rubygems-update 2.2.4 → 2.2.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e98b04b25f22f349df28ad4154da407e710580d9
-  data.tar.gz: dbe2d28493e2a1b911a6fabd6c52a09a1b01d776
+  metadata.gz: 6b784798b365f2224360537c17ff3673155af0ab
+  data.tar.gz: 483ecdaddafc5ee9890a213e17f7847f31dbcb10
 SHA512:
-  metadata.gz: 748b24e51af2ef2603fc2d965da192dde7b14f689e88041a648d7349985a8edb80304d3ad00046523579f3af1942ea5a50711382a5eb400a644f5ec41fa2ef3d
-  data.tar.gz: 3e0569007b0adafb4c81221b7d09c77c40435c1581cdcd7d201285cb6492460f1f31da0c494865f2269c0cdbc63b676ffe05b63fe1cf7026015c6e56f1a22152
+  metadata.gz: 910de3dfc30de9c054bd26eeba5eebffaf58fe568b8ef6421614804e771a48f4509dc6fd60f1d900d0c928c3fb8e38e44c16b474fa5ef889dffcbb3b2f5d703a
+  data.tar.gz: 71e6e54a9caf792fe86bfec7536fd00e70aa164318c933737441ab660e5614bd00e003479e41b2fb96c55e7db86bdba932335ee6b61171e6ce880304b6247db2

data/History.txt

@@ -1,5 +1,11 @@
 # coding: UTF-8
 
+=== 2.2.5 / 2015-06-08
+
+Bug fixes:
+
+* Tightened API endpoint checks for CVE-2015-3900
+
 === 2.2.4 / 2015-05-14
 
 Bug fixes:

data/lib/rubygems.rb

@@ -8,7 +8,7 @@
 require 'rbconfig'
 
 module Gem
-  VERSION = '2.2.4'
+  VERSION = '2.2.5'
 end
 
 # Must be first since it unloads the prelude from 1.9.2

data/lib/rubygems/remote_fetcher.rb

@@ -92,7 +92,7 @@ class Gem::RemoteFetcher
     else
       target = res.target.to_s.strip
 
-      if /#{host}\z/ =~ target
+      if /\.#{Regexp.quote(host)}\z/ =~ target
         return URI.parse "#{uri.scheme}://#{target}#{uri.path}"
       end
 

data/test/rubygems/test_gem_remote_fetcher.rb

@@ -192,6 +192,36 @@ gems:
     dns.verify
   end
 
+  def test_api_endpoint_ignores_trans_domain_values_that_starts_with_original
+    uri = URI.parse "http://example.com/foo"
+    target = MiniTest::Mock.new
+    target.expect :target, "example.combadguy.com"
+
+    dns = MiniTest::Mock.new
+    dns.expect :getresource, target, [String, Object]
+
+    fetch = Gem::RemoteFetcher.new nil, dns
+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+
+    target.verify
+    dns.verify
+  end
+
+  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original
+    uri = URI.parse "http://example.com/foo"
+    target = MiniTest::Mock.new
+    target.expect :target, "badexample.com"
+
+    dns = MiniTest::Mock.new
+    dns.expect :getresource, target, [String, Object]
+
+    fetch = Gem::RemoteFetcher.new nil, dns
+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)
+
+    target.verify
+    dns.verify
+  end
+
   def test_cache_update_path
     uri = URI 'http://example/file'
     path = File.join @tempdir, 'file'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubygems-update
 version: !ruby/object:Gem::Version
-  version: 2.2.4
+  version: 2.2.5
 platform: ruby
 authors:
 - Jim Weirich
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-05-14 00:00:00.000000000 Z
+date: 2015-06-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest