From f86e5daee790ee509cb17f4f51f95cc76ca89a4e Mon Sep 17 00:00:00 2001

From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>

Date: Mon, 18 Mar 2019 18:30:36 +0000

Subject: [PATCH] Applied security patches for RubyGems

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@67303 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

---

 lib/rubygems/command_manager.rb        |  10 ++-

 lib/rubygems/commands/owner_command.rb |   5 +-

 lib/rubygems/gemcutter_utilities.rb    |   8 +-

 lib/rubygems/installer.rb              |  29 +++++--

 lib/rubygems/user_interaction.rb       |   8 +-

 test/rubygems/test_gem_installer.rb    | 108 +++++++++++++++++++++++++

 test/rubygems/test_gem_text.rb         |   5 ++

 7 files changed, 159 insertions(+), 14 deletions(-)

diff --git a/lib/rubygems/command_manager.rb b/lib/rubygems/command_manager.rb

index 451b719c4683..d3ff6614dc47 100644

--- a/lib/rubygems/command_manager.rb

+++ b/lib/rubygems/command_manager.rb

@@ -6,6 +6,7 @@

 require 'rubygems/command'

 require 'rubygems/user_interaction'

+require 'rubygems/text'

 ##

 # The command manager registers and installs all the individual sub-commands

@@ -31,6 +32,7 @@

 class Gem::CommandManager

+  include Gem::Text

   include Gem::UserInteraction

   ##

@@ -129,7 +131,7 @@ def command_names

   def run(args, build_args=nil)

     process_args(args, build_args)

   rescue StandardError, Timeout::Error => ex

-    alert_error "While executing gem ... (#{ex.class})\n    #{ex.to_s}"

+    alert_error clean_text("While executing gem ... (#{ex.class})\n    #{ex}")

     ui.backtrace ex

     if Gem.configuration.really_verbose and \

@@ -142,7 +144,7 @@ def run(args, build_args=nil)

     terminate_interaction(1)

   rescue Interrupt

-    alert_error "Interrupted"

+    alert_error clean_text("Interrupted")

     terminate_interaction(1)

   end

@@ -162,7 +164,7 @@ def process_args(args, build_args=nil)

       say Gem::VERSION

       terminate_interaction 0

     when /^-/ then

-      alert_error "Invalid option: #{args.first}.  See 'gem --help'."

+      alert_error clean_text("Invalid option: #{args.first}. See 'gem --help'.")

       terminate_interaction 1

     else

       cmd_name = args.shift.downcase

@@ -211,7 +213,7 @@ def load_and_instantiate(command_name)

     rescue Exception => e

       e = load_error if load_error

-      alert_error "Loading command: #{command_name} (#{e.class})\n\t#{e}"

+      alert_error clean_text("Loading command: #{command_name} (#{e.class})\n\t#{e}")

       ui.backtrace e

     end

   end

diff --git a/lib/rubygems/commands/owner_command.rb b/lib/rubygems/commands/owner_command.rb

index 2ee7f84462c1..7842a322cfce 100644

--- a/lib/rubygems/commands/owner_command.rb

+++ b/lib/rubygems/commands/owner_command.rb

@@ -1,8 +1,11 @@

 require 'rubygems/command'

 require 'rubygems/local_remote_options'

 require 'rubygems/gemcutter_utilities'

+require 'rubygems/text'

 class Gem::Commands::OwnerCommand < Gem::Command

+

+  include Gem::Text

   include Gem::LocalRemoteOptions

   include Gem::GemcutterUtilities

@@ -48,7 +51,7 @@ def show_owners name

     end

     with_response response do |resp|

-      owners = YAML.load resp.body

+      owners = Gem::SafeYAML.load clean_text(resp.body)

       say "Owners for gem: #{name}"

       owners.each do |owner|

diff --git a/lib/rubygems/gemcutter_utilities.rb b/lib/rubygems/gemcutter_utilities.rb

index 7c6d6bb36404..623d9301b598 100644

--- a/lib/rubygems/gemcutter_utilities.rb

+++ b/lib/rubygems/gemcutter_utilities.rb

@@ -1,6 +1,10 @@

 require 'rubygems/remote_fetcher'

+require 'rubygems/text'

 module Gem::GemcutterUtilities

+

+  include Gem::Text

+

   # TODO: move to Gem::Command

   OptionParser.accept Symbol do |value|

     value.to_sym

@@ -93,13 +97,13 @@ def with_response response, error_prefix = nil

       if block_given? then

         yield resp

       else

-        say resp.body

+        say clean_text(resp.body)

       end

     else

       message = resp.body

       message = "#{error_prefix}: #{message}" if error_prefix

-      say message

+      say clean_text(message)

       terminate_interaction 1 # TODO: question this

     end

   end

diff --git a/lib/rubygems/installer.rb b/lib/rubygems/installer.rb

index 6fd3399dd44c..5818b94fb5f8 100644

--- a/lib/rubygems/installer.rb

+++ b/lib/rubygems/installer.rb

@@ -596,9 +596,26 @@ def verify_gem_home(unpack = false) # :nodoc:

       unpack or File.writable?(gem_home)

   end

-  def verify_spec_name

-    return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN

-    raise Gem::InstallError, "#{spec} has an invalid name"

+  def verify_spec

+    unless spec.name =~ Gem::Specification::VALID_NAME_PATTERN

+      raise Gem::InstallError, "#{spec} has an invalid name"

+    end

+

+    if spec.require_paths.any?{|path| path =~ /\r\n|\r|\n/ }

+      raise Gem::InstallError, "#{spec} has an invalid require_paths"

+    end

+

+    if spec.extensions.any?{|ext| ext =~ /\r\n|\r|\n/ }

+      raise Gem::InstallError, "#{spec} has an invalid extensions"

+    end

+

+    unless spec.specification_version.to_s =~ /\A\d+\z/

+      raise Gem::InstallError, "#{spec} has an invalid specification_version"

+    end

+

+    if spec.dependencies.any? {|dep| dep.type =~ /\r\n|\r|\n/ || dep.name =~ /\r\n|\r|\n/ }

+      raise Gem::InstallError, "#{spec} has an invalid dependencies"

+    end

   end

   ##

@@ -770,9 +787,11 @@ def dir

     @security_policy = nil if

       @force and @security_policy and not @security_policy.only_signed

+    # The name and require_paths must be verified first, since it could contain

+    # ruby code that would be eval'ed in #ensure_loadable_spec

+    verify_spec

+

     ensure_loadable_spec

-

-    verify_spec_name

     Gem.ensure_gem_subdirectories gem_home

diff --git a/lib/rubygems/user_interaction.rb b/lib/rubygems/user_interaction.rb

index 390d0f2aea72..237ae2bc71c2 100644

--- a/lib/rubygems/user_interaction.rb

+++ b/lib/rubygems/user_interaction.rb

@@ -4,11 +4,15 @@

 # See LICENSE.txt for permissions.

 #++

+require 'rubygems/text'

+

 ##

 # Module that defines the default UserInteraction.  Any class including this

 # module will have access to the +ui+ method that returns the default UI.

 module Gem::DefaultUserInteraction

+

+  include Gem::Text

   ##

   # The default UI is a class variable of the singleton class for this

@@ -124,8 +128,8 @@ def terminate_interaction exit_code = 0

   # Calls +say+ with +msg+ or the results of the block if really_verbose

   # is true.

-  def verbose msg = nil

-    say(msg || yield) if Gem.configuration.really_verbose

+  def verbose(msg = nil)

+    say(clean_text(msg || yield)) if Gem.configuration.really_verbose

   end

 end

diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb

index dd049214fbb8..af4573cde8d2 100644

--- a/test/rubygems/test_gem_installer.rb

+++ b/test/rubygems/test_gem_installer.rb

@@ -1222,6 +1222,114 @@ def spec.validate; end

     end

   end

+  def test_pre_install_checks_malicious_name_before_eval

+    spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1'

+    def spec.full_name # so the spec is buildable

+      "malicious-1"

+    end

+    def spec.validate(*args); end

+

+    util_build_gem spec

+

+    gem = File.join(@gemhome, 'cache', spec.file_name)

+

+    use_ui @ui do

+      @installer = Gem::Installer.new gem

+      e = assert_raises Gem::InstallError do

+        @installer.pre_install_checks

+      end

+      assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message

+    end

+    refute defined?(::Object::FROM_EVAL)

+  end

+

+  def test_pre_install_checks_malicious_require_paths_before_eval

+    spec = util_spec "malicious", '1'

+    def spec.full_name # so the spec is buildable

+      "malicious-1"

+    end

+    def spec.validate(*args); end

+    spec.require_paths = ["malicious\n``"]

+

+    util_build_gem spec

+

+    gem = File.join(@gemhome, 'cache', spec.file_name)

+

+    use_ui @ui do

+      @installer = Gem::Installer.new gem

+      e = assert_raises Gem::InstallError do

+        @installer.pre_install_checks

+      end

+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message

+    end

+  end

+

+  def test_pre_install_checks_malicious_extensions_before_eval

+    skip "mswin environment disallow to create file contained the carriage return code." if Gem.win_platform?

+

+    spec = util_spec "malicious", '1'

+    def spec.full_name # so the spec is buildable

+      "malicious-1"

+    end

+    def spec.validate(*args); end

+    spec.extensions = ["malicious\n``"]

+

+    util_build_gem spec

+

+    gem = File.join(@gemhome, 'cache', spec.file_name)

+

+    use_ui @ui do

+      @installer = Gem::Installer.new gem

+      e = assert_raises Gem::InstallError do

+        @installer.pre_install_checks

+      end

+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message

+    end

+  end

+

+  def test_pre_install_checks_malicious_specification_version_before_eval

+    spec = util_spec "malicious", '1'

+    def spec.full_name # so the spec is buildable

+      "malicious-1"

+    end

+    def spec.validate(*args); end

+    spec.specification_version = "malicious\n``"

+

+    util_build_gem spec

+

+    gem = File.join(@gemhome, 'cache', spec.file_name)

+

+    use_ui @ui do

+      @installer = Gem::Installer.new gem

+      e = assert_raises Gem::InstallError do

+        @installer.pre_install_checks

+      end

+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message

+    end

+  end

+

+  def test_pre_install_checks_malicious_dependencies_before_eval

+    spec = util_spec "malicious", '1'

+    def spec.full_name # so the spec is buildable

+      "malicious-1"

+    end

+    def spec.validate(*args); end

+    spec.add_dependency "b\nfoo", '> 5'

+

+    util_build_gem spec

+

+    gem = File.join(@gemhome, 'cache', spec.file_name)

+

+    use_ui @ui do

+      @installer = Gem::Installer.new gem

+      @installer.ignore_dependencies = true

+      e = assert_raises Gem::InstallError do

+        @installer.pre_install_checks

+      end

+      assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message

+    end

+  end

+

   def test_shebang

     util_make_exec @spec, "#!/usr/bin/ruby"

diff --git a/test/rubygems/test_gem_text.rb b/test/rubygems/test_gem_text.rb

index 04f3f605e8c0..8ce6df94bbc0 100644

--- a/test/rubygems/test_gem_text.rb

+++ b/test/rubygems/test_gem_text.rb

@@ -66,4 +66,9 @@ def test_truncate_text

     s = "ab" * 500_001

     assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)

   end

+

+  def test_clean_text

+    assert_equal ".]2;nyan.", clean_text("\e]2;nyan\a")

+  end

+

 end