rubygems-update 3.5.5 → 3.6.9

data/lib/rubygems/resolver.rb

@@ -11,7 +11,7 @@ require_relative "util/list"
 # all the requirements.
 
 class Gem::Resolver
-  require_relative "resolver/molinillo"
+  require_relative "vendored_molinillo"
 
   ##
   # If the DEBUG_RESOLVER environment variable is set then debugging mode is
@@ -59,7 +59,7 @@ class Gem::Resolver
   def self.compose_sets(*sets)
     sets.compact!
 
-    sets = sets.map do |set|
+    sets = sets.flat_map do |set|
       case set
       when Gem::Resolver::BestSet then
         set
@@ -68,7 +68,7 @@ class Gem::Resolver
       else
         set
       end
-    end.flatten
+    end
 
     case sets.length
     when 0 then
@@ -167,7 +167,7 @@ class Gem::Resolver
     reqs
   end
 
-  include Molinillo::UI
+  include Gem::Molinillo::UI
 
   def output
     @output ||= debug? ? $stdout : File.open(IO::NULL, "w")
@@ -177,14 +177,14 @@ class Gem::Resolver
     DEBUG_RESOLVER
   end
 
-  include Molinillo::SpecificationProvider
+  include Gem::Molinillo::SpecificationProvider
 
   ##
   # Proceed with resolution! Returns an array of ActivationRequest objects.
 
   def resolve
-    Molinillo::Resolver.new(self, self).resolve(@needed.map {|d| DependencyRequest.new d, nil }).tsort.map(&:payload).compact
-  rescue Molinillo::VersionConflict => e
+    Gem::Molinillo::Resolver.new(self, self).resolve(@needed.map {|d| DependencyRequest.new d, nil }).tsort.filter_map(&:payload)
+  rescue Gem::Molinillo::VersionConflict => e
     conflict = e.conflicts.values.first
     raise Gem::DependencyResolutionError, Conflict.new(conflict.requirement_trees.first.first, conflict.existing, conflict.requirement)
   ensure

data/lib/rubygems/s3_uri_signer.rb

@@ -49,7 +49,7 @@ class Gem::S3URISigner
     string_to_sign = generate_string_to_sign(date_time, credential_info, canonical_request)
     signature = generate_signature(s3_config, date, string_to_sign)
 
-    URI.parse("https://#{canonical_host}#{uri.path}?#{query_params}&X-Amz-Signature=#{signature}")
+    Gem::URI.parse("https://#{canonical_host}#{uri.path}?#{query_params}&X-Amz-Signature=#{signature}")
   end
 
   private
@@ -140,7 +140,7 @@ class Gem::S3URISigner
   end
 
   def ec2_metadata_credentials_json
-    require_relative "net/http"
+    require_relative "vendored_net_http"
     require_relative "request"
     require_relative "request/connection_pools"
     require "json"
@@ -152,7 +152,7 @@ class Gem::S3URISigner
   end
 
   def ec2_metadata_request(url)
-    uri = URI(url)
+    uri = Gem::URI(url)
     @request_pool ||= create_request_pool(uri)
     request = Gem::Request.new(uri, Gem::Net::HTTP::Get, nil, @request_pool)
     response = request.fetch

data/lib/rubygems/safe_marshal/reader.rb

@@ -20,6 +20,12 @@ module Gem
       class EOFError < Error
       end
 
+      class DataTooShortError < Error
+      end
+
+      class NegativeLengthError < Error
+      end
+
       def initialize(io)
         @io = io
       end
@@ -27,7 +33,7 @@ module Gem
       def read!
         read_header
         root = read_element
-        raise UnconsumedBytesError unless @io.eof?
+        raise UnconsumedBytesError, "expected EOF, got #{@io.read(10).inspect}... after top-level element #{root.class}" unless @io.eof?
         root
       end
 
@@ -41,8 +47,16 @@ module Gem
         raise UnsupportedVersionError, "Unsupported marshal version #{v.bytes.map(&:ord).join(".")}, expected #{Marshal::MAJOR_VERSION}.#{Marshal::MINOR_VERSION}" unless v == MARSHAL_VERSION
       end
 
+      def read_bytes(n)
+        raise NegativeLengthError if n < 0
+        str = @io.read(n)
+        raise EOFError, "expected #{n} bytes, got EOF" if str.nil?
+        raise DataTooShortError, "expected #{n} bytes, got #{str.inspect}" unless str.bytesize == n
+        str
+      end
+
       def read_byte
-        @io.getbyte
+        @io.getbyte || raise(EOFError, "Unexpected EOF")
       end
 
       def read_integer
@@ -67,8 +81,6 @@ module Gem
           read_byte | (read_byte << 8) | -0x10000
         when 0xFF
           read_byte | -0x100
-        when nil
-          raise EOFError, "Unexpected EOF"
         else
           signed = (b ^ 128) - 128
           if b >= 128
@@ -107,8 +119,6 @@ module Gem
         when 47 then read_regexp # ?/
         when 83 then read_struct # ?S
         when 67 then read_user_class # ?C
-        when nil
-          raise EOFError, "Unexpected EOF"
         else
           raise Error, "Unknown marshal type discriminator #{type.chr.inspect} (#{type})"
         end
@@ -127,7 +137,7 @@ module Gem
             Elements::Symbol.new(byte.chr)
           end
         else
-          name = -@io.read(len)
+          name = read_bytes(len)
           Elements::Symbol.new(name)
         end
       end
@@ -138,7 +148,7 @@ module Gem
       def read_string
         length = read_integer
         return EMPTY_STRING if length == 0
-        str = @io.read(length)
+        str = read_bytes(length)
         Elements::String.new(str)
       end
 
@@ -152,7 +162,7 @@ module Gem
 
       def read_user_defined
         name = read_element
-        binary_string = @io.read(read_integer)
+        binary_string = read_bytes(read_integer)
         Elements::UserDefined.new(name, binary_string)
       end
 
@@ -162,6 +172,7 @@ module Gem
       def read_array
         length = read_integer
         return EMPTY_ARRAY if length == 0
+        raise NegativeLengthError if length < 0
         elements = Array.new(length) do
           read_element
         end
@@ -170,7 +181,9 @@ module Gem
 
       def read_object_with_ivars
         object = read_element
-        ivars = Array.new(read_integer) do
+        length = read_integer
+        raise NegativeLengthError if length < 0
+        ivars = Array.new(length) do
           [read_element, read_element]
         end
         Elements::WithIvars.new(object, ivars)
@@ -239,7 +252,9 @@ module Gem
       end
 
       def read_hash_with_default_value
-        pairs = Array.new(read_integer) do
+        length = read_integer
+        raise NegativeLengthError if length < 0
+        pairs = Array.new(length) do
           [read_element, read_element]
         end
         default = read_element
@@ -249,7 +264,9 @@ module Gem
       def read_object
         name = read_element
         object = Elements::Object.new(name)
-        ivars = Array.new(read_integer) do
+        length = read_integer
+        raise NegativeLengthError if length < 0
+        ivars = Array.new(length) do
           [read_element, read_element]
         end
         Elements::WithIvars.new(object, ivars)
@@ -260,13 +277,13 @@ module Gem
       end
 
       def read_float
-        string = @io.read(read_integer)
+        string = read_bytes(read_integer)
         Elements::Float.new(string)
       end
 
       def read_bignum
         sign = read_byte
-        data = @io.read(read_integer * 2)
+        data = read_bytes(read_integer * 2)
         Elements::Bignum.new(sign, data)
       end
 

data/lib/rubygems/safe_marshal/visitors/to_ruby.rb

@@ -45,7 +45,7 @@ module Gem::SafeMarshal
         idx = 0
         # not idiomatic, but there's a huge number of IMEMOs allocated here, so we avoid the block
         # because this is such a hot path when doing a bundle install with the full index
-        until idx == size
+        while idx < size
           push_stack idx
           array << visit(elements[idx])
           idx += 1
@@ -98,16 +98,21 @@ module Gem::SafeMarshal
             end
 
             s = e.object.binary_string
+            # 122 is the largest integer that can be represented in marshal in a single byte
+            raise TimeTooLargeError.new("binary string too large", stack: formatted_stack) if s.bytesize > 122
 
             marshal_string = "\x04\bIu:\tTime".b
-            marshal_string.concat(s.size + 5)
+            marshal_string.concat(s.bytesize + 5)
             marshal_string << s
+            # internal is limited to 5, so no overflow is possible
             marshal_string.concat(internal.size + 5)
 
             internal.each do |k, v|
+              k = k.name
+              # ivar name can't be too large because only known ivars are in the internal ivars list
               marshal_string.concat(":")
-              marshal_string.concat(k.size + 5)
-              marshal_string.concat(k.to_s)
+              marshal_string.concat(k.bytesize + 5)
+              marshal_string.concat(k)
               dumped = Marshal.dump(v)
               dumped[0, 2] = ""
               marshal_string.concat(dumped)
@@ -171,11 +176,11 @@ module Gem::SafeMarshal
       end
 
       def visit_Gem_SafeMarshal_Elements_ObjectLink(o)
-        @objects[o.offset]
+        @objects.fetch(o.offset)
       end
 
       def visit_Gem_SafeMarshal_Elements_SymbolLink(o)
-        @symbols[o.offset]
+        @symbols.fetch(o.offset)
       end
 
       def visit_Gem_SafeMarshal_Elements_UserDefined(o)
@@ -219,16 +224,18 @@ module Gem::SafeMarshal
       end
 
       def visit_Gem_SafeMarshal_Elements_Float(f)
-        case f.string
-        when "inf"
-          ::Float::INFINITY
-        when "-inf"
-          -::Float::INFINITY
-        when "nan"
-          ::Float::NAN
-        else
-          f.string.to_f
-        end
+        register_object(
+          case f.string
+          when "inf"
+            ::Float::INFINITY
+          when "-inf"
+            -::Float::INFINITY
+          when "nan"
+            ::Float::NAN
+          else
+            f.string.to_f
+          end
+        )
       end
 
       def visit_Gem_SafeMarshal_Elements_Bignum(b)
@@ -374,6 +381,12 @@ module Gem::SafeMarshal
       class Error < StandardError
       end
 
+      class TimeTooLargeError < Error
+        def initialize(message, stack:)
+          super "#{message} @ #{stack.join "."}"
+        end
+      end
+
       class UnpermittedSymbolError < Error
         def initialize(symbol:, stack:)
           @symbol = symbol

data/lib/rubygems/safe_yaml.rb

@@ -25,8 +25,17 @@ module Gem
       runtime
     ].freeze
 
+    @aliases_enabled = true
+    def self.aliases_enabled=(value) # :nodoc:
+      @aliases_enabled = !!value
+    end
+
+    def self.aliases_enabled? # :nodoc:
+      @aliases_enabled
+    end
+
     def self.safe_load(input)
-      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: true)
+      ::Psych.safe_load(input, permitted_classes: PERMITTED_CLASSES, permitted_symbols: PERMITTED_SYMBOLS, aliases: @aliases_enabled)
     end
 
     def self.load(input)

data/lib/rubygems/security.rb

@@ -323,7 +323,7 @@ require_relative "openssl"
 # == Original author
 #
 # Paul Duncan <pabs@pablotron.org>
-# http://pablotron.org/
+# https://pablotron.org/
 
 module Gem::Security
   ##

data/lib/rubygems/source/git.rb

@@ -58,7 +58,6 @@ class Gem::Source::Git < Gem::Source
 
     @remote   = true
     @root_dir = Gem.dir
-    @git      = ENV["git"] || "git"
   end
 
   def <=>(other)
@@ -81,6 +80,10 @@ class Gem::Source::Git < Gem::Source
       @need_submodules == other.need_submodules
   end
 
+  def git_command
+    ENV.fetch("git", "git")
+  end
+
   ##
   # Checks out the files for the repository into the install_dir.
 
@@ -90,18 +93,18 @@ class Gem::Source::Git < Gem::Source
     return false unless File.exist? repo_cache_dir
 
     unless File.exist? install_dir
-      system @git, "clone", "--quiet", "--no-checkout",
+      system git_command, "clone", "--quiet", "--no-checkout",
              repo_cache_dir, install_dir
     end
 
     Dir.chdir install_dir do
-      system @git, "fetch", "--quiet", "--force", "--tags", install_dir
+      system git_command, "fetch", "--quiet", "--force", "--tags", install_dir
 
-      success = system @git, "reset", "--quiet", "--hard", rev_parse
+      success = system git_command, "reset", "--quiet", "--hard", rev_parse
 
       if @need_submodules
         require "open3"
-        _, status = Open3.capture2e(@git, "submodule", "update", "--quiet", "--init", "--recursive")
+        _, status = Open3.capture2e(git_command, "submodule", "update", "--quiet", "--init", "--recursive")
 
         success &&= status.success?
       end
@@ -118,11 +121,11 @@ class Gem::Source::Git < Gem::Source
 
     if File.exist? repo_cache_dir
       Dir.chdir repo_cache_dir do
-        system @git, "fetch", "--quiet", "--force", "--tags",
+        system git_command, "fetch", "--quiet", "--force", "--tags",
                @repository, "refs/heads/*:refs/heads/*"
       end
     else
-      system @git, "clone", "--quiet", "--bare", "--no-hardlinks",
+      system git_command, "clone", "--quiet", "--bare", "--no-hardlinks",
              @repository, repo_cache_dir
     end
   end
@@ -157,12 +160,14 @@ class Gem::Source::Git < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[Git: ", "]" do
-      q.breakable
-      q.text @repository
+    q.object_group(self) do
+      q.group 2, "[Git: ", "]" do
+        q.breakable
+        q.text @repository
 
-      q.breakable
-      q.text @reference
+        q.breakable
+        q.text @reference
+      end
     end
   end
 
@@ -180,7 +185,7 @@ class Gem::Source::Git < Gem::Source
     hash = nil
 
     Dir.chdir repo_cache_dir do
-      hash = Gem::Util.popen(@git, "rev-parse", @reference).strip
+      hash = Gem::Util.popen(git_command, "rev-parse", @reference).strip
     end
 
     raise Gem::Exception,
@@ -199,7 +204,7 @@ class Gem::Source::Git < Gem::Source
     return [] unless install_dir
 
     Dir.chdir install_dir do
-      Dir["{,*,*/*}.gemspec"].map do |spec_file|
+      Dir["{,*,*/*}.gemspec"].filter_map do |spec_file|
         directory = File.dirname spec_file
         file      = File.basename spec_file
 
@@ -216,19 +221,19 @@ class Gem::Source::Git < Gem::Source
           end
           spec
         end
-      end.compact
+      end
     end
   end
 
   ##
-  # A hash for the git gem based on the git repository URI.
+  # A hash for the git gem based on the git repository Gem::URI.
 
   def uri_hash # :nodoc:
     require_relative "../openssl"
 
     normalized =
       if @repository.match?(%r{^\w+://(\w+@)?})
-        uri = URI(@repository).normalize.to_s.sub %r{/$},""
+        uri = Gem::URI(@repository).normalize.to_s.sub %r{/$},""
         uri.sub(/\A(\w+)/) { $1.downcase }
       else
         @repository

data/lib/rubygems/source/installed.rb

@@ -32,6 +32,8 @@ class Gem::Source::Installed < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.text "[Installed]"
+    q.object_group(self) do
+      q.text "[Installed]"
+    end
   end
 end

data/lib/rubygems/source/local.rb

@@ -117,10 +117,14 @@ class Gem::Source::Local < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[Local gems:", "]" do
-      q.breakable
-      q.seplist @specs.keys do |v|
-        q.text v.full_name
+    q.object_group(self) do
+      q.group 2, "[Local gems:", "]" do
+        q.breakable
+        if @specs
+          q.seplist @specs.keys do |v|
+            q.text v.full_name
+          end
+        end
       end
     end
   end

data/lib/rubygems/source/specific_file.rb

@@ -42,9 +42,11 @@ class Gem::Source::SpecificFile < Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[SpecificFile:", "]" do
-      q.breakable
-      q.text @path
+    q.object_group(self) do
+      q.group 2, "[SpecificFile:", "]" do
+        q.breakable
+        q.text @path
+      end
     end
   end
 

data/lib/rubygems/source.rb

@@ -79,7 +79,7 @@ class Gem::Source
       uri
     end
 
-    bundler_api_uri = enforce_trailing_slash(fetch_uri)
+    bundler_api_uri = enforce_trailing_slash(fetch_uri) + "versions"
 
     begin
       fetcher = Gem::RemoteFetcher.fetcher
@@ -213,14 +213,16 @@ class Gem::Source
   end
 
   def pretty_print(q) # :nodoc:
-    q.group 2, "[Remote:", "]" do
-      q.breakable
-      q.text @uri.to_s
-
-      if api = uri
+    q.object_group(self) do
+      q.group 2, "[Remote:", "]" do
         q.breakable
-        q.text "API URI: "
-        q.text api.to_s
+        q.text @uri.to_s
+
+        if api = uri
+          q.breakable
+          q.text "API URI: "
+          q.text api.to_s
+        end
       end
     end
   end

data/lib/rubygems/source_list.rb

@@ -44,7 +44,7 @@ class Gem::SourceList
   end
 
   ##
-  # Appends +obj+ to the source list which may be a Gem::Source, URI or URI
+  # Appends +obj+ to the source list which may be a Gem::Source, Gem::URI or URI
   # String.
 
   def <<(obj)

data/lib/rubygems/spec_fetcher.rb

@@ -170,23 +170,55 @@ class Gem::SpecFetcher
   # alternative gem names.
 
   def suggest_gems_from_name(gem_name, type = :latest, num_results = 5)
-    gem_name        = gem_name.downcase.tr("_-", "")
-    max             = gem_name.size / 2
-    names           = available_specs(type).first.values.flatten(1)
+    gem_name = gem_name.downcase.tr("_-", "")
 
-    matches = names.map do |n|
+    # All results for 3-character-or-shorter (minus hyphens/underscores) gem
+    # names get rejected, so we just return an empty array immediately instead.
+    return [] if gem_name.length <= 3
+
+    max   = gem_name.size / 2
+    names = available_specs(type).first.values.flatten(1)
+
+    min_length = gem_name.length - max
+    max_length = gem_name.length + max
+
+    gem_name_with_postfix = "#{gem_name}ruby"
+    gem_name_with_prefix = "ruby#{gem_name}"
+
+    matches = names.filter_map do |n|
+      len = n.name.length
+      # If the gem doesn't support the current platform, bail early.
       next unless n.match_platform?
-      [n.name, 0] if n.name.downcase.tr("_-", "").include?(gem_name)
-    end.compact
-
-    if matches.length < num_results
-      matches += names.map do |n|
-        next unless n.match_platform?
-        distance = levenshtein_distance gem_name, n.name.downcase.tr("_-", "")
-        next if distance >= max
-        return [n.name] if distance == 0
-        [n.name, distance]
-      end.compact
+
+      # If the length is min_length or shorter, we've done `max` deletions.
+      # This would be rejected later, so we skip it for performance.
+      next if len <= min_length
+
+      # The candidate name, normalized the same as gem_name.
+      normalized_name = n.name.downcase
+      normalized_name.tr!("_-", "")
+
+      # If the gem is "{NAME}-ruby" and "ruby-{NAME}", we want to return it.
+      # But we already removed hyphens, so we check "{NAME}ruby" and "ruby{NAME}".
+      next [n.name, 0] if normalized_name == gem_name_with_postfix
+      next [n.name, 0] if normalized_name == gem_name_with_prefix
+
+      # If the length is max_length or longer, we've done `max` insertions.
+      # This would be rejected later, so we skip it for performance.
+      next if len >= max_length
+
+      # If we found an exact match (after stripping underscores and hyphens),
+      # that's our most likely candidate.
+      # Return it immediately, and skip the rest of the loop.
+      return [n.name] if normalized_name == gem_name
+
+      distance = levenshtein_distance gem_name, normalized_name
+
+      # Skip current candidate, if the edit distance is greater than allowed.
+      next if distance >= max
+
+      # If all else fails, return the name and the calculated distance.
+      [n.name, distance]
     end
 
     matches = if matches.empty? && type != :prerelease