|
|
4d3aad |
diff --git a/lib/rubygems/installer.rb b/lib/rubygems/installer.rb
|
|
|
4d3aad |
index 709b77d126..8828c08a22 100644
|
|
|
4d3aad |
--- a/lib/rubygems/installer.rb
|
|
|
4d3aad |
+++ b/lib/rubygems/installer.rb
|
|
|
4d3aad |
@@ -693,9 +693,26 @@ def verify_gem_home(unpack = false) # :nodoc:
|
|
|
4d3aad |
unpack or File.writable?(gem_home)
|
|
|
4d3aad |
end
|
|
|
4d3aad |
|
|
|
4d3aad |
- def verify_spec_name
|
|
|
4d3aad |
- return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
|
|
|
4d3aad |
- raise Gem::InstallError, "#{spec} has an invalid name"
|
|
|
4d3aad |
+ def verify_spec
|
|
|
4d3aad |
+ unless spec.name =~ Gem::Specification::VALID_NAME_PATTERN
|
|
|
4d3aad |
+ raise Gem::InstallError, "#{spec} has an invalid name"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ if spec.raw_require_paths.any?{|path| path =~ /\R/ }
|
|
|
4d3aad |
+ raise Gem::InstallError, "#{spec} has an invalid require_paths"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ if spec.extensions.any?{|ext| ext =~ /\R/ }
|
|
|
4d3aad |
+ raise Gem::InstallError, "#{spec} has an invalid extensions"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ if spec.specification_version.to_s =~ /\R/
|
|
|
4d3aad |
+ raise Gem::InstallError, "#{spec} has an invalid specification_version"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ if spec.dependencies.any? {|dep| dep.type =~ /\R/ || dep.name =~ /\R/ }
|
|
|
4d3aad |
+ raise Gem::InstallError, "#{spec} has an invalid dependencies"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
end
|
|
|
4d3aad |
|
|
|
4d3aad |
##
|
|
|
4d3aad |
@@ -815,9 +832,11 @@ def dir
|
|
|
4d3aad |
def pre_install_checks
|
|
|
4d3aad |
verify_gem_home options[:unpack]
|
|
|
4d3aad |
|
|
|
4d3aad |
- ensure_loadable_spec
|
|
|
4d3aad |
+ # The name and require_paths must be verified first, since it could contain
|
|
|
4d3aad |
+ # ruby code that would be eval'ed in #ensure_loadable_spec
|
|
|
4d3aad |
+ verify_spec
|
|
|
4d3aad |
|
|
|
4d3aad |
- verify_spec_name
|
|
|
4d3aad |
+ ensure_loadable_spec
|
|
|
4d3aad |
|
|
|
4d3aad |
if options[:install_as_default]
|
|
|
4d3aad |
Gem.ensure_default_gem_subdirectories gem_home
|
|
|
4d3aad |
diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb
|
|
|
4d3aad |
index 1092a0c68f..966681b1a0 100644
|
|
|
4d3aad |
--- a/test/rubygems/test_gem_installer.rb
|
|
|
4d3aad |
+++ b/test/rubygems/test_gem_installer.rb
|
|
|
4d3aad |
@@ -1247,6 +1247,112 @@ def spec.validate; end
|
|
|
4d3aad |
end
|
|
|
4d3aad |
end
|
|
|
4d3aad |
|
|
|
4d3aad |
+ def test_pre_install_checks_malicious_name_before_eval
|
|
|
4d3aad |
+ spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1'
|
|
|
4d3aad |
+ def spec.full_name # so the spec is buildable
|
|
|
4d3aad |
+ "malicious-1"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ def spec.validate(*args); end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ util_build_gem spec
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ use_ui @ui do
|
|
|
4d3aad |
+ @installer = Gem::Installer.at gem
|
|
|
4d3aad |
+ e = assert_raises Gem::InstallError do
|
|
|
4d3aad |
+ @installer.pre_install_checks
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ refute defined?(::Object::FROM_EVAL)
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ def test_pre_install_checks_malicious_require_paths_before_eval
|
|
|
4d3aad |
+ spec = util_spec "malicious", '1'
|
|
|
4d3aad |
+ def spec.full_name # so the spec is buildable
|
|
|
4d3aad |
+ "malicious-1"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ def spec.validate(*args); end
|
|
|
4d3aad |
+ spec.require_paths = ["malicious\n``"]
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ util_build_gem spec
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ use_ui @ui do
|
|
|
4d3aad |
+ @installer = Gem::Installer.at gem
|
|
|
4d3aad |
+ e = assert_raises Gem::InstallError do
|
|
|
4d3aad |
+ @installer.pre_install_checks
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ def test_pre_install_checks_malicious_extensions_before_eval
|
|
|
4d3aad |
+ spec = util_spec "malicious", '1'
|
|
|
4d3aad |
+ def spec.full_name # so the spec is buildable
|
|
|
4d3aad |
+ "malicious-1"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ def spec.validate(*args); end
|
|
|
4d3aad |
+ spec.extensions = ["malicious\n``"]
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ util_build_gem spec
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ use_ui @ui do
|
|
|
4d3aad |
+ @installer = Gem::Installer.at gem
|
|
|
4d3aad |
+ e = assert_raises Gem::InstallError do
|
|
|
4d3aad |
+ @installer.pre_install_checks
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ def test_pre_install_checks_malicious_specification_version_before_eval
|
|
|
4d3aad |
+ spec = util_spec "malicious", '1'
|
|
|
4d3aad |
+ def spec.full_name # so the spec is buildable
|
|
|
4d3aad |
+ "malicious-1"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ def spec.validate(*args); end
|
|
|
4d3aad |
+ spec.specification_version = "malicious\n``"
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ util_build_gem spec
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ use_ui @ui do
|
|
|
4d3aad |
+ @installer = Gem::Installer.at gem
|
|
|
4d3aad |
+ e = assert_raises Gem::InstallError do
|
|
|
4d3aad |
+ @installer.pre_install_checks
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ def test_pre_install_checks_malicious_dependencies_before_eval
|
|
|
4d3aad |
+ spec = util_spec "malicious", '1'
|
|
|
4d3aad |
+ def spec.full_name # so the spec is buildable
|
|
|
4d3aad |
+ "malicious-1"
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ def spec.validate(*args); end
|
|
|
4d3aad |
+ spec.add_dependency "b\nfoo", '> 5'
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ util_build_gem spec
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
4d3aad |
+
|
|
|
4d3aad |
+ use_ui @ui do
|
|
|
4d3aad |
+ @installer = Gem::Installer.at gem
|
|
|
4d3aad |
+ @installer.ignore_dependencies = true
|
|
|
4d3aad |
+ e = assert_raises Gem::InstallError do
|
|
|
4d3aad |
+ @installer.pre_install_checks
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+ end
|
|
|
4d3aad |
+
|
|
|
4d3aad |
def test_shebang
|
|
|
4d3aad |
util_make_exec @spec, "#!/usr/bin/ruby"
|
|
|
4d3aad |
|
|
|
4d3aad |
--
|
|
|
4d3aad |
2.20.1
|
|
|
4d3aad |
|