUBY
+
+      _, err = capture_subprocess_io do
+        system(*ruby_with_rubygems_in_load_path, "-w", "--disable=gems", "-C", dir, "-I", dir, "main.rb")
       end
+      assert_match(/main\.rb:2: warning: This is a deprecated method$/, err)
+      _, err = capture_subprocess_io do
+        system(*ruby_with_rubygems_in_load_path, "-w", "--enable=gems", "-C", dir, "-I", dir, "main.rb")
+      end
+      assert_match(/main\.rb:2: warning: This is a deprecated method$/, err)
     end
   end
 
+  def test_require_does_not_crash_when_utilizing_bundler_version_finder
+    a1 = util_spec "a", "1.1", { "bundler" => ">= 0" }
+    a2 = util_spec "a", "1.2", { "bundler" => ">= 0" }
+    b1 = util_spec "bundler", "2.3.7"
+    b2 = util_spec "bundler", "2.3.24"
+    c = util_spec "c", "1", { "a" => [">= 1.1", "< 99.0"] }, "lib/test_gem_require_c.rb"
+
+    install_specs a1, a2, b1, b2, c
+
+    cmd = <<-RUBY
+      require "test_gem_require_c"
+      require "json"
+    RUBY
+    out = Gem::Util.popen({ "GEM_HOME" => @gemhome }, *ruby_with_rubygems_in_load_path, "-e", cmd)
+    assert_predicate $?, :success?, "Require failed due to #{out}"
+  end
+
   private
 
   def util_install_extension_file(name)
@@ -694,13 +709,13 @@ class TestGemRequire < Gem::TestCase
 
     spec.files += ["extconf.rb", "depend", "#{name}.c"]
 
-    so = File.join(spec.gem_dir, "#{name}.#{RbConfig::CONFIG["DLEXT"]}")
-    assert_path_not_exist so
+    extension_file = File.join(spec.extension_dir, "#{name}.#{RbConfig::CONFIG["DLEXT"]}")
+    assert_path_not_exist extension_file
 
     path = Gem::Package.build spec
     installer = Gem::Installer.at path
     installer.install
-    assert_path_exist so
+    assert_path_exist extension_file
 
     spec.gem_dir
   end

data/test/rubygems/test_rubygems.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "helper"
 
 class GemTest < Gem::TestCase

data/test/rubygems/test_webauthn_listener.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require_relative "helper"
+require "rubygems/gemcutter_utilities/webauthn_listener"
+require "rubygems/gemcutter_utilities"
+
+class WebauthnListenerTest < Gem::TestCase
+  def setup
+    super
+    @server = TCPServer.new 0
+    @port = @server.addr[1].to_s
+  end
+
+  def teardown
+    @thread.kill.join if @thread
+    @server&.close
+    super
+  end
+
+  def test_listener_thread_retreives_otp_code
+    thread = Gem::GemcutterUtilities::WebauthnListener.listener_thread(Gem.host, @server)
+    Gem::MockBrowser.get URI("http://localhost:#{@port}?code=xyz")
+
+    thread.join
+    assert_equal "xyz", thread[:otp]
+  end
+
+  def test_listener_thread_sets_error
+    thread = Gem::GemcutterUtilities::WebauthnListener.listener_thread(Gem.host, @server)
+    Gem::MockBrowser.post URI("http://localhost:#{@port}?code=xyz")
+
+    thread.join
+    assert_equal "Security device verification failed: Invalid HTTP method POST received.", thread[:error].message
+  end
+
+  def test_wait_for_otp_code_get_follows_options
+    wait_for_otp_code
+    assert Gem::MockBrowser.options(URI("http://localhost:#{@port}?code=xyz")).is_a? Net::HTTPNoContent
+    assert Gem::MockBrowser.get(URI("http://localhost:#{@port}?code=xyz")).is_a? Net::HTTPOK
+  end
+
+  def test_wait_for_otp_code_options_request
+    wait_for_otp_code
+    response = Gem::MockBrowser.options URI("http://localhost:#{@port}?code=xyz")
+
+    assert response.is_a? Net::HTTPNoContent
+    assert_equal Gem.host, response["access-control-allow-origin"]
+    assert_equal "POST", response["access-control-allow-methods"]
+    assert_equal "Content-Type, Authorization, x-csrf-token", response["access-control-allow-headers"]
+    assert_equal "close", response["Connection"]
+  end
+
+  def test_wait_for_otp_code_get_request
+    wait_for_otp_code
+    response = Gem::MockBrowser.get URI("http://localhost:#{@port}?code=xyz")
+
+    assert response.is_a? Net::HTTPOK
+    assert_equal "text/plain; charset=utf-8", response["Content-Type"]
+    assert_equal "7", response["Content-Length"]
+    assert_equal Gem.host, response["access-control-allow-origin"]
+    assert_equal "POST", response["access-control-allow-methods"]
+    assert_equal "Content-Type, Authorization, x-csrf-token", response["access-control-allow-headers"]
+    assert_equal "close", response["Connection"]
+    assert_equal "success", response.body
+
+    @thread.join
+    assert_equal "xyz", @thread[:otp]
+  end
+
+  def test_wait_for_otp_code_invalid_post_req_method
+    wait_for_otp_code_expect_error_with_message("Security device verification failed: Invalid HTTP method POST received.")
+    response = Gem::MockBrowser.post URI("http://localhost:#{@port}?code=xyz")
+
+    assert response
+    assert response.is_a? Net::HTTPMethodNotAllowed
+    assert_equal "GET, OPTIONS", response["allow"]
+    assert_equal "close", response["Connection"]
+
+    @thread.join
+    assert_nil @thread[:otp]
+  end
+
+  def test_wait_for_otp_code_incorrect_path
+    wait_for_otp_code_expect_error_with_message("Security device verification failed: Page at /path not found.")
+    response = Gem::MockBrowser.post URI("http://localhost:#{@port}/path?code=xyz")
+
+    assert response.is_a? Net::HTTPNotFound
+    assert_equal "close", response["Connection"]
+
+    @thread.join
+    assert_nil @thread[:otp]
+  end
+
+  def test_wait_for_otp_code_no_params_response
+    wait_for_otp_code_expect_error_with_message("Security device verification failed: Did not receive OTP from https://rubygems.org.")
+    response = Gem::MockBrowser.get URI("http://localhost:#{@port}")
+
+    assert response.is_a? Net::HTTPBadRequest
+    assert_equal "text/plain; charset=utf-8", response["Content-Type"]
+    assert_equal "22", response["Content-Length"]
+    assert_equal "close", response["Connection"]
+    assert_equal "missing code parameter", response.body
+
+    @thread.join
+    assert_nil @thread[:otp]
+  end
+
+  def test_wait_for_otp_code_incorrect_params
+    wait_for_otp_code_expect_error_with_message("Security device verification failed: Did not receive OTP from https://rubygems.org.")
+    response = Gem::MockBrowser.get URI("http://localhost:#{@port}?param=xyz")
+
+    assert response.is_a? Net::HTTPBadRequest
+    assert_equal "text/plain; charset=utf-8", response["Content-Type"]
+    assert_equal "22", response["Content-Length"]
+    assert_equal "close", response["Connection"]
+    assert_equal "missing code parameter", response.body
+
+    @thread.join
+    assert_nil @thread[:otp]
+  end
+
+  private
+
+  def wait_for_otp_code
+    @thread = Thread.new do
+      Thread.current[:otp] = Gem::GemcutterUtilities::WebauthnListener.new(Gem.host).wait_for_otp_code(@server)
+    end
+    @thread.abort_on_exception = true
+    @thread.report_on_exception = false
+  end
+
+  def wait_for_otp_code_expect_error_with_message(message)
+    @thread = Thread.new do
+      error = assert_raise Gem::WebauthnVerificationError do
+        Thread.current[:otp] = Gem::GemcutterUtilities::WebauthnListener.new(Gem.host).wait_for_otp_code(@server)
+      end
+
+      assert_equal message, error.message
+    end
+    @thread.abort_on_exception = true
+    @thread.report_on_exception = false
+  end
+end

data/test/rubygems/test_webauthn_listener_response.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require_relative "helper"
+require "rubygems/gemcutter_utilities/webauthn_listener/response"
+
+class WebauthnListenerResponseTest < Gem::TestCase
+  def setup
+    super
+    @host = "rubygems.example"
+  end
+
+  def test_ok_response_to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::OkResponse.new(@host).to_s
+
+    expected_to_s = <<~RESPONSE
+      HTTP/1.1 200 OK\r
+      connection: close\r
+      access-control-allow-origin: rubygems.example\r
+      access-control-allow-methods: POST\r
+      access-control-allow-headers: Content-Type, Authorization, x-csrf-token\r
+      content-type: text/plain; charset=utf-8\r
+      content-length: 7\r
+      \r
+      success
+    RESPONSE
+
+    assert_equal expected_to_s, to_s
+  end
+
+  def test_no_to_s_response_to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::NoContentResponse.new(@host).to_s
+
+    expected_to_s = <<~RESPONSE
+      HTTP/1.1 204 No Content\r
+      connection: close\r
+      access-control-allow-origin: rubygems.example\r
+      access-control-allow-methods: POST\r
+      access-control-allow-headers: Content-Type, Authorization, x-csrf-token\r
+      \r
+    RESPONSE
+
+    assert_equal expected_to_s, to_s
+  end
+
+  def test_method_not_allowed_response_to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::MethodNotAllowedResponse.new(@host).to_s
+
+    expected_to_s = <<~RESPONSE
+      HTTP/1.1 405 Method Not Allowed\r
+      connection: close\r
+      access-control-allow-origin: rubygems.example\r
+      access-control-allow-methods: POST\r
+      access-control-allow-headers: Content-Type, Authorization, x-csrf-token\r
+      allow: GET, OPTIONS\r
+      \r
+    RESPONSE
+
+    assert_equal expected_to_s, to_s
+  end
+
+  def test_method_not_found_response_to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::NotFoundResponse.new(@host).to_s
+
+    expected_to_s = <<~RESPONSE
+      HTTP/1.1 404 Not Found\r
+      connection: close\r
+      access-control-allow-origin: rubygems.example\r
+      access-control-allow-methods: POST\r
+      access-control-allow-headers: Content-Type, Authorization, x-csrf-token\r
+      \r
+    RESPONSE
+
+    assert_equal expected_to_s, to_s
+  end
+
+  def test_bad_request_response_to_s
+    to_s = Gem::GemcutterUtilities::WebauthnListener::BadRequestResponse.new(@host).to_s
+
+    expected_to_s = <<~RESPONSE
+      HTTP/1.1 400 Bad Request\r
+      connection: close\r
+      access-control-allow-origin: rubygems.example\r
+      access-control-allow-methods: POST\r
+      access-control-allow-headers: Content-Type, Authorization, x-csrf-token\r
+      content-type: text/plain; charset=utf-8\r
+      content-length: 22\r
+      \r
+      missing code parameter
+    RESPONSE
+
+    assert_equal expected_to_s, to_s
+  end
+end