rubygems-update 4.0.21 → 4.0.23

data/bundler/lib/bundler/vendor/thor/lib/thor/actions/inject_into_file.rb

@@ -2,6 +2,38 @@ require_relative "empty_directory"
 
 class Bundler::Thor
   module Actions
+    WARNINGS = {unchanged_no_flag: "File unchanged! Either the supplied flag value not found or the content has already been inserted!"}
+
+    # Injects the given content into a file, raising an error if the contents of
+    # the file are not changed. Different from gsub_file, this method is reversible.
+    #
+    # ==== Parameters
+    # destination<String>:: Relative path to the destination root
+    # data<String>:: Data to add to the file. Can be given as a block.
+    # config<Hash>:: give :verbose => false to not log the status and the flag
+    #                for injection (:after or :before) or :force => true for
+    #                insert two or more times the same content.
+    #
+    # ==== Examples
+    #
+    #   insert_into_file "config/environment.rb", "config.gem :thor", :after => "Rails::Initializer.run do |config|\n"
+    #
+    #   insert_into_file "config/environment.rb", :after => "Rails::Initializer.run do |config|\n" do
+    #     gems = ask "Which gems would you like to add?"
+    #     gems.split(" ").map{ |gem| "  config.gem :#{gem}" }.join("\n")
+    #   end
+    #
+    def insert_into_file!(destination, *args, &block)
+      data = block_given? ? block : args.shift
+
+      config = args.shift || {}
+      config[:after] = /\z/ unless config.key?(:before) || config.key?(:after)
+      config = config.merge({error_on_no_change: true})
+
+      action InjectIntoFile.new(self, destination, data, config)
+    end
+    alias_method :inject_into_file!, :insert_into_file!
+
     # Injects the given content into a file. Different from gsub_file, this
     # method is reversible.
     #
@@ -21,8 +53,6 @@ class Bundler::Thor
     #     gems.split(" ").map{ |gem| "  config.gem :#{gem}" }.join("\n")
     #   end
     #
-    WARNINGS = {unchanged_no_flag: "File unchanged! Either the supplied flag value not found or the content has already been inserted!"}
-
     def insert_into_file(destination, *args, &block)
       data = block_given? ? block : args.shift
 
@@ -47,6 +77,7 @@ class Bundler::Thor
 
         @replacement = data.is_a?(Proc) ? data.call : data
         @flag = Regexp.escape(@flag) unless @flag.is_a?(Regexp)
+        @error_on_no_change = @config.fetch(:error_on_no_change, false)
       end
 
       def invoke!
@@ -59,6 +90,8 @@ class Bundler::Thor
         if exists?
           if replace!(/#{flag}/, content, config[:force])
             say_status(:invoke)
+          elsif @error_on_no_change
+            raise Bundler::Thor::Error, "The content of #{destination} did not change"
           elsif replacement_present?
             say_status(:unchanged, color: :blue)
           else

data/bundler/lib/bundler/vendor/thor/lib/thor/base.rb

@@ -13,8 +13,9 @@ class Bundler::Thor
   autoload :RakeCompat, File.expand_path("rake_compat", __dir__)
   autoload :Group,      File.expand_path("group", __dir__)
 
-  # Shortcuts for help.
+  # Shortcuts for help and tree commands.
   HELP_MAPPINGS       = %w(-h -? --help -D)
+  TREE_MAPPINGS       = %w(-t --tree)
 
   # Bundler::Thor methods that should not be overwritten by the user.
   THOR_RESERVED_WORDS = %w(invoke shell options behavior root destination_root relative_root

data/bundler/lib/bundler/vendor/thor/lib/thor/shell/basic.rb

@@ -311,13 +311,11 @@ class Bundler::Thor
       end
 
       def show_diff(destination, content) #:nodoc:
-        diff_cmd = ENV["THOR_DIFF"] || ENV["RAILS_DIFF"] || "diff -u"
-
         require "tempfile"
         Tempfile.open(File.basename(destination), File.dirname(destination), binmode: true) do |temp|
           temp.write content
           temp.rewind
-          system %(#{diff_cmd} "#{destination}" "#{temp.path}")
+          system(*diff_tool, destination, temp.path)
         end
       end
 
@@ -369,15 +367,25 @@ class Bundler::Thor
 
       def merge(destination, content) #:nodoc:
         require "tempfile"
-        Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination)) do |temp|
+        Tempfile.open([File.basename(destination), File.extname(destination)], File.dirname(destination), binmode: true) do |temp|
           temp.write content
           temp.rewind
-          system(merge_tool, temp.path, destination)
+          system(*merge_tool, temp.path, destination)
         end
       end
 
       def merge_tool #:nodoc:
-        @merge_tool ||= ENV["THOR_MERGE"] || "git difftool --no-index"
+        @merge_tool ||= begin
+          require "shellwords"
+          Shellwords.split(ENV["THOR_MERGE"] || "git difftool --no-index")
+        end
+      end
+
+      def diff_tool #:nodoc:
+        @diff_cmd ||= begin
+          require "shellwords"
+          Shellwords.split(ENV["THOR_DIFF"] || ENV["RAILS_DIFF"] || "diff -u")
+        end
       end
     end
   end

data/bundler/lib/bundler/vendor/thor/lib/thor/shell/color.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative "basic"
 
 class Bundler::Thor

data/bundler/lib/bundler/vendor/thor/lib/thor/version.rb

@@ -1,3 +1,3 @@
 class Bundler::Thor
-  VERSION = "1.4.0"
+  VERSION = "1.5.0"
 end

data/bundler/lib/bundler/vendor/thor/lib/thor.rb

@@ -625,7 +625,7 @@ class Bundler::Thor
     # alias name.
     def find_command_possibilities(meth)
       len = meth.to_s.length
-      possibilities = all_commands.reject { |_k, c| c.hidden? }.merge(map).keys.select { |n| meth == n[0, len] }.sort
+      possibilities = all_commands.reject {|k, v| v.is_a?(HiddenCommand) }.merge(map).keys.select { |n| meth == n[0, len] }.sort
       unique_possibilities = possibilities.map { |k| map[k] || k }.uniq
 
       if possibilities.include?(meth)
@@ -671,4 +671,37 @@ class Bundler::Thor
       self.class.help(shell, subcommand)
     end
   end
+
+  map TREE_MAPPINGS => :tree
+
+  desc "tree", "Print a tree of all available commands"
+  def tree
+    build_command_tree(self.class, "")
+  end
+
+private
+
+  def build_command_tree(klass, indent)
+    # Print current class name if it's not the root Bundler::Thor class
+    unless klass == Bundler::Thor
+      say "#{indent}#{klass.namespace || 'default'}", :blue
+      indent = "#{indent}  "
+    end
+
+    # Print all commands for this class
+    visible_commands = klass.commands.reject { |_, cmd| cmd.hidden? || cmd.name == "help" }
+    commands_count = visible_commands.count
+    visible_commands.sort.each_with_index do |(command_name, command), i|
+      description = command.description.split("\n").first || ""
+      icon = i == (commands_count - 1) ? "└─" : "├─"
+      say "#{indent}#{icon} ", nil, false
+      say command_name, :green, false
+      say " (#{description})" unless description.empty?
+    end
+
+    # Print all subcommands (from registered Bundler::Thor subclasses)
+    klass.subcommand_classes.each do |_, subclass|
+      build_command_tree(subclass, indent)
+    end
+  end
 end

data/bundler/lib/bundler/vendor/uri/lib/uri/common.rb

@@ -271,7 +271,7 @@ module Bundler::URI
   #   # => #<Bundler::URI::HTTP http://example.com/foo/bar>
   #
   def self.join(*str)
-    DEFAULT_PARSER.join(*str)
+    PARSER.join(*str)
   end
 
   #

data/bundler/lib/bundler/vendor/uri/lib/uri/generic.rb

@@ -466,7 +466,7 @@ module Bundler::URI
     #
     #   uri = Bundler::URI.parse("http://john:S3nsit1ve@my.example.com")
     #   uri.user = "sam"
-    #   uri.to_s  #=> "http://sam:V3ry_S3nsit1ve@my.example.com"
+    #   uri.to_s  #=> "http://sam@my.example.com"
     #
     def user=(user)
       check_user(user)
@@ -1021,9 +1021,21 @@ module Bundler::URI
 
       # RFC2396, Section 5.2, 6), a)
       base_path << '' if base_path.last == '..'
-      while i = base_path.index('..')
-        base_path.slice!(i - 1, 2)
+      # Remove "<segment>/.." pairs in a single left-to-right pass (O(n)).
+      # This deliberately differs from the relative-path stack handling
+      # below: a leading ".." (one with no preceding segment left to
+      # cancel) discards the whole base path, reproducing the previous
+      # index/slice! implementation exactly.
+      reduced = []
+      base_path.each do |seg|
+        if seg == '..'
+          break if reduced.empty?
+          reduced.pop
+        else
+          reduced << seg
+        end
       end
+      base_path = reduced
 
       if (first = rel_path.first) and first.empty?
         base_path.clear

data/bundler/lib/bundler/vendor/uri/lib/uri/version.rb

@@ -1,6 +1,6 @@
 module Bundler::URI
   # :stopdoc:
-  VERSION = '1.1.1'.freeze
+  VERSION = '1.1.2'.freeze
   VERSION_CODE = VERSION.split('.').map{|s| s.rjust(2, '0')}.join.freeze
   # :startdoc:
 end

data/bundler/lib/bundler/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: false
 
 module Bundler
-  VERSION = "4.0.21".freeze
+  VERSION = "4.0.23".freeze
 
   def self.bundler_major_version
     @bundler_major_version ||= gem_version.segments.first

data/bundler/lib/bundler.rb

@@ -119,9 +119,7 @@ module Bundler
     def bin_path
       @bin_path ||= begin
         path = Bundler.settings[:bin] || "bin"
-        path = Pathname.new(path).expand_path(root).expand_path
-        mkdir_p(path)
-        path
+        Pathname.new(path).expand_path(root).expand_path
       end
     end
 

data/lib/rubygems/commands/exec_command.rb

@@ -3,17 +3,20 @@
 require_relative "../command"
 require_relative "../dependency_installer"
 require_relative "../gem_runner"
+require_relative "../local_remote_options"
 require_relative "../package"
 require_relative "../version_option"
 
 class Gem::Commands::ExecCommand < Gem::Command
   include Gem::VersionOption
+  include Gem::LocalRemoteOptions
 
   def initialize
     super "exec", "Run a command from a gem", {
       version: Gem::Requirement.default,
     }
 
+    add_source_option
     add_version_option
     add_prerelease_option "to be installed"
 

data/lib/rubygems/ext/builder.rb

@@ -204,7 +204,8 @@ class Gem::Ext::Builder
     when /Cargo.toml/ then
       Gem::Ext::CargoBuilder.new
     else
-      build_error("No builder for extension '#{extension}'")
+      # Also called to validate a specification, which must not leave a build log.
+      raise Gem::Ext::BuildError, "No builder for extension '#{extension}'"
     end
   end
 
@@ -229,7 +230,11 @@ EOF
   def build_extension(extension, dest_path) # :nodoc:
     results = []
 
-    builder = builder_for(extension)
+    begin
+      builder = builder_for(extension)
+    rescue Gem::Ext::BuildError => e
+      build_error(e.message)
+    end
 
     extension_dir =
       File.expand_path File.join(@gem_dir, File.dirname(extension))

data/lib/rubygems/gemcutter_utilities/webauthn_listener.rb

@@ -50,6 +50,13 @@ module Gem::GemcutterUtilities
         socket = server.accept
         request_line = socket.gets
 
+        # Browsers open connections speculatively and close them again without
+        # ever sending a request, so wait for the one that carries the code.
+        unless request_line
+          socket.close
+          next
+        end
+
         method, req_uri, _protocol = request_line.split(" ")
         req_uri = Gem::URI.parse(req_uri)
 
@@ -75,6 +82,8 @@ module Gem::GemcutterUtilities
           responder.send(MethodNotAllowedResponse.for(host))
           raise Gem::WebauthnVerificationError, "Invalid HTTP method #{method.upcase} received."
         end
+      rescue Errno::ECONNABORTED, Errno::ECONNRESET
+        socket&.close
       end
     end
 

data/lib/rubygems/installer.rb

@@ -684,6 +684,10 @@ class Gem::Installer
       raise Gem::InstallError, "#{spec} has an invalid name"
     end
 
+    unless /\A#{Gem::Version::VERSION_PATTERN}\z/.match?(spec.version.to_s)
+      raise Gem::InstallError, "#{spec} has an invalid version"
+    end
+
     if spec.raw_require_paths.any? {|path| path =~ /\R/ }
       raise Gem::InstallError, "#{spec} has an invalid require_paths"
     end

data/lib/rubygems/package.rb

@@ -89,6 +89,18 @@ class Gem::Package
 
   class TarInvalidError < Error; end
 
+  ##
+  # Raised when a filename contains characters that are invalid on Windows
+
+  class InvalidWindowsFileNameError < Gem::InstallError
+    def initialize(filename, gem_name = nil)
+      message = "The gem contains a file '#{filename}' with characters in its name that are not allowed on Windows (e.g., colons)."
+      message += " This is a problem with the '#{gem_name}' gem, not Rubygems." if gem_name
+      message += " Please report this issue to the gem author."
+      super message
+    end
+  end
+
   attr_accessor :build_time # :nodoc:
 
   ##
@@ -258,6 +270,10 @@ class Gem::Package
 
   def add_files(tar) # :nodoc:
     @spec.files.each do |file|
+      if invalid_windows_filename?(file)
+        alert_warning "filename '#{file}' contains characters that are invalid on Windows (e.g., colons). This gem may fail to install on Windows."
+      end
+
       stat = File.lstat file
 
       if stat.symlink?
@@ -425,6 +441,11 @@ EOM
         full_name = entry.full_name
         next unless File.fnmatch pattern, full_name, File::FNM_DOTMATCH
 
+        if Gem.win_platform? && invalid_windows_filename?(full_name)
+          gem_name = @spec ? @spec.full_name : "unknown"
+          raise Gem::Package::InvalidWindowsFileNameError.new(full_name, gem_name)
+        end
+
         destination = install_location full_name, destination_dir
 
         if entry.symlink?
@@ -445,7 +466,7 @@ EOM
           end
 
         unless directories.include?(mkdir)
-          FileUtils.mkdir_p mkdir, mode: dir_mode ? 0o755 : (entry.header.mode if entry.directory?)
+          FileUtils.mkdir_p mkdir, mode: dir_mode ? 0o755 : (entry.header.mode & 0o777 if entry.directory?)
           directories << mkdir
         end
 
@@ -482,10 +503,10 @@ EOM
   def file_mode(mode) # :nodoc:
     ((mode & 0o111).zero? ? data_mode : prog_mode) ||
       # If we're not using one of the default modes, then we're going to fall
-      # back to the mode from the tarball. In this case we need to mask it down
-      # to fit into 2^16 bits (the maximum value for a mode in CRuby since it
-      # gets put into an unsigned short).
-      (mode & ((1 << 16) - 1))
+      # back to the permission bits from the tarball. Masking drops setuid,
+      # setgid and sticky bits along with anything that does not fit into a
+      # mode in CRuby (an unsigned short).
+      (mode & 0o777)
   end
 
   ##
@@ -531,6 +552,16 @@ EOM
     end
   end
 
+  ##
+  # Checks if a filename contains characters that are invalid on Windows.
+  # Windows doesn't allow: < > : " | ? * \ and control characters (0x00-0x1F).
+  # Colons are the most common issue since they're allowed on Unix.
+  # Note: Colons are only valid as drive letter separators (e.g., C:), not in filenames.
+
+  def invalid_windows_filename?(filename) # :nodoc:
+    filename.to_s.split("/").any? {|part| part.match?(/[:<>"|?*\\\x00-\x1f]/) }
+  end
+
   ##
   # Loads a Gem::Specification from the TarEntry +entry+
 

data/lib/rubygems/uninstaller.rb

@@ -272,6 +272,7 @@ class Gem::Uninstaller
 
     safe_delete { rm_r full_gem_path, exclusions: exclusions }
     safe_delete { FileUtils.rm_r spec.extension_dir }
+    safe_delete { FileUtils.rm_f spec.build_info_file }
 
     old_platform_name = spec.original_name
 

data/lib/rubygems/vendor/net-http/lib/net/http/exceptions.rb

@@ -3,7 +3,7 @@ module Gem::Net
   # Gem::Net::HTTP exception class.
   # You cannot use Gem::Net::HTTPExceptions directly; instead, you must use
   # its subclasses.
-  module HTTPExceptions
+  module HTTPExceptions # :nodoc:
     def initialize(msg, res)   #:nodoc:
       super msg
       @response = res
@@ -12,6 +12,7 @@ module Gem::Net
     alias data response    #:nodoc: obsolete
   end
 
+  # :stopdoc:
   class HTTPError < ProtocolError
     include HTTPExceptions
   end

data/lib/rubygems/vendor/net-http/lib/net/http/generic_request.rb

@@ -19,16 +19,13 @@ class Gem::Net::HTTPGenericRequest
 
     if Gem::URI === uri_or_path then
       raise ArgumentError, "not an HTTP Gem::URI" unless Gem::URI::HTTP === uri_or_path
-      hostname = uri_or_path.hostname
+      hostname = uri_or_path.host
       raise ArgumentError, "no host component for Gem::URI" unless (hostname && hostname.length > 0)
       @uri = uri_or_path.dup
-      host = @uri.hostname.dup
-      host << ":" << @uri.port.to_s if @uri.port != @uri.default_port
       @path = uri_or_path.request_uri
       raise ArgumentError, "no HTTP request path given" unless @path
     else
       @uri = nil
-      host = nil
       raise ArgumentError, "no HTTP request path given" unless uri_or_path
       raise ArgumentError, "HTTP request path is empty" if uri_or_path.empty?
       @path = uri_or_path.dup
@@ -51,7 +48,7 @@ class Gem::Net::HTTPGenericRequest
     initialize_http_header initheader
     self['Accept'] ||= '*/*'
     self['User-Agent'] ||= 'Ruby'
-    self['Host'] ||= host if host
+    self['Host'] ||= @uri.authority if @uri
     @body = nil
     @body_stream = nil
     @body_data = nil
@@ -245,7 +242,7 @@ class Gem::Net::HTTPGenericRequest
     end
 
     if host = self['host']
-      host.sub!(/:.*/m, '')
+      host = Gem::URI.parse("//#{host}").host # Remove a port component from the existing Host header
     elsif host = @uri.host
     else
      host = addr
@@ -264,6 +261,8 @@ class Gem::Net::HTTPGenericRequest
 
   private
 
+  # :stopdoc:
+
   class Chunker #:nodoc:
     def initialize(sock)
       @sock = sock
@@ -337,6 +336,9 @@ class Gem::Net::HTTPGenericRequest
     boundary = opt[:boundary]
     require 'securerandom' unless defined?(SecureRandom)
     boundary ||= SecureRandom.urlsafe_base64(40)
+    if /[\r\n]/.match?(boundary.to_s)
+      raise ArgumentError, "multipart boundary cannot include CR/LF"
+    end
     chunked_p = chunked?
 
     buf = +''
@@ -350,7 +352,10 @@ class Gem::Net::HTTPGenericRequest
       buf << "--#{boundary}\r\n"
       if filename
         filename = quote_string(filename, charset)
-        type = h[:content_type] || 'application/octet-stream'
+        type = (h[:content_type] || 'application/octet-stream').to_s
+        if /[\r\n]/.match?(type)
+          raise ArgumentError, "field content type cannot include CR/LF"
+        end
         buf << "Content-Disposition: form-data; " \
           "name=\"#{key}\"; filename=\"#{filename}\"\r\n" \
           "Content-Type: #{type}\r\n\r\n"
@@ -385,6 +390,9 @@ class Gem::Net::HTTPGenericRequest
 
   def quote_string(str, charset)
     str = str.encode(charset, fallback:->(c){'&#%d;'%c.encode("UTF-8").ord}) if charset
+    if /[\r\n]/.match?(str)
+      raise ArgumentError, "multipart field name or filename cannot include CR/LF"
+    end
     str.gsub(/[\\"]/, '\\\\\&')
   end