aboutsummaryrefslogtreecommitdiffstats
path: root/lib
Commit message (Collapse)AuthorAgeFilesLines
...
* webrick/httputils: note Kernel#open behaviornormal2017-12-221-0/+2
| | | | | | | | | | | | | | I don't know who uses the load_mime_types method; but it is conceivable that a user would want to read the results of a command instead of reading a regular file to load MIME types. None of the WEBrick-related code in Ruby or default/bundled gems seems to rely on this method; but it is likely 3rd-party code does. * lib/webrick/httputils.rb (load_mime_types): note Kernel#open behavior [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61402 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick/httpservlet/*handler: use File.opennormal2017-12-222-3/+3
| | | | | | | | | | | | | This makes future code audits easier. None of these changes fix realistic remote code execution vulnerabilities because we stat(2) before attempting Kernel#open. * lib/webrick/httpservlet/erbhandler.rb (do_GET): use File.open * lib/webrick/httpservlet/filehandler.rb (do_GET): use File.open (make_partial_content): ditto [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61401 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick: WEBrick::Log requires path arg when given stringnormal2017-12-221-1/+1
| | | | | | | | | | Allowing a user to specify "| command" via Kernel#open is nonsensical since we never read from the resultant IO. * lib/webrick/log.rb (initialize): replace Kernel#open with File.open [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61400 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick/httpservlet/cgi_runner.rb: remove unnecessary opennormal2017-12-221-2/+2
| | | | | | | | | | | | | | IO#reopen already takes string path names as well as IO objects (but not "| command" strings) This makes further auditing for inadvertant code execution easier. There's no actual bugfix or behavior change here, as no external data is passed to cgi_runner.rb. * lib/webrick/httpservlet/cgi_runner.rb: remove Kernel#open call [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61398 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick: httpauth requires regular filesnormal2017-12-223-6/+6
| | | | | | | | | | | | Be sure we do not try to open a pipe to read from, since we care about mtime in all cases. * lib/webrick/httpauth/htdigest.rb: use File.open * lib/webrick/httpauth/htgroup.rb: ditto * lib/webrick/httpauth/htpasswd.rb: ditto [Misc #14216] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61397 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* open-uri defines URI.open defined as an alias.akr2017-12-211-0/+7
| | | | | | | | open-uri's Kernel.open will be deprecated in future. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61392 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Merge release version of bundler-1.16.1 from upstream.hsbt2017-12-213-5/+6
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61388 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* * lib/logger.rb (Logger::LogDevice#open_logfile, #create_logfile):sonots2017-12-211-2/+2
| | | | | | Logger should be able to open only files [Bug #14212] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61378 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* raise error if value contains CR/LF in iniheader of initialize_http_headernaruse2017-12-201-3/+7
| | | | | | like r59693, initialize_http_header also should raise error. [Bug #14208] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61359 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Fixed command Injectionnobu2017-12-201-1/+1
| | | | | | | | * lib/resolv.rb (Resolv::Config.parse_resolv_conf): fixed potential command injection by use of Kernel#open. [ruby-core:84347] [Bug #14205] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61351 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Fixed command Injectionnobu2017-12-201-1/+1
| | | | | | | | | | * resolv.rb (Resolv::Hosts#lazy_initialize): fixed potential command Injection in Hosts::new() by use of Kernel#open. [Fix GH-1777] [ruby-core:84347] [Bug #14205] From: Drigg3r <drigg3r@yandex.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61349 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Break out of the loop after shutdown in DRbServereregon2017-12-191-1/+4
| | | | | | | * Patch by @seki: https://gist.github.com/seki/ae8bef20238c37c94a91b5461c4bfbdd git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61342 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick 1.4.1 releasenormal2017-12-182-3/+3
| | | | | | | | * lib/webrick/version.rb: bump version * lib/webrick/webrick.gemspec: support Ruby 2.3+ [Bug #14189] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61322 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Requiring pp is not required now [ci skip]nobu2017-12-181-4/+0
| | | | | | | | - Followup of https://bugs.ruby-lang.org/issues/14123 From: Prathamesh Sonpatki <csonpatki@gmail.com> git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61310 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/erb: Update doc [ci-skip] [doc]marcandre2017-12-151-2/+2
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61286 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick 1.4.0 releasenormal2017-12-142-6/+5
| | | | | | | | | * lib/webrick/version.rb: change VERSION to 1.4.0 * lib/webrick/webrick.gemspec: require_relative for version, update date and contact info [Feature #13173] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61266 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Fix a command injection vulnerability in Net::FTP.nagachika2017-12-141-5/+5
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61242 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Use string instead of regexpnaruse2017-12-141-1/+1
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61225 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Allow empty path components in a URI [Bug #8352]knu2017-12-141-3/+3
| | | | | | | | | | | * generic.rb (URI::Generic#merge, URI::Generic#route_to): Fix a bug where a sequence of slashes in the path part gets collapsed to a single slash. According to the relevant RFCs and WHATWG URL Standard, empty path components are simply valid and there is no special treatment defined for them, so we just keep them as they are. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61218 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Bump version to csv-1.0.0 as default gems.hsbt2017-12-131-3/+3
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61200 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick: compile RE correctly for beginning and end matchnormal2017-12-131-2/+2
| | | | | | | | | | | | | | | | Using ^ and $ in regexps means we can accidentally get fooled by "%0a" in HTTP request paths being decoded to newline characters. Use \A and \z to match beginning and end-of-string respectively, instead. Thanks to mame and hsbt for reporting. * lib/webrick/httpserver.rb (MountTable#compile): use \A and \z instead of ^ and $ * lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $ * test/webrick/test_httpserver.rb (test_cntrl_in_path): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61197 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Avoid creating a Thread for shutting down a DRbServereregon2017-12-121-9/+14
| | | | | | | | | | * lib/drb/drb.rb: avoid creating a Thread and call the shutdown logic directly. Do not try to kill or join the current Thread. Thread.new { stop_service } caused "can't alloc thread (ThreadError)", which is shown with Thread.report_on_exception = true. [Bug #14171] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61184 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Remove unnecessary `:`kazu2017-12-121-1/+1
| | | | | | | | | | | | | | Before: `.../irb/init.rb:280: warning: :LoadError: cannot load such file -- hoge` After: `.../irb/init.rb:280: warning: LoadError: cannot load such file -- hoge` [ci skip] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61175 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Use printf instead of puts and sprintfkazu2017-12-121-1/+1
| | | | | | [ci skip] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61174 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Add uplevel keyword to Kernel#warn and use itshyouhei2017-12-1230-60/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If uplevel keyword is given, the warning message is prepended with caller file and line information and the string "warning: ". The use of the uplevel keyword makes Kernel#warn format output similar to how rb_warn formats output. This patch modifies net/ftp and net/imap to use Kernel#warn instead of $stderr.puts or $stderr.printf, since they are used for printing warnings. This makes lib/cgi/core and tempfile use $stderr.puts instead of warn for debug logging, since they are used for debug printing and not for warning. This does not modify bundler, rubygems, or rdoc, as those are maintained outside of ruby and probably wish to remain backwards compatible with older ruby versions. rb_warn_m code is originally from nobu, but I've changed it so that it only includes the path and lineno from uplevel (not the method), and also prepends the string "warning: ", to make it more similar to rb_warn. From: Jeremy Evans code@jeremyevans.net Signed-off-by: Urabe Shyouhei shyouhei@ruby-lang.org git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61155 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* irb/init.rb: make sure ARGV refers to toplevel onek0kubun2017-12-121-2/+2
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61151 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* irb.rb: preserve ARGV on binding.irbk0kubun2017-12-122-16/+16
| | | | | | | | | | | | | | | This is not perfectly good solution (at least we don't want to have ARGV as default value of `argv` argument), but unfortunately IRB.setup and IRB.parse_opts are public methods and we can't make breaking change to those methods. We may deprecate using them and then make them private in the future, but the removal should not be in Ruby 2.5. So I kept their interface for now. [Bug #14162] [close GH-1770] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61149 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Bump version to fileutils-1.0.1.hsbt2017-12-121-1/+7
| | | | | | | Update source code url metadata on rubygems.org. [Feature #13197][ruby-core:79455] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61148 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Bump version to fileutils-1.0.0 as default gems.hsbt2017-12-121-3/+3
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61146 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Ignore gemspec under the lib directory for documentation.hsbt2017-12-122-0/+30
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61139 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Merge 1-16-stable branch of bundler.hsbt2017-12-128-17/+29
| | | | | | | It's rc version for bundler-1.16.1. I'm going to update it version after official release from bundler team. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61134 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Bump version to scanf-1.0.0 as default gems.hsbt2017-12-111-3/+3
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61114 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/pp.rb: remove alias for suppressing a redefinition warning.mame2017-12-111-4/+0
| | | | | | Because there is now the same guard in prelude.rb (alias pp pp). git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61111 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Bump version to cmath-1.0.0 as default gems.hsbt2017-12-111-3/+3
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61109 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* bccwin is no longer supportedusa2017-12-111-1/+0
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61108 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* depend on win32.h on Windowsusa2017-12-111-1/+4
| | | | | | | * lib/mkmf.rb (depend_rules): all objs should depend on win32.h on Windows. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61107 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Ignore to generate documentation for template files of bundler.hsbt2017-12-111-0/+1
| | | | | | [Bug #14163][ruby-core:84141] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61104 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* webrick: allow shutdown after StartCallbacknormal2017-12-081-1/+1
| | | | | | | | | | | | | | | | | | We must to ensure the @status ivar is set to :Running before running StartCallback, otherwise Webrick::Server#stop will not change the @status to :Shutdown properly. Note: I have not been able to reproduce the original issue but understood at least part of the problem and fixed it with this commit. However, the original reporter (Peak Xu) was still able to reproduce the problem on 1.9.2 p180 on Windows, so I'm not sure what else might be going on. Ruby threading and synchronization primitives have changed a lot since 1.9.2, so maybe that was fixed elsewhere. * lib/webrick/server.rb: call StartCallback sooner [Bug #4841] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61083 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/pp.rb: no rdoc of alias to suppress a warningnobu2017-12-081-0/+2
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61082 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* pp.rb: rdocnobu2017-12-081-1/+1
| | | | | | | * lib/pp.rb (pp): move pp alias before its rdoc, not to prevent parsing. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61080 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Bump version to rdoc-6.0.0.hsbt2017-12-052-2/+2
| | | | | | There is no changes from rdoc-6.0.0.bebta4. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61029 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Append "//" if empty host for file or postgres URInaruse2017-12-011-1/+1
| | | | | | | | | https://url.spec.whatwg.org/#url-serializing > Otherwise, if url’s host is null and url’s scheme is "file", append "//" to output. URL spec doesn't says anything about postgres, but assume the same thing. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60970 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Replace Kernel#pp after PP class is defined.akr2017-12-011-26/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid a race condition which a context switch occur after replacing Kernel#pp but before defining PP class. Following patch, inserting sleep, makes this problem reproducible. ``` Index: lib/pp.rb =================================================================== --- lib/pp.rb (revision 60960) +++ lib/pp.rb (working copy) @@ -26,6 +26,7 @@ module Kernel end undef __pp_backup__ if method_defined?(:__pp_backup__) module_function :pp + sleep 1 # thread context switch end ## ``` With the above patch, "uninitialized constant Kernel::PP" can happen as as follows. ``` % ./ruby -w -Ilib -e ' t1 = Thread.new { Thread.current.report_on_exception = true pp :foo1 } t2 = Thread.new { Thread.current.report_on_exception = true sleep 0.5 pp :foo2 } t1.join rescue nil t2.join rescue nil ' #<Thread:0x000055dbf926eaa0@-e:6 run> terminated with exception: Traceback (most recent call last): 3: from -e:9:in `block in <main>' 2: from /home/ruby/tst2/ruby/lib/pp.rb:22:in `pp' 1: from /home/ruby/tst2/ruby/lib/pp.rb:22:in `each' /home/ruby/tst2/ruby/lib/pp.rb:23:in `block in pp': uninitialized constant Kernel::PP (NameError) :foo1 ``` git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60961 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* prelude.rb: suppress redefinition warningsnobu2017-12-011-1/+0
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60952 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/pp.rb (Kernel#pp): Fix a race conditionmame2017-12-011-1/+2
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60948 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* prelude.rb: Add Kernel#pp, a trigger for lib/pp.rbmame2017-11-301-0/+1
| | | | | | [Feature #14123] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60944 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Merge rubygems-2.7.3.hsbt2017-11-284-18/+67
| | | | | | http://blog.rubygems.org/2017/11/28/2.7.3-released.html git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60927 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* * remove trailing spaces.svn2017-11-272-108/+108
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60921 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Merge rdoc-6.0.0.beta4 from upstream.hsbt2017-11-27115-1019/+1254
| | | | | | It version applied `frozen_string_literal: true` git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60920 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* Fix TOCTTOU and avoid to read existing unreadable filekazu2017-11-241-2/+5
| | | | git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@60900 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-09 06:25:34 +0000