|
|
121925 |
From f86e5daee790ee509cb17f4f51f95cc76ca89a4e Mon Sep 17 00:00:00 2001
|
|
|
121925 |
From: usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
|
|
|
121925 |
Date: Mon, 18 Mar 2019 18:30:36 +0000
|
|
|
121925 |
Subject: [PATCH] Applied security patches for RubyGems
|
|
|
121925 |
|
|
|
121925 |
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@67303 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
|
|
|
121925 |
---
|
|
|
121925 |
lib/rubygems/command_manager.rb | 10 ++-
|
|
|
121925 |
lib/rubygems/commands/owner_command.rb | 5 +-
|
|
|
121925 |
lib/rubygems/gemcutter_utilities.rb | 8 +-
|
|
|
121925 |
lib/rubygems/installer.rb | 29 +++++--
|
|
|
121925 |
lib/rubygems/user_interaction.rb | 8 +-
|
|
|
121925 |
test/rubygems/test_gem_installer.rb | 108 +++++++++++++++++++++++++
|
|
|
121925 |
test/rubygems/test_gem_text.rb | 5 ++
|
|
|
121925 |
7 files changed, 159 insertions(+), 14 deletions(-)
|
|
|
121925 |
|
|
|
121925 |
diff --git a/lib/rubygems/command_manager.rb b/lib/rubygems/command_manager.rb
|
|
|
121925 |
index 451b719c4683..d3ff6614dc47 100644
|
|
|
121925 |
--- a/lib/rubygems/command_manager.rb
|
|
|
121925 |
+++ b/lib/rubygems/command_manager.rb
|
|
|
121925 |
@@ -6,6 +6,7 @@
|
|
|
121925 |
|
|
|
121925 |
require 'rubygems/command'
|
|
|
121925 |
require 'rubygems/user_interaction'
|
|
|
121925 |
+require 'rubygems/text'
|
|
|
121925 |
|
|
|
121925 |
##
|
|
|
121925 |
# The command manager registers and installs all the individual sub-commands
|
|
|
121925 |
@@ -31,6 +32,7 @@
|
|
|
121925 |
|
|
|
121925 |
class Gem::CommandManager
|
|
|
121925 |
|
|
|
121925 |
+ include Gem::Text
|
|
|
121925 |
include Gem::UserInteraction
|
|
|
121925 |
|
|
|
121925 |
##
|
|
|
121925 |
@@ -129,7 +131,7 @@ def command_names
|
|
|
121925 |
def run(args, build_args=nil)
|
|
|
121925 |
process_args(args, build_args)
|
|
|
121925 |
rescue StandardError, Timeout::Error => ex
|
|
|
121925 |
- alert_error "While executing gem ... (#{ex.class})\n #{ex.to_s}"
|
|
|
121925 |
+ alert_error clean_text("While executing gem ... (#{ex.class})\n #{ex}")
|
|
|
121925 |
ui.backtrace ex
|
|
|
121925 |
|
|
|
121925 |
if Gem.configuration.really_verbose and \
|
|
|
121925 |
@@ -142,7 +144,7 @@ def run(args, build_args=nil)
|
|
|
121925 |
|
|
|
121925 |
terminate_interaction(1)
|
|
|
121925 |
rescue Interrupt
|
|
|
121925 |
- alert_error "Interrupted"
|
|
|
121925 |
+ alert_error clean_text("Interrupted")
|
|
|
121925 |
terminate_interaction(1)
|
|
|
121925 |
end
|
|
|
121925 |
|
|
|
121925 |
@@ -162,7 +164,7 @@ def process_args(args, build_args=nil)
|
|
|
121925 |
say Gem::VERSION
|
|
|
121925 |
terminate_interaction 0
|
|
|
121925 |
when /^-/ then
|
|
|
121925 |
- alert_error "Invalid option: #{args.first}. See 'gem --help'."
|
|
|
121925 |
+ alert_error clean_text("Invalid option: #{args.first}. See 'gem --help'.")
|
|
|
121925 |
terminate_interaction 1
|
|
|
121925 |
else
|
|
|
121925 |
cmd_name = args.shift.downcase
|
|
|
121925 |
@@ -211,7 +213,7 @@ def load_and_instantiate(command_name)
|
|
|
121925 |
rescue Exception => e
|
|
|
121925 |
e = load_error if load_error
|
|
|
121925 |
|
|
|
121925 |
- alert_error "Loading command: #{command_name} (#{e.class})\n\t#{e}"
|
|
|
121925 |
+ alert_error clean_text("Loading command: #{command_name} (#{e.class})\n\t#{e}")
|
|
|
121925 |
ui.backtrace e
|
|
|
121925 |
end
|
|
|
121925 |
end
|
|
|
121925 |
diff --git a/lib/rubygems/commands/owner_command.rb b/lib/rubygems/commands/owner_command.rb
|
|
|
121925 |
index 2ee7f84462c1..7842a322cfce 100644
|
|
|
121925 |
--- a/lib/rubygems/commands/owner_command.rb
|
|
|
121925 |
+++ b/lib/rubygems/commands/owner_command.rb
|
|
|
121925 |
@@ -1,8 +1,11 @@
|
|
|
121925 |
require 'rubygems/command'
|
|
|
121925 |
require 'rubygems/local_remote_options'
|
|
|
121925 |
require 'rubygems/gemcutter_utilities'
|
|
|
121925 |
+require 'rubygems/text'
|
|
|
121925 |
|
|
|
121925 |
class Gem::Commands::OwnerCommand < Gem::Command
|
|
|
121925 |
+
|
|
|
121925 |
+ include Gem::Text
|
|
|
121925 |
include Gem::LocalRemoteOptions
|
|
|
121925 |
include Gem::GemcutterUtilities
|
|
|
121925 |
|
|
|
121925 |
@@ -48,7 +51,7 @@ def show_owners name
|
|
|
121925 |
end
|
|
|
121925 |
|
|
|
121925 |
with_response response do |resp|
|
|
|
121925 |
- owners = Gem::SafeYAML.load resp.body
|
|
|
121925 |
+ owners = Gem::SafeYAML.load clean_text(resp.body)
|
|
|
121925 |
|
|
|
121925 |
say "Owners for gem: #{name}"
|
|
|
121925 |
owners.each do |owner|
|
|
|
121925 |
diff --git a/lib/rubygems/gemcutter_utilities.rb b/lib/rubygems/gemcutter_utilities.rb
|
|
|
121925 |
index 7c6d6bb36404..623d9301b598 100644
|
|
|
121925 |
--- a/lib/rubygems/gemcutter_utilities.rb
|
|
|
121925 |
+++ b/lib/rubygems/gemcutter_utilities.rb
|
|
|
121925 |
@@ -1,6 +1,10 @@
|
|
|
121925 |
require 'rubygems/remote_fetcher'
|
|
|
121925 |
+require 'rubygems/text'
|
|
|
121925 |
|
|
|
121925 |
module Gem::GemcutterUtilities
|
|
|
121925 |
+
|
|
|
121925 |
+ include Gem::Text
|
|
|
121925 |
+
|
|
|
121925 |
# TODO: move to Gem::Command
|
|
|
121925 |
OptionParser.accept Symbol do |value|
|
|
|
121925 |
value.to_sym
|
|
|
121925 |
@@ -93,13 +97,13 @@ def with_response response, error_prefix = nil
|
|
|
121925 |
if block_given? then
|
|
|
121925 |
yield resp
|
|
|
121925 |
else
|
|
|
121925 |
- say resp.body
|
|
|
121925 |
+ say clean_text(resp.body)
|
|
|
121925 |
end
|
|
|
121925 |
else
|
|
|
121925 |
message = resp.body
|
|
|
121925 |
message = "#{error_prefix}: #{message}" if error_prefix
|
|
|
121925 |
|
|
|
121925 |
- say message
|
|
|
121925 |
+ say clean_text(message)
|
|
|
121925 |
terminate_interaction 1 # TODO: question this
|
|
|
121925 |
end
|
|
|
121925 |
end
|
|
|
121925 |
diff --git a/lib/rubygems/installer.rb b/lib/rubygems/installer.rb
|
|
|
121925 |
index 6fd3399dd44c..5818b94fb5f8 100644
|
|
|
121925 |
--- a/lib/rubygems/installer.rb
|
|
|
121925 |
+++ b/lib/rubygems/installer.rb
|
|
|
121925 |
@@ -596,9 +596,26 @@ def verify_gem_home(unpack = false) # :nodoc:
|
|
|
121925 |
unpack or File.writable?(gem_home)
|
|
|
121925 |
end
|
|
|
121925 |
|
|
|
121925 |
- def verify_spec_name
|
|
|
121925 |
- return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
|
|
|
121925 |
- raise Gem::InstallError, "#{spec} has an invalid name"
|
|
|
121925 |
+ def verify_spec
|
|
|
121925 |
+ unless spec.name =~ Gem::Specification::VALID_NAME_PATTERN
|
|
|
121925 |
+ raise Gem::InstallError, "#{spec} has an invalid name"
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ if spec.require_paths.any?{|path| path =~ /\r\n|\r|\n/ }
|
|
|
121925 |
+ raise Gem::InstallError, "#{spec} has an invalid require_paths"
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ if spec.extensions.any?{|ext| ext =~ /\r\n|\r|\n/ }
|
|
|
121925 |
+ raise Gem::InstallError, "#{spec} has an invalid extensions"
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ unless spec.specification_version.to_s =~ /\A\d+\z/
|
|
|
121925 |
+ raise Gem::InstallError, "#{spec} has an invalid specification_version"
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ if spec.dependencies.any? {|dep| dep.type =~ /\r\n|\r|\n/ || dep.name =~ /\r\n|\r|\n/ }
|
|
|
121925 |
+ raise Gem::InstallError, "#{spec} has an invalid dependencies"
|
|
|
121925 |
+ end
|
|
|
121925 |
end
|
|
|
121925 |
|
|
|
121925 |
##
|
|
|
121925 |
@@ -770,9 +787,11 @@ def dir
|
|
|
121925 |
@security_policy = nil if
|
|
|
121925 |
@force and @security_policy and not @security_policy.only_signed
|
|
|
121925 |
|
|
|
121925 |
+ # The name and require_paths must be verified first, since it could contain
|
|
|
121925 |
+ # ruby code that would be eval'ed in #ensure_loadable_spec
|
|
|
121925 |
+ verify_spec
|
|
|
121925 |
+
|
|
|
121925 |
ensure_loadable_spec
|
|
|
121925 |
-
|
|
|
121925 |
- verify_spec_name
|
|
|
121925 |
|
|
|
121925 |
Gem.ensure_gem_subdirectories gem_home
|
|
|
121925 |
|
|
|
121925 |
diff --git a/lib/rubygems/user_interaction.rb b/lib/rubygems/user_interaction.rb
|
|
|
121925 |
index 390d0f2aea72..237ae2bc71c2 100644
|
|
|
121925 |
--- a/lib/rubygems/user_interaction.rb
|
|
|
121925 |
+++ b/lib/rubygems/user_interaction.rb
|
|
|
121925 |
@@ -4,11 +4,15 @@
|
|
|
121925 |
# See LICENSE.txt for permissions.
|
|
|
121925 |
#++
|
|
|
121925 |
|
|
|
121925 |
+require 'rubygems/text'
|
|
|
121925 |
+
|
|
|
121925 |
##
|
|
|
121925 |
# Module that defines the default UserInteraction. Any class including this
|
|
|
121925 |
# module will have access to the +ui+ method that returns the default UI.
|
|
|
121925 |
|
|
|
121925 |
module Gem::DefaultUserInteraction
|
|
|
121925 |
+
|
|
|
121925 |
+ include Gem::Text
|
|
|
121925 |
|
|
|
121925 |
##
|
|
|
121925 |
# The default UI is a class variable of the singleton class for this
|
|
|
121925 |
@@ -124,8 +128,8 @@ def terminate_interaction exit_code = 0
|
|
|
121925 |
# Calls +say+ with +msg+ or the results of the block if really_verbose
|
|
|
121925 |
# is true.
|
|
|
121925 |
|
|
|
121925 |
- def verbose msg = nil
|
|
|
121925 |
- say(msg || yield) if Gem.configuration.really_verbose
|
|
|
121925 |
+ def verbose(msg = nil)
|
|
|
121925 |
+ say(clean_text(msg || yield)) if Gem.configuration.really_verbose
|
|
|
121925 |
end
|
|
|
121925 |
end
|
|
|
121925 |
|
|
|
121925 |
diff --git a/test/rubygems/test_gem_installer.rb b/test/rubygems/test_gem_installer.rb
|
|
|
121925 |
index dd049214fbb8..af4573cde8d2 100644
|
|
|
121925 |
--- a/test/rubygems/test_gem_installer.rb
|
|
|
121925 |
+++ b/test/rubygems/test_gem_installer.rb
|
|
|
121925 |
@@ -1222,6 +1222,114 @@ def spec.validate; end
|
|
|
121925 |
end
|
|
|
121925 |
end
|
|
|
121925 |
|
|
|
121925 |
+ def test_pre_install_checks_malicious_name_before_eval
|
|
|
121925 |
+ spec = util_spec "malicious\n::Object.const_set(:FROM_EVAL, true)#", '1'
|
|
|
121925 |
+ def spec.full_name # so the spec is buildable
|
|
|
121925 |
+ "malicious-1"
|
|
|
121925 |
+ end
|
|
|
121925 |
+ def spec.validate(*args); end
|
|
|
121925 |
+
|
|
|
121925 |
+ util_build_gem spec
|
|
|
121925 |
+
|
|
|
121925 |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
121925 |
+
|
|
|
121925 |
+ use_ui @ui do
|
|
|
121925 |
+ @installer = Gem::Installer.new gem
|
|
|
121925 |
+ e = assert_raises Gem::InstallError do
|
|
|
121925 |
+ @installer.pre_install_checks
|
|
|
121925 |
+ end
|
|
|
121925 |
+ assert_equal "#<Gem::Specification name=malicious\n::Object.const_set(:FROM_EVAL, true)# version=1> has an invalid name", e.message
|
|
|
121925 |
+ end
|
|
|
121925 |
+ refute defined?(::Object::FROM_EVAL)
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ def test_pre_install_checks_malicious_require_paths_before_eval
|
|
|
121925 |
+ spec = util_spec "malicious", '1'
|
|
|
121925 |
+ def spec.full_name # so the spec is buildable
|
|
|
121925 |
+ "malicious-1"
|
|
|
121925 |
+ end
|
|
|
121925 |
+ def spec.validate(*args); end
|
|
|
121925 |
+ spec.require_paths = ["malicious\n``"]
|
|
|
121925 |
+
|
|
|
121925 |
+ util_build_gem spec
|
|
|
121925 |
+
|
|
|
121925 |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
121925 |
+
|
|
|
121925 |
+ use_ui @ui do
|
|
|
121925 |
+ @installer = Gem::Installer.new gem
|
|
|
121925 |
+ e = assert_raises Gem::InstallError do
|
|
|
121925 |
+ @installer.pre_install_checks
|
|
|
121925 |
+ end
|
|
|
121925 |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid require_paths", e.message
|
|
|
121925 |
+ end
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ def test_pre_install_checks_malicious_extensions_before_eval
|
|
|
121925 |
+ skip "mswin environment disallow to create file contained the carriage return code." if Gem.win_platform?
|
|
|
121925 |
+
|
|
|
121925 |
+ spec = util_spec "malicious", '1'
|
|
|
121925 |
+ def spec.full_name # so the spec is buildable
|
|
|
121925 |
+ "malicious-1"
|
|
|
121925 |
+ end
|
|
|
121925 |
+ def spec.validate(*args); end
|
|
|
121925 |
+ spec.extensions = ["malicious\n``"]
|
|
|
121925 |
+
|
|
|
121925 |
+ util_build_gem spec
|
|
|
121925 |
+
|
|
|
121925 |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
121925 |
+
|
|
|
121925 |
+ use_ui @ui do
|
|
|
121925 |
+ @installer = Gem::Installer.new gem
|
|
|
121925 |
+ e = assert_raises Gem::InstallError do
|
|
|
121925 |
+ @installer.pre_install_checks
|
|
|
121925 |
+ end
|
|
|
121925 |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid extensions", e.message
|
|
|
121925 |
+ end
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ def test_pre_install_checks_malicious_specification_version_before_eval
|
|
|
121925 |
+ spec = util_spec "malicious", '1'
|
|
|
121925 |
+ def spec.full_name # so the spec is buildable
|
|
|
121925 |
+ "malicious-1"
|
|
|
121925 |
+ end
|
|
|
121925 |
+ def spec.validate(*args); end
|
|
|
121925 |
+ spec.specification_version = "malicious\n``"
|
|
|
121925 |
+
|
|
|
121925 |
+ util_build_gem spec
|
|
|
121925 |
+
|
|
|
121925 |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
121925 |
+
|
|
|
121925 |
+ use_ui @ui do
|
|
|
121925 |
+ @installer = Gem::Installer.new gem
|
|
|
121925 |
+ e = assert_raises Gem::InstallError do
|
|
|
121925 |
+ @installer.pre_install_checks
|
|
|
121925 |
+ end
|
|
|
121925 |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid specification_version", e.message
|
|
|
121925 |
+ end
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
+ def test_pre_install_checks_malicious_dependencies_before_eval
|
|
|
121925 |
+ spec = util_spec "malicious", '1'
|
|
|
121925 |
+ def spec.full_name # so the spec is buildable
|
|
|
121925 |
+ "malicious-1"
|
|
|
121925 |
+ end
|
|
|
121925 |
+ def spec.validate(*args); end
|
|
|
121925 |
+ spec.add_dependency "b\nfoo", '> 5'
|
|
|
121925 |
+
|
|
|
121925 |
+ util_build_gem spec
|
|
|
121925 |
+
|
|
|
121925 |
+ gem = File.join(@gemhome, 'cache', spec.file_name)
|
|
|
121925 |
+
|
|
|
121925 |
+ use_ui @ui do
|
|
|
121925 |
+ @installer = Gem::Installer.new gem
|
|
|
121925 |
+ @installer.ignore_dependencies = true
|
|
|
121925 |
+ e = assert_raises Gem::InstallError do
|
|
|
121925 |
+ @installer.pre_install_checks
|
|
|
121925 |
+ end
|
|
|
121925 |
+ assert_equal "#<Gem::Specification name=malicious version=1> has an invalid dependencies", e.message
|
|
|
121925 |
+ end
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
def test_shebang
|
|
|
121925 |
util_make_exec @spec, "#!/usr/bin/ruby"
|
|
|
121925 |
|
|
|
121925 |
diff --git a/test/rubygems/test_gem_text.rb b/test/rubygems/test_gem_text.rb
|
|
|
121925 |
index 04f3f605e8c0..8ce6df94bbc0 100644
|
|
|
121925 |
--- a/test/rubygems/test_gem_text.rb
|
|
|
121925 |
+++ b/test/rubygems/test_gem_text.rb
|
|
|
121925 |
@@ -66,4 +66,9 @@ def test_truncate_text
|
|
|
121925 |
s = "ab" * 500_001
|
|
|
121925 |
assert_equal "Truncating desc to 1,000,000 characters:\n#{s[0, 1_000_000]}", truncate_text(s, "desc", 1_000_000)
|
|
|
121925 |
end
|
|
|
121925 |
+
|
|
|
121925 |
+ def test_clean_text
|
|
|
121925 |
+ assert_equal ".]2;nyan.", clean_text("\e]2;nyan\a")
|
|
|
121925 |
+ end
|
|
|
121925 |
+
|
|
|
121925 |
end
|