diff --git a/lib/rubygems/installer.rb b/lib/rubygems/installer.rb index 709b77d126..8828c08a22 100644 --- a/lib/rubygems/installer.rb +++ b/lib/rubygems/installer.rb @@ -693,9 +693,26 @@ def verify_gem_home(unpack = false) # :nodoc: unpack or File.writable?(gem_home) end - def verify_spec_name - return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN - raise Gem::InstallError, "#{spec} has an invalid name" + def verify_spec + unless spec.name =~ Gem::Specification::VALID_NAME_PATTERN + raise Gem::InstallError, "#{spec} has an invalid name" + end + + if spec.raw_require_paths.any?{|path| path =~ /\R/ } + raise Gem::InstallError, "#{spec} has an invalid require_paths" + end + + if spec.extensions.any?{|ext| ext =~ /\R/ } + raise Gem::InstallError, "#{spec} has an invalid extensions" + end + + if spec.specification_version.to_s =~ /\R/ + raise Gem::InstallError, "#{spec} has an invalid specification_version" + end + + if spec.dependencies.any? {|dep| dep.type =~ /\R/ || dep.name =~ /\R/ } + raise Gem::InstallError, "#{spec} has an invalid dependencies" + end end ## @@ -815,9 +832,11 @@ def dir def pre_install_checks verify_gem_home options[:unpack] - ensure_loadable_spec + # The name and require_paths must be verified first, since it could contain + # ruby code that would be eval'ed in #ensure_loadable_spec + verify_spec - verify_spec_name + ensure_loadable_spec if options[:install_as_default] Gem.ensure_default_gem_subdirectories gem_home diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb index 1092a0c68f..966681b1a0 100644 --- a/test/rubygems/test_gem_installer.rb +++ b/test/rubygems/test_gem_installer.rb @@ -1247,6 +1247,112 @@ def spec.validate; end end end + def test_pre_install_checks_malicious_name_before_eval + spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "# has an invalid name", e.message + end + refute defined?(::Object::FROM_EVAL) + end + + def test_pre_install_checks_malicious_require_paths_before_eval + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.require_paths = ["malicious\n``"] + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "# has an invalid require_paths", e.message + end + end + + def test_pre_install_checks_malicious_extensions_before_eval + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.extensions = ["malicious\n``"] + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "# has an invalid extensions", e.message + end + end + + def test_pre_install_checks_malicious_specification_version_before_eval + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.specification_version = "malicious\n``" + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "# has an invalid specification_version", e.message + end + end + + def test_pre_install_checks_malicious_dependencies_before_eval + spec = util_spec "malicious", '1' + def spec.full_name # so the spec is buildable + "malicious-1" + end + def spec.validate(*args); end + spec.add_dependency "b\nfoo", '> 5' + + util_build_gem spec + + gem = File.join(@gemhome, 'cache', spec.file_name) + + use_ui @ui do + @installer = Gem::Installer.at gem + @installer.ignore_dependencies = true + e = assert_raises Gem::InstallError do + @installer.pre_install_checks + end + assert_equal "# has an invalid dependencies", e.message + end + end + def test_shebang util_make_exec @spec, "#!/usr/bin/ruby" -- 2.20.1