diff options
author | hsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2015-06-11 05:34:52 +0000 |
---|---|---|
committer | hsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2015-06-11 05:34:52 +0000 |
commit | 038213351b757fb5a62bc9313b64fcb78ff2ce97 (patch) | |
tree | f58266730b1f084a889f6e00fb516260bf56284a /lib | |
parent | 7d3923e9d848830648cac0339d25d234dcf37300 (diff) | |
download | ruby-038213351b757fb5a62bc9313b64fcb78ff2ce97.tar.gz |
* lib/rubygems.rb: bump version to 2.4.7 and 2.4.8. these versions fixed
CVE-2015-3900.
* lib/rubygems/remote_fetcher.rb: ditto.
* test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@50829 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib')
-rw-r--r-- | lib/rubygems.rb | 2 | ||||
-rw-r--r-- | lib/rubygems/remote_fetcher.rb | 8 |
2 files changed, 8 insertions, 2 deletions
diff --git a/lib/rubygems.rb b/lib/rubygems.rb index 2bd8cc77f9..817805c1f4 100644 --- a/lib/rubygems.rb +++ b/lib/rubygems.rb @@ -9,7 +9,7 @@ require 'rbconfig' require 'thread' module Gem - VERSION = '2.4.6' + VERSION = '2.4.8' end # Must be first since it unloads the prelude from 1.9.2 diff --git a/lib/rubygems/remote_fetcher.rb b/lib/rubygems/remote_fetcher.rb index da1febbe86..3f107a3981 100644 --- a/lib/rubygems/remote_fetcher.rb +++ b/lib/rubygems/remote_fetcher.rb @@ -94,7 +94,13 @@ class Gem::RemoteFetcher rescue Resolv::ResolvError uri else - URI.parse "#{uri.scheme}://#{res.target}#{uri.path}" + target = res.target.to_s.strip + + if /\.#{Regexp.quote(host)}\z/ =~ target + return URI.parse "#{uri.scheme}://#{target}#{uri.path}" + end + + uri end end |