aboutsummaryrefslogtreecommitdiffstats
path: root/spec/ruby/security
diff options
context:
space:
mode:
authorBenoit Daloze <eregontp@gmail.com>2021-10-20 21:41:46 +0200
committerBenoit Daloze <eregontp@gmail.com>2021-10-20 21:41:46 +0200
commita6c6eef04aaa075f4bbd0eef740d011737afec91 (patch)
treee8779ca2ddc044899caabca88c16abc9a9054fff /spec/ruby/security
parent207a5a5bc13018344dc2ab7913fdcaeaeca01292 (diff)
downloadruby-a6c6eef04aaa075f4bbd0eef740d011737afec91.tar.gz
Update to ruby/spec@d6921ef
Diffstat (limited to 'spec/ruby/security')
-rw-r--r--spec/ruby/security/cve_2010_1330_spec.rb2
-rw-r--r--spec/ruby/security/cve_2013_4164_spec.rb4
-rw-r--r--spec/ruby/security/cve_2014_8080_spec.rb1
-rw-r--r--spec/ruby/security/cve_2018_16396_spec.rb4
-rw-r--r--spec/ruby/security/cve_2018_8778_spec.rb2
-rw-r--r--spec/ruby/security/cve_2019_8323_spec.rb54
-rw-r--r--spec/ruby/security/cve_2019_8325_spec.rb6
7 files changed, 31 insertions, 42 deletions
diff --git a/spec/ruby/security/cve_2010_1330_spec.rb b/spec/ruby/security/cve_2010_1330_spec.rb
index fa4c756c6d..33e88d652e 100644
--- a/spec/ruby/security/cve_2010_1330_spec.rb
+++ b/spec/ruby/security/cve_2010_1330_spec.rb
@@ -1,7 +1,6 @@
require_relative '../spec_helper'
describe "String#gsub" do
-
it "resists CVE-2010-1330 by raising an exception on invalid UTF-8 bytes" do
# This original vulnerability talked about KCODE, which is no longer
# used. Instead we are forcing encodings here. But I think the idea is the
@@ -17,5 +16,4 @@ describe "String#gsub" do
str.gsub(/</, "&lt;")
}.should raise_error(ArgumentError, /invalid byte sequence in UTF-8/)
end
-
end
diff --git a/spec/ruby/security/cve_2013_4164_spec.rb b/spec/ruby/security/cve_2013_4164_spec.rb
index 94578cc7ce..d223b8fd5e 100644
--- a/spec/ruby/security/cve_2013_4164_spec.rb
+++ b/spec/ruby/security/cve_2013_4164_spec.rb
@@ -3,17 +3,13 @@ require_relative '../spec_helper'
require 'json'
describe "String#to_f" do
-
it "resists CVE-2013-4164 by converting very long Strings to a Float" do
"1.#{'1'*1000000}".to_f.should be_close(1.1111111111111112, TOLERANCE)
end
-
end
describe "JSON.parse" do
-
it "resists CVE-2013-4164 by converting very long Strings to a Float" do
JSON.parse("[1.#{'1'*1000000}]").first.should be_close(1.1111111111111112, TOLERANCE)
end
-
end
diff --git a/spec/ruby/security/cve_2014_8080_spec.rb b/spec/ruby/security/cve_2014_8080_spec.rb
index a3f4483994..23770f94b1 100644
--- a/spec/ruby/security/cve_2014_8080_spec.rb
+++ b/spec/ruby/security/cve_2014_8080_spec.rb
@@ -1,6 +1,5 @@
require_relative '../spec_helper'
-
ruby_version_is ''...'3.0' do
require 'rexml/document'
diff --git a/spec/ruby/security/cve_2018_16396_spec.rb b/spec/ruby/security/cve_2018_16396_spec.rb
index 303c47a8c7..c9624e9c63 100644
--- a/spec/ruby/security/cve_2018_16396_spec.rb
+++ b/spec/ruby/security/cve_2018_16396_spec.rb
@@ -1,7 +1,6 @@
require_relative '../spec_helper'
describe "Array#pack" do
-
ruby_version_is ''...'2.7' do
it "resists CVE-2018-16396 by tainting output based on input" do
"aAZBbHhuMmPp".each_char do |f|
@@ -9,11 +8,9 @@ describe "Array#pack" do
end
end
end
-
end
describe "String#unpack" do
-
ruby_version_is ''...'2.7' do
it "resists CVE-2018-16396 by tainting output based on input" do
"aAZBbHhuMm".each_char do |f|
@@ -21,5 +18,4 @@ describe "String#unpack" do
end
end
end
-
end
diff --git a/spec/ruby/security/cve_2018_8778_spec.rb b/spec/ruby/security/cve_2018_8778_spec.rb
index 628159a4db..62057faa53 100644
--- a/spec/ruby/security/cve_2018_8778_spec.rb
+++ b/spec/ruby/security/cve_2018_8778_spec.rb
@@ -1,12 +1,10 @@
require_relative '../spec_helper'
describe "String#unpack" do
-
it "resists CVE-2018-8778 by raising an exception when a position indicator is larger than a native integer" do
pos = (1 << PlatformGuard::POINTER_SIZE) - 99
-> {
"0123456789".unpack("@#{pos}C10")
}.should raise_error(RangeError, /pack length too big/)
end
-
end
diff --git a/spec/ruby/security/cve_2019_8323_spec.rb b/spec/ruby/security/cve_2019_8323_spec.rb
index d4606de054..3632d3b028 100644
--- a/spec/ruby/security/cve_2019_8323_spec.rb
+++ b/spec/ruby/security/cve_2019_8323_spec.rb
@@ -1,36 +1,38 @@
require_relative '../spec_helper'
-require 'optparse'
+platform_is_not :darwin do # frequent timeout/hang on macOS
+ require 'optparse'
-require 'rubygems'
-require 'rubygems/gemcutter_utilities'
+ require 'rubygems'
+ require 'rubygems/gemcutter_utilities'
-describe "CVE-2019-8323 is resisted by" do
- describe "sanitising the body" do
- it "for success codes" do
- cutter = Class.new {
- include Gem::GemcutterUtilities
- }.new
- response = Net::HTTPSuccess.new(nil, nil, nil)
- def response.body
- "\e]2;nyan\a"
+ describe "CVE-2019-8323 is resisted by" do
+ describe "sanitising the body" do
+ it "for success codes" do
+ cutter = Class.new {
+ include Gem::GemcutterUtilities
+ }.new
+ response = Net::HTTPSuccess.new(nil, nil, nil)
+ def response.body
+ "\e]2;nyan\a"
+ end
+ cutter.should_receive(:say).with(".]2;nyan.")
+ cutter.with_response response
end
- cutter.should_receive(:say).with(".]2;nyan.")
- cutter.with_response response
- end
- it "for error codes" do
- cutter = Class.new {
- include Gem::GemcutterUtilities
- }.new
- def cutter.terminate_interaction(n)
- end
- response = Net::HTTPNotFound.new(nil, nil, nil)
- def response.body
- "\e]2;nyan\a"
+ it "for error codes" do
+ cutter = Class.new {
+ include Gem::GemcutterUtilities
+ }.new
+ def cutter.terminate_interaction(n)
+ end
+ response = Net::HTTPNotFound.new(nil, nil, nil)
+ def response.body
+ "\e]2;nyan\a"
+ end
+ cutter.should_receive(:say).with(".]2;nyan.")
+ cutter.with_response response
end
- cutter.should_receive(:say).with(".]2;nyan.")
- cutter.with_response response
end
end
end
diff --git a/spec/ruby/security/cve_2019_8325_spec.rb b/spec/ruby/security/cve_2019_8325_spec.rb
index 935f127d7f..309445a50f 100644
--- a/spec/ruby/security/cve_2019_8325_spec.rb
+++ b/spec/ruby/security/cve_2019_8325_spec.rb
@@ -1,9 +1,9 @@
require_relative '../spec_helper'
-require 'rubygems'
-require 'rubygems/command_manager'
-
platform_is_not :darwin do # frequent timeout/hang on macOS
+ require 'rubygems'
+ require 'rubygems/command_manager'
+
describe "CVE-2019-8325 is resisted by" do
describe "sanitising error message components" do
it "for the 'while executing' message" do