From 97c6e3934c68e90592f6913f68861d0dbc49c6a4 Mon Sep 17 00:00:00 2001

From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>

Date: Sun, 10 Sep 2017 01:10:24 +0000

Subject: [PATCH] * lib/rubygems: fix several vulnerabilities in RubyGems; bump

 to version   2.4.5.3. [Backport #13842]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@59805 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

---

 ChangeLog                                        |    4 +

 lib/rubygems/commands/query_command.rb           |    5 -

 lib/rubygems/installer.rb                        |    7 ++

 lib/rubygems/remote_fetcher.rb                   |    2 +-

 lib/rubygems/specification.rb                    |   12 ++-

 lib/rubygems/text.rb                             |   15 ++++

 test/rubygems/test_gem_commands_query_command.rb |   80 +++++++++++++++++++++++

 test/rubygems/test_gem_installer.rb              |   32 +++++++++

 test/rubygems/test_gem_remote_fetcher.rb         |   15 ++++

 test/rubygems/test_gem_specification.rb          |   32 ++++++++-

 test/rubygems/test_gem_text.rb                   |   11 +++

 11 files changed, 208 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog

index 08bc53d050..ef36ffbd15 100644

--- a/ChangeLog

+++ b/ChangeLog

@@ -4,6 +4,10 @@

 	  protocol list.

 	  The protocol list from OpenSSL is not null-terminated.

 	  patched by Kazuki Yamaguchi [Bug #11810] [ruby-core:72082]

+

+Sun Sep 10 10:10:05 2017  SHIBATA Hiroshi  <hsbt@ruby-lang.org>

+

+	* lib/rubygems: fix several vulnerabilities in RubyGems [Backport #13842]

 Thu Feb 25 19:49:31 2016  Nobuyoshi Nakada  <nobu@ruby-lang.org>

diff --git a/lib/rubygems/commands/query_command.rb b/lib/rubygems/commands/query_command.rb

index 432250e033..44364cfab2 100644

--- a/lib/rubygems/commands/query_command.rb

+++ b/lib/rubygems/commands/query_command.rb

@@ -193,7 +193,7 @@ def output_versions output, versions

         end

       end

-      output << make_entry(matching_tuples, platforms)

+      output << clean_text(make_entry(matching_tuples, platforms))

     end

   end

@@ -311,7 +311,8 @@ def spec_platforms entry, platforms

   end

   def spec_summary entry, spec

-    entry << "\n\n" << format_text(spec.summary, 68, 4)

+    summary = truncate_text(spec.summary, "the summary for #{spec.full_name}")

+    entry << "\n\n" << format_text(summary, 68, 4)

   end

 end

diff --git a/lib/rubygems/installer.rb b/lib/rubygems/installer.rb

index 10fc1a34a5..a27569fe2e 100644

--- a/lib/rubygems/installer.rb

+++ b/lib/rubygems/installer.rb

@@ -596,6 +596,11 @@ def verify_gem_home(unpack = false) # :nodoc:

       unpack or File.writable?(gem_home)

   end

+  def verify_spec_name

+    return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN

+    raise Gem::InstallError, "#{spec} has an invalid name"

+  end

+

   ##

   # Return the text for an application file.

@@ -767,6 +772,8 @@ def pre_install_checks

     ensure_loadable_spec

+    verify_spec_name

+

     Gem.ensure_gem_subdirectories gem_home

     return true if @force

diff --git a/lib/rubygems/remote_fetcher.rb b/lib/rubygems/remote_fetcher.rb

index b1f6dd17fc..2b9d61c0a1 100644

--- a/lib/rubygems/remote_fetcher.rb

+++ b/lib/rubygems/remote_fetcher.rb

@@ -105,7 +105,7 @@ def api_endpoint(uri)

     else

       target = res.target.to_s.strip

-      if /\.#{Regexp.quote(host)}\z/ =~ target

+      if URI("http://" + target).host.end_with?(".#{host}")

         return URI.parse "#{uri.scheme}://#{target}#{uri.path}"

       end

diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb

index ab1cd92270..faca837128 100644

--- a/lib/rubygems/specification.rb

+++ b/lib/rubygems/specification.rb

@@ -107,6 +107,8 @@ class Gem::Specification < Gem::BasicSpecification

   today = Time.now.utc

   TODAY = Time.utc(today.year, today.month, today.day)

+  VALID_NAME_PATTERN = /\A[a-zA-Z0-9\.\-\_]+\z/ # :nodoc:

+

   # :startdoc:

   ##

@@ -2377,9 +2379,15 @@ def validate packaging = true

       end

     end

-    unless String === name then

+    if !name.is_a?(String) then

+      raise Gem::InvalidSpecificationException,

+            "invalid value for attribute name: \"#{name.inspect}\" must be a string"

+    elsif name !~ /[a-zA-Z]/ then

+      raise Gem::InvalidSpecificationException,

+            "invalid value for attribute name: #{name.dump} must include at least one letter"

+    elsif name !~ VALID_NAME_PATTERN then

       raise Gem::InvalidSpecificationException,

-            "invalid value for attribute name: \"#{name.inspect}\""

+            "invalid value for attribute name: #{name.dump} can only include letters, numbers, dashes, and underscores"

     end

     if require_paths.empty? then

diff --git a/lib/rubygems/text.rb b/lib/rubygems/text.rb

index 5c9287ad2e..86a722ffc0 100644

--- a/lib/rubygems/text.rb

+++ b/lib/rubygems/text.rb

@@ -5,13 +5,26 @@

 module Gem::Text

+  ##

+  # Remove any non-printable characters and make the text suitable for

+  # printing.

+  def clean_text(text)

+    text.gsub(/[\000-\b\v-\f\016-\037\177]/, ".".freeze)

+  end

+

+  def truncate_text(text, description, max_length = 100_000)

+    raise ArgumentError, "max_length must be positive" unless max_length > 0

+    return text if text.size <= max_length

+    "Truncating #{description} to #{max_length.to_s.reverse.gsub(/...(?=.)/,'\&,').reverse} characters:\n" + text[0, max_length]

+  end

+

   ##

   # Wraps +text+ to +wrap+ characters and optionally indents by +indent+

   # characters

   def format_text(text, wrap, indent=0)

     result = []

-    work = text.dup

+    work = clean_text(text)

     while work.length > wrap do

       if work =~ /^(.{0,#{wrap}})[ \n]/ then

diff --git a/test/rubygems/test_gem_commands_query_command.rb b/test/rubygems/test_gem_commands_query_command.rb

index 43fa82571d..ccd2621874 100644

--- a/test/rubygems/test_gem_commands_query_command.rb

+++ b/test/rubygems/test_gem_commands_query_command.rb

@@ -127,6 +127,86 @@ def test_execute_details

     This is a lot of text. This is a lot of text. This is a lot of text.

     This is a lot of text.

+pl (1)

+    Platform: i386-linux

+    Author: A User

+    Homepage: http://example.com

+

+    this is a summary

+    EOF

+

+    assert_equal expected, @ui.output

+    assert_equal '', @ui.error

+  end

+

+  def test_execute_details_cleans_text

+    spec_fetcher do |fetcher|

+      fetcher.spec 'a', 2 do |s|

+        s.summary = 'This is a lot of text. ' * 4

+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]

+        s.homepage = "http://a.example.com/\x03"

+      end

+

+      fetcher.legacy_platform

+    end

+

+    @cmd.handle_options %w[-r -d]

+

+    use_ui @ui do

+      @cmd.execute

+    end

+

+    expected = <<-EOF

+

+*** REMOTE GEMS ***

+

+a (2)

+    Authors: Abraham Lincoln ., . Hirohito

+    Homepage: http://a.example.com/.

+

+    This is a lot of text. This is a lot of text. This is a lot of text.

+    This is a lot of text.

+

+pl (1)

+    Platform: i386-linux

+    Author: A User

+    Homepage: http://example.com

+

+    this is a summary

+    EOF

+

+    assert_equal expected, @ui.output

+    assert_equal '', @ui.error

+  end

+

+  def test_execute_details_truncates_summary

+    spec_fetcher do |fetcher|

+      fetcher.spec 'a', 2 do |s|

+        s.summary = 'This is a lot of text. ' * 10_000

+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]

+        s.homepage = "http://a.example.com/\x03"

+      end

+

+      fetcher.legacy_platform

+    end

+

+    @cmd.handle_options %w[-r -d]

+

+    use_ui @ui do

+      @cmd.execute

+    end

+

+    expected = <<-EOF

+

+*** REMOTE GEMS ***

+

+a (2)

+    Authors: Abraham Lincoln ., . Hirohito

+    Homepage: http://a.example.com/.

+

+    Truncating the summary for a-2 to 100,000 characters:

+#{"    This is a lot of text. This is a lot of text. This is a lot of text.\n" * 1449}    This is a lot of te

+

 pl (1)

     Platform: i386-linux

     Author: A User

diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb

index 6f8012feb8..0a439cdf3d 100644

--- a/test/rubygems/test_gem_installer.rb

+++ b/test/rubygems/test_gem_installer.rb

@@ -1190,6 +1190,38 @@ def test_pre_install_checks_wrong_rubygems_version

     end

   end

+  def test_pre_install_checks_malicious_name

+    spec = Gem::Specification.new do |s|

+      s.platform    = Gem::Platform::RUBY

+      s.name        = '../malicious'

+      s.version     = '1'

+      s.author      = 'A User'

+      s.email       = 'example@example.com'

+      s.homepage    = 'http://example.com'

+      s.summary     = "this is a summary"

+      s.description = "This is a test description"

+    end

+

+    Gem::Specification.reset

+

+    def spec.full_name # so the spec is buildable

+      "malicious-1"

+    end

+    def spec.validate; end

+

+    util_build_gem spec

+

+    gem = File.join(@gemhome, 'cache', spec.file_name)

+

+    use_ui @ui do

+      @installer = Gem::Installer.new gem

+      e = assert_raises Gem::InstallError do

+        @installer.pre_install_checks

+      end

+      assert_equal '#<Gem::Specification name=../malicious version=1> has an invalid name', e.message

+    end

+  end

+

   def test_shebang

     util_make_exec @spec, "#!/usr/bin/ruby"

diff --git a/test/rubygems/test_gem_remote_fetcher.rb b/test/rubygems/test_gem_remote_fetcher.rb

index 63dd8feb38..ca4627810b 100644

--- a/test/rubygems/test_gem_remote_fetcher.rb

+++ b/test/rubygems/test_gem_remote_fetcher.rb

@@ -191,6 +191,21 @@ def test_api_endpoint

     dns.verify

   end

+  def test_api_endpoint_ignores_trans_domain_values_that_end_with_original_in_path

+    uri = URI.parse "http://example.com/foo"

+    target = MiniTest::Mock.new

+    target.expect :target, "evil.com/a.example.com"

+

+    dns = MiniTest::Mock.new

+    dns.expect :getresource, target, [String, Object]

+

+    fetch = Gem::RemoteFetcher.new nil, dns

+    assert_equal URI.parse("http://example.com/foo"), fetch.api_endpoint(uri)

+

+    target.verify

+    dns.verify

+  end

+

   def test_api_endpoint_ignores_trans_domain_values

     uri = URI.parse "http://gems.example.com/foo"

     target = MiniTest::Mock.new

diff --git a/test/rubygems/test_gem_specification.rb b/test/rubygems/test_gem_specification.rb

index 3cadc55d5d..4f7076a03a 100644

--- a/test/rubygems/test_gem_specification.rb

+++ b/test/rubygems/test_gem_specification.rb

@@ -1598,7 +1598,37 @@ def test_validate_name

       @a1.validate

     end

-    assert_equal 'invalid value for attribute name: ":json"', e.message

+    assert_equal 'invalid value for attribute name: ":json" must be a string', e.message

+

+    @a1.name = []

+    e = assert_raises Gem::InvalidSpecificationException do

+      @a1.validate

+    end

+    assert_equal "invalid value for attribute name: \"[]\" must be a string", e.message

+

+    @a1.name = ""

+    e = assert_raises Gem::InvalidSpecificationException do

+      @a1.validate

+    end

+    assert_equal "invalid value for attribute name: \"\" must include at least one letter", e.message

+

+    @a1.name = "12345"

+    e = assert_raises Gem::InvalidSpecificationException do

+      @a1.validate

+    end

+    assert_equal "invalid value for attribute name: \"12345\" must include at least one letter", e.message

+

+    @a1.name = "../malicious"

+    e = assert_raises Gem::InvalidSpecificationException do

+      @a1.validate

+    end

+    assert_equal "invalid value for attribute name: \"../malicious\" can only include letters, numbers, dashes, and underscores", e.message

+

+    @a1.name = "\ba\t"

+    e = assert_raises Gem::InvalidSpecificationException do

+      @a1.validate

+    end

+    assert_equal "invalid value for attribute name: \"\\ba\\t\" can only include letters, numbers, dashes, and underscores", e.message

   end

   def test_validate_non_nil

diff --git a/test/rubygems/test_gem_text.rb b/test/rubygems/test_gem_text.rb

index e5cfc41e61..9b270b481b 100644

--- a/test/rubygems/test_gem_text.rb

+++ b/test/rubygems/test_gem_text.rb

@@ -35,6 +35,10 @@ def test_format_text_trailing # for two spaces after .

     assert_equal expected, format_text(text, 78)

   end

+  def test_format_removes_nonprintable_characters

+    assert_equal "text with weird .. stuff .", format_text("text with weird \x1b\x02 stuff \x7f", 40)

+  end

+

   def test_levenshtein_distance_add

     assert_equal 2, levenshtein_distance("zentest", "zntst")

     assert_equal 2, levenshtein_distance("zntst", "zentest")

@@ -55,4 +59,11 @@ def test_levenshtein_distance_replace

     assert_equal 7, levenshtein_distance("xxxxxxx", "ZenTest")

     assert_equal 7, levenshtein_distance("zentest", "xxxxxxx")

   end

+

+  def test_truncate_text

+    assert_equal "abc", truncate_text("abc", "desc")

+    assert_equal "Truncating desc to 2 characters:\nab", truncate_text("abc", "desc", 2)

+    s = "ab" * 500_001

+    assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)

+  end

 end

-- 

2.15.1