rubygems-update 3.5.3 → 3.7.1

data/lib/rubygems/resolver/best_set.rb

@@ -21,7 +21,7 @@ class Gem::Resolver::BestSet < Gem::Resolver::ComposedSet
 
   def pick_sets # :nodoc:
     @sources.each_source do |source|
-      @sets << source.dependency_resolver_set
+      @sets << source.dependency_resolver_set(@prerelease)
     end
   end
 
@@ -29,10 +29,6 @@ class Gem::Resolver::BestSet < Gem::Resolver::ComposedSet
     pick_sets if @remote && @sets.empty?
 
     super
-  rescue Gem::RemoteFetcher::FetchError => e
-    replace_failed_api_set e
-
-    retry
   end
 
   def prefetch(reqs) # :nodoc:
@@ -50,28 +46,4 @@ class Gem::Resolver::BestSet < Gem::Resolver::ComposedSet
       q.pp @sets
     end
   end
-
-  ##
-  # Replaces a failed APISet for the URI in +error+ with an IndexSet.
-  #
-  # If no matching APISet can be found the original +error+ is raised.
-  #
-  # The calling method must retry the exception to repeat the lookup.
-
-  def replace_failed_api_set(error) # :nodoc:
-    uri = error.original_uri
-    uri = URI uri unless URI === uri
-    uri += "."
-
-    raise error unless api_set = @sets.find do |set|
-      Gem::Resolver::APISet === set && set.dep_uri == uri
-    end
-
-    index_set = Gem::Resolver::IndexSet.new api_set.source
-
-    @sets.map! do |set|
-      next set unless set == api_set
-      index_set
-    end
-  end
 end

data/lib/rubygems/resolver/composed_set.rb

@@ -44,16 +44,16 @@ class Gem::Resolver::ComposedSet < Gem::Resolver::Set
   end
 
   def errors
-    @errors + @sets.map(&:errors).flatten
+    @errors + @sets.flat_map(&:errors)
   end
 
   ##
   # Finds all specs matching +req+ in all sets.
 
   def find_all(req)
-    @sets.map do |s|
+    @sets.flat_map do |s|
       s.find_all req
-    end.flatten
+    end
   end
 
   ##

data/lib/rubygems/resolver/git_set.rb

@@ -36,7 +36,6 @@ class Gem::Resolver::GitSet < Gem::Resolver::Set
   def initialize # :nodoc:
     super()
 
-    @git             = ENV["git"] || "git"
     @need_submodules = {}
     @repositories    = {}
     @root_dir        = Gem.dir

data/lib/rubygems/resolver/index_set.rb

@@ -65,11 +65,11 @@ class Gem::Resolver::IndexSet < Gem::Resolver::Set
 
       q.breakable
 
-      names = @all.values.map do |tuples|
+      names = @all.values.flat_map do |tuples|
         tuples.map do |_, tuple|
           tuple.full_name
         end
-      end.flatten
+      end
 
       q.seplist names do |name|
         q.text name

data/lib/rubygems/resolver/source_set.rb

@@ -42,6 +42,6 @@ class Gem::Resolver::SourceSet < Gem::Resolver::Set
 
   def get_set(name)
     link = @links[name]
-    @sets[link] ||= Gem::Source.new(link).dependency_resolver_set if link
+    @sets[link] ||= Gem::Source.new(link).dependency_resolver_set(@prerelease) if link
   end
 end

data/lib/rubygems/resolver/spec_specification.rb

@@ -66,4 +66,11 @@ class Gem::Resolver::SpecSpecification < Gem::Resolver::Specification
   def version
     spec.version
   end
+
+  ##
+  # The hash value for this specification.
+
+  def hash
+    spec.hash
+  end
 end

data/lib/rubygems/resolver.rb

@@ -11,7 +11,7 @@ require_relative "util/list"
 # all the requirements.
 
 class Gem::Resolver
-  require_relative "resolver/molinillo"
+  require_relative "vendored_molinillo"
 
   ##
   # If the DEBUG_RESOLVER environment variable is set then debugging mode is
@@ -59,7 +59,7 @@ class Gem::Resolver
   def self.compose_sets(*sets)
     sets.compact!
 
-    sets = sets.map do |set|
+    sets = sets.flat_map do |set|
       case set
       when Gem::Resolver::BestSet then
         set
@@ -68,7 +68,7 @@ class Gem::Resolver
       else
         set
       end
-    end.flatten
+    end
 
     case sets.length
     when 0 then
@@ -167,7 +167,7 @@ class Gem::Resolver
     reqs
   end
 
-  include Molinillo::UI
+  include Gem::Molinillo::UI
 
   def output
     @output ||= debug? ? $stdout : File.open(IO::NULL, "w")
@@ -177,14 +177,14 @@ class Gem::Resolver
     DEBUG_RESOLVER
   end
 
-  include Molinillo::SpecificationProvider
+  include Gem::Molinillo::SpecificationProvider
 
   ##
   # Proceed with resolution! Returns an array of ActivationRequest objects.
 
   def resolve
-    Molinillo::Resolver.new(self, self).resolve(@needed.map {|d| DependencyRequest.new d, nil }).tsort.map(&:payload).compact
-  rescue Molinillo::VersionConflict => e
+    Gem::Molinillo::Resolver.new(self, self).resolve(@needed.map {|d| DependencyRequest.new d, nil }).tsort.filter_map(&:payload)
+  rescue Gem::Molinillo::VersionConflict => e
     conflict = e.conflicts.values.first
     raise Gem::DependencyResolutionError, Conflict.new(conflict.requirement_trees.first.first, conflict.existing, conflict.requirement)
   ensure
@@ -241,7 +241,7 @@ class Gem::Resolver
 
     sources.each do |source|
       groups[source].
-        sort_by {|spec| [spec.version, spec.platform =~ Gem::Platform.local ? 1 : 0] }. # rubocop:disable Performance/RegexpMatch
+        sort_by {|spec| [spec.version, -Gem::Platform.platform_specificity_match(spec.platform, Gem::Platform.local)] }.
         map {|spec| ActivationRequest.new spec, dependency }.
         each {|activation_request| activation_requests << activation_request }
     end

data/lib/rubygems/s3_uri_signer.rb

@@ -27,9 +27,11 @@ class Gem::S3URISigner
   end
 
   attr_accessor :uri
+  attr_accessor :method
 
-  def initialize(uri)
+  def initialize(uri, method)
     @uri = uri
+    @method = method
   end
 
   ##
@@ -38,7 +40,7 @@ class Gem::S3URISigner
     s3_config = fetch_s3_config
 
     current_time = Time.now.utc
-    date_time = current_time.strftime("%Y%m%dT%H%m%SZ")
+    date_time = current_time.strftime("%Y%m%dT%H%M%SZ")
     date = date_time[0,8]
 
     credential_info = "#{date}/#{s3_config.region}/s3/aws4_request"
@@ -49,7 +51,7 @@ class Gem::S3URISigner
     string_to_sign = generate_string_to_sign(date_time, credential_info, canonical_request)
     signature = generate_signature(s3_config, date, string_to_sign)
 
-    URI.parse("https://#{canonical_host}#{uri.path}?#{query_params}&X-Amz-Signature=#{signature}")
+    Gem::URI.parse("https://#{canonical_host}#{uri.path}?#{query_params}&X-Amz-Signature=#{signature}")
   end
 
   private
@@ -73,7 +75,7 @@ class Gem::S3URISigner
 
   def generate_canonical_request(canonical_host, query_params)
     [
-      "GET",
+      method.upcase,
       uri.path,
       query_params,
       "host:#{canonical_host}",
@@ -140,7 +142,7 @@ class Gem::S3URISigner
   end
 
   def ec2_metadata_credentials_json
-    require_relative "net/http"
+    require_relative "vendored_net_http"
     require_relative "request"
     require_relative "request/connection_pools"
     require "json"
@@ -152,7 +154,7 @@ class Gem::S3URISigner
   end
 
   def ec2_metadata_request(url)
-    uri = URI(url)
+    uri = Gem::URI(url)
     @request_pool ||= create_request_pool(uri)
     request = Gem::Request.new(uri, Gem::Net::HTTP::Get, nil, @request_pool)
     response = request.fetch

data/lib/rubygems/safe_marshal/reader.rb

@@ -20,6 +20,12 @@ module Gem
       class EOFError < Error
       end
 
+      class DataTooShortError < Error
+      end
+
+      class NegativeLengthError < Error
+      end
+
       def initialize(io)
         @io = io
       end
@@ -27,7 +33,7 @@ module Gem
       def read!
         read_header
         root = read_element
-        raise UnconsumedBytesError unless @io.eof?
+        raise UnconsumedBytesError, "expected EOF, got #{@io.read(10).inspect}... after top-level element #{root.class}" unless @io.eof?
         root
       end
 
@@ -41,8 +47,16 @@ module Gem
         raise UnsupportedVersionError, "Unsupported marshal version #{v.bytes.map(&:ord).join(".")}, expected #{Marshal::MAJOR_VERSION}.#{Marshal::MINOR_VERSION}" unless v == MARSHAL_VERSION
       end
 
+      def read_bytes(n)
+        raise NegativeLengthError if n < 0
+        str = @io.read(n)
+        raise EOFError, "expected #{n} bytes, got EOF" if str.nil?
+        raise DataTooShortError, "expected #{n} bytes, got #{str.inspect}" unless str.bytesize == n
+        str
+      end
+
       def read_byte
-        @io.getbyte
+        @io.getbyte || raise(EOFError, "Unexpected EOF")
       end
 
       def read_integer
@@ -67,8 +81,6 @@ module Gem
           read_byte | (read_byte << 8) | -0x10000
         when 0xFF
           read_byte | -0x100
-        when nil
-          raise EOFError, "Unexpected EOF"
         else
           signed = (b ^ 128) - 128
           if b >= 128
@@ -107,8 +119,6 @@ module Gem
         when 47 then read_regexp # ?/
         when 83 then read_struct # ?S
         when 67 then read_user_class # ?C
-        when nil
-          raise EOFError, "Unexpected EOF"
         else
           raise Error, "Unknown marshal type discriminator #{type.chr.inspect} (#{type})"
         end
@@ -127,7 +137,7 @@ module Gem
             Elements::Symbol.new(byte.chr)
           end
         else
-          name = -@io.read(len)
+          name = read_bytes(len)
           Elements::Symbol.new(name)
         end
       end
@@ -138,7 +148,7 @@ module Gem
       def read_string
         length = read_integer
         return EMPTY_STRING if length == 0
-        str = @io.read(length)
+        str = read_bytes(length)
         Elements::String.new(str)
       end
 
@@ -152,7 +162,7 @@ module Gem
 
       def read_user_defined
         name = read_element
-        binary_string = @io.read(read_integer)
+        binary_string = read_bytes(read_integer)
         Elements::UserDefined.new(name, binary_string)
       end
 
@@ -162,6 +172,7 @@ module Gem
       def read_array
         length = read_integer
         return EMPTY_ARRAY if length == 0
+        raise NegativeLengthError if length < 0
         elements = Array.new(length) do
           read_element
         end
@@ -170,7 +181,9 @@ module Gem
 
       def read_object_with_ivars
         object = read_element
-        ivars = Array.new(read_integer) do
+        length = read_integer
+        raise NegativeLengthError if length < 0
+        ivars = Array.new(length) do
           [read_element, read_element]
         end
         Elements::WithIvars.new(object, ivars)
@@ -239,7 +252,9 @@ module Gem
       end
 
       def read_hash_with_default_value
-        pairs = Array.new(read_integer) do
+        length = read_integer
+        raise NegativeLengthError if length < 0
+        pairs = Array.new(length) do
           [read_element, read_element]
         end
         default = read_element
@@ -249,7 +264,9 @@ module Gem
       def read_object
         name = read_element
         object = Elements::Object.new(name)
-        ivars = Array.new(read_integer) do
+        length = read_integer
+        raise NegativeLengthError if length < 0
+        ivars = Array.new(length) do
           [read_element, read_element]
         end
         Elements::WithIvars.new(object, ivars)
@@ -260,13 +277,13 @@ module Gem
       end
 
       def read_float
-        string = @io.read(read_integer)
+        string = read_bytes(read_integer)
         Elements::Float.new(string)
       end
 
       def read_bignum
         sign = read_byte
-        data = @io.read(read_integer * 2)
+        data = read_bytes(read_integer * 2)
         Elements::Bignum.new(sign, data)
       end
 

data/lib/rubygems/safe_marshal/visitors/to_ruby.rb

@@ -45,7 +45,7 @@ module Gem::SafeMarshal
         idx = 0
         # not idiomatic, but there's a huge number of IMEMOs allocated here, so we avoid the block
         # because this is such a hot path when doing a bundle install with the full index
-        until idx == size
+        while idx < size
           push_stack idx
           array << visit(elements[idx])
           idx += 1
@@ -98,16 +98,21 @@ module Gem::SafeMarshal
             end
 
             s = e.object.binary_string
+            # 122 is the largest integer that can be represented in marshal in a single byte
+            raise TimeTooLargeError.new("binary string too large", stack: formatted_stack) if s.bytesize > 122
 
             marshal_string = "\x04\bIu:\tTime".b
-            marshal_string.concat(s.size + 5)
+            marshal_string.concat(s.bytesize + 5)
             marshal_string << s
+            # internal is limited to 5, so no overflow is possible
             marshal_string.concat(internal.size + 5)
 
             internal.each do |k, v|
+              k = k.name
+              # ivar name can't be too large because only known ivars are in the internal ivars list
               marshal_string.concat(":")
-              marshal_string.concat(k.size + 5)
-              marshal_string.concat(k.to_s)
+              marshal_string.concat(k.bytesize + 5)
+              marshal_string.concat(k)
               dumped = Marshal.dump(v)
               dumped[0, 2] = ""
               marshal_string.concat(dumped)
@@ -171,11 +176,11 @@ module Gem::SafeMarshal
       end
 
       def visit_Gem_SafeMarshal_Elements_ObjectLink(o)
-        @objects[o.offset]
+        @objects.fetch(o.offset)
       end
 
       def visit_Gem_SafeMarshal_Elements_SymbolLink(o)
-        @symbols[o.offset]
+        @symbols.fetch(o.offset)
       end
 
       def visit_Gem_SafeMarshal_Elements_UserDefined(o)
@@ -219,16 +224,18 @@ module Gem::SafeMarshal
       end
 
       def visit_Gem_SafeMarshal_Elements_Float(f)
-        case f.string
-        when "inf"
-          ::Float::INFINITY
-        when "-inf"
-          -::Float::INFINITY
-        when "nan"
-          ::Float::NAN
-        else
-          f.string.to_f
-        end
+        register_object(
+          case f.string
+          when "inf"
+            ::Float::INFINITY
+          when "-inf"
+            -::Float::INFINITY
+          when "nan"
+            ::Float::NAN
+          else
+            f.string.to_f
+          end
+        )
       end
 
       def visit_Gem_SafeMarshal_Elements_Bignum(b)
@@ -374,6 +381,12 @@ module Gem::SafeMarshal
       class Error < StandardError
       end
 
+      class TimeTooLargeError < Error
+        def initialize(message, stack:)
+          super "#{message} @ #{stack.join "."}"
+        end
+      end
+
       class UnpermittedSymbolError < Error
         def initialize(symbol:, stack:)
           @symbol = symbol

data/lib/rubygems/safe_yaml.rb

@@ -25,8 +25,17 @@ module Gem
       runtime
     ].freeze
 
+    @aliases_enabled = true
+    def self.aliases_enabled=(value) # :nodoc:
+      @aliases_enabled = !!value
+    end
+
+    def self.aliases_enabled? # :nodoc:
+      @aliases_enabled
+    end
+
     def self.safe_load(input)
-      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: true)
+      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: @aliases_enabled)
     end
 
     def self.load(input)

data/lib/rubygems/security.rb

@@ -323,7 +323,7 @@ require_relative "openssl"
 # == Original author
 #
 # Paul Duncan <pabs@pablotron.org>
-# http://pablotron.org/
+# https://pablotron.org/
 
 module Gem::Security
   ##

data/lib/rubygems/source/git.rb

@@ -58,7 +58,6 @@ class Gem::Source::Git < Gem::Source
 
     @remote   = true
     @root_dir = Gem.dir
-    @git      = ENV["git"] || "git"
   end
 
   def <=>(other)
@@ -81,6 +80,10 @@ class Gem::Source::Git < Gem::Source
       @need_submodules == other.need_submodules
   end
 
+  def git_command
+    ENV.fetch("git", "git")
+  end
+
   ##
   # Checks out the files for the repository into the install_dir.
 
@@ -90,18 +93,18 @@ class Gem::Source::Git < Gem::Source
     return false unless File.exist? repo_cache_dir
 
     unless File.exist? install_dir
-      system @git, "clone", "--quiet", "--no-checkout",
+      system git_command, "clone", "--quiet", "--no-checkout",
              repo_cache_dir, install_dir
     end
 
     Dir.chdir install_dir do
-      system @git, "fetch", "--quiet", "--force", "--tags", install_dir
+      system git_command, "fetch", "--quiet", "--force", "--tags", install_dir
 
-      success = system @git, "reset", "--quiet", "--hard", rev_parse
+      success = system git_command, "reset", "--quiet", "--hard", rev_parse
 
       if @need_submodules
         require "open3"
-        _, status = Open3.capture2e(@git, "submodule", "update", "--quiet", "--init", "--recursive")
+        _, status = Open3.capture2e(git_command, "submodule", "update", "--quiet", "--init", "--recursive")
 
         success &&= status.success?
       end
@@ -118,11 +121,11 @@ class Gem::Source::Git < Gem::Source
 
     if File.exist? repo_cache_dir
       Dir.chdir repo_cache_dir do
-        system @git, "fetch", "--quiet", "--force", "--tags",
+        system git_command, "fetch", "--quiet", "--force", "--tags",
                @repository, "refs/heads/*:refs/heads/*"
       end
     else
-      system @git, "clone", "--quiet", "--bare", "--no-hardlinks",
+      system git_command, "clone", "--quiet", "--bare", "--no-hardlinks",
              @repository, repo_cache_dir
     end
   end
@@ -157,12 +160,14 @@ class Gem::Source::Git < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[Git: ", "]" do
-      q.breakable
-      q.text @repository
+    q.object_group(self) do
+      q.group 2, "[Git: ", "]" do
+        q.breakable
+        q.text @repository
 
-      q.breakable
-      q.text @reference
+        q.breakable
+        q.text @reference
+      end
     end
   end
 
@@ -180,7 +185,7 @@ class Gem::Source::Git < Gem::Source
     hash = nil
 
     Dir.chdir repo_cache_dir do
-      hash = Gem::Util.popen(@git, "rev-parse", @reference).strip
+      hash = Gem::Util.popen(git_command, "rev-parse", @reference).strip
     end
 
     raise Gem::Exception,
@@ -199,7 +204,7 @@ class Gem::Source::Git < Gem::Source
     return [] unless install_dir
 
     Dir.chdir install_dir do
-      Dir["{,*,*/*}.gemspec"].map do |spec_file|
+      Dir["{,*,*/*}.gemspec"].filter_map do |spec_file|
         directory = File.dirname spec_file
         file      = File.basename spec_file
 
@@ -216,19 +221,19 @@ class Gem::Source::Git < Gem::Source
           end
           spec
         end
-      end.compact
+      end
     end
   end
 
   ##
-  # A hash for the git gem based on the git repository URI.
+  # A hash for the git gem based on the git repository Gem::URI.
 
   def uri_hash # :nodoc:
     require_relative "../openssl"
 
     normalized =
       if @repository.match?(%r{^\w+://(\w+@)?})
-        uri = URI(@repository).normalize.to_s.sub %r{/$},""
+        uri = Gem::URI(@repository).normalize.to_s.sub %r{/$},""
         uri.sub(/\A(\w+)/) { $1.downcase }
       else
         @repository

data/lib/rubygems/source/installed.rb

@@ -32,6 +32,8 @@ class Gem::Source::Installed < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.text "[Installed]"
+    q.object_group(self) do
+      q.text "[Installed]"
+    end
   end
 end

data/lib/rubygems/source/local.rb

@@ -117,10 +117,14 @@ class Gem::Source::Local < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[Local gems:", "]" do
-      q.breakable
-      q.seplist @specs.keys do |v|
-        q.text v.full_name
+    q.object_group(self) do
+      q.group 2, "[Local gems:", "]" do
+        q.breakable
+        if @specs
+          q.seplist @specs.keys do |v|
+            q.text v.full_name
+          end
+        end
       end
     end
   end

data/lib/rubygems/source/specific_file.rb

@@ -42,9 +42,11 @@ class Gem::Source::SpecificFile < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[SpecificFile:", "]" do
-      q.breakable
-      q.text @path
+    q.object_group(self) do
+      q.group 2, "[SpecificFile:", "]" do
+        q.breakable
+        q.text @path
+      end
     end
   end