From 08f8cfe14e0f8937e3bcf8a22becdc5ce60b920e Mon Sep 17 00:00:00 2001
From: hsbt <hsbt@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Tue, 5 Mar 2019 03:32:58 +0000
Subject: Merge RubyGems upstream: 56c0bbb69e4506bda7ef7f447dfec5db820df20b

  It fixed the multiple vulnerabilities.
  https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@67168 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 lib/rubygems/command_manager.rb             | 16 ++++++--
 lib/rubygems/commands/install_command.rb    | 62 +++++------------------------
 lib/rubygems/commands/owner_command.rb      | 13 +++---
 lib/rubygems/commands/push_command.rb       |  8 +---
 lib/rubygems/commands/update_command.rb     | 24 ++++++-----
 lib/rubygems/commands/yank_command.rb       |  9 ++++-
 lib/rubygems/dependency_list.rb             |  2 +-
 lib/rubygems/gemcutter_utilities.rb         | 43 +++++++++++---------
 lib/rubygems/installer.rb                   | 31 ++++++++++++---
 lib/rubygems/installer_test_case.rb         |  4 +-
 lib/rubygems/package.rb                     | 10 +++++
 lib/rubygems/requirement.rb                 | 12 +-----
 lib/rubygems/resolver/activation_request.rb | 15 ++++++-
 lib/rubygems/test_case.rb                   |  6 +++
 lib/rubygems/test_utilities.rb              | 15 +++++--
 lib/rubygems/user_interaction.rb            |  5 ++-
 16 files changed, 147 insertions(+), 128 deletions(-)

(limited to 'lib')

diff --git a/lib/rubygems/command_manager.rb b/lib/rubygems/command_manager.rb
index 8e4e26fdea..8ab0d98ed4 100644
--- a/lib/rubygems/command_manager.rb
+++ b/lib/rubygems/command_manager.rb
@@ -7,6 +7,7 @@
 
 require 'rubygems/command'
 require 'rubygems/user_interaction'
+require 'rubygems/text'
 
 ##
 # The command manager registers and installs all the individual sub-commands
@@ -32,6 +33,7 @@ require 'rubygems/user_interaction'
 
 class Gem::CommandManager
 
+  include Gem::Text
   include Gem::UserInteraction
 
   BUILTIN_COMMANDS = [ # :nodoc:
@@ -145,12 +147,12 @@ class Gem::CommandManager
   def run(args, build_args=nil)
     process_args(args, build_args)
   rescue StandardError, Timeout::Error => ex
-    alert_error "While executing gem ... (#{ex.class})\n    #{ex}"
+    alert_error clean_text("While executing gem ... (#{ex.class})\n    #{ex}")
     ui.backtrace ex
 
     terminate_interaction(1)
   rescue Interrupt
-    alert_error "Interrupted"
+    alert_error clean_text("Interrupted")
     terminate_interaction(1)
   end
 
@@ -167,8 +169,14 @@ class Gem::CommandManager
     when '-v', '--version' then
       say Gem::VERSION
       terminate_interaction 0
+    when '--no-ri', '--no-rdoc' then
+      # This was added to compensate for a deprecation warning not being shown
+      # in Rubygems 2.x.x.
+      # TODO: Remove when Rubygems 3.1 is released.
+      alert_error "Invalid option: #{args.first}. Use --no-document instead."
+      terminate_interaction 1
     when /^-/ then
-      alert_error "Invalid option: #{args.first}. See 'gem --help'."
+      alert_error clean_text("Invalid option: #{args.first}. See 'gem --help'.")
       terminate_interaction 1
     else
       cmd_name = args.shift.downcase
@@ -224,7 +232,7 @@ class Gem::CommandManager
     rescue Exception => e
       e = load_error if load_error
 
-      alert_error "Loading command: #{command_name} (#{e.class})\n\t#{e}"
+      alert_error clean_text("Loading command: #{command_name} (#{e.class})\n\t#{e}")
       ui.backtrace e
     end
   end
diff --git a/lib/rubygems/commands/install_command.rb b/lib/rubygems/commands/install_command.rb
index 82631b1ffd..0085d68cf3 100644
--- a/lib/rubygems/commands/install_command.rb
+++ b/lib/rubygems/commands/install_command.rb
@@ -194,65 +194,21 @@ You can use `i` command instead of `install`.
 
     req = Gem::Requirement.create(version)
 
-    if options[:ignore_dependencies]
-      install_gem_without_dependencies name, req
-    else
-      inst = Gem::DependencyInstaller.new options
-      request_set = inst.resolve_dependencies name, req
-
-      if options[:explain]
-        say "Gems to install:"
-
-        request_set.sorted_requests.each do |s|
-          # shows platform specific gems if used
-          say (plat = s.spec.platform) == Gem::Platform::RUBY ?
-            "  #{s.full_name}" :
-            "  #{s.full_name}-#{plat}"
-        end
-
-        return
-      else
-        @installed_specs.concat request_set.install options
-      end
+    dinst = Gem::DependencyInstaller.new options
 
-      show_install_errors inst.errors
-    end
-  end
+    request_set = dinst.resolve_dependencies name, req
 
-  def install_gem_without_dependencies(name, req) # :nodoc:
-    gem = nil
+    if options[:explain]
+      say "Gems to install:"
 
-    if local?
-      if name =~ /\.gem$/ and File.file? name
-        source = Gem::Source::SpecificFile.new name
-        spec = source.spec
-      else
-        source = Gem::Source::Local.new
-        spec = source.find_gem name, req
+      request_set.sorted_requests.each do |activation_request|
+        say "  #{activation_request.full_name}"
       end
-      gem = source.download spec if spec
-    end
-
-    if remote? and not gem
-      dependency = Gem::Dependency.new name, req
-      dependency.prerelease = options[:prerelease]
-
-      fetcher = Gem::RemoteFetcher.fetcher
-      gem = fetcher.download_to_cache dependency
+    else
+      @installed_specs.concat request_set.install options
     end
 
-    inst = Gem::Installer.at gem, options
-    inst.install
-
-    require 'rubygems/dependency_installer'
-    dinst = Gem::DependencyInstaller.new options
-    dinst.installed_gems.replace [inst.spec]
-
-    Gem.done_installing_hooks.each do |hook|
-      hook.call dinst, [inst.spec]
-    end unless Gem.done_installing_hooks.empty?
-
-    @installed_specs.push(inst.spec)
+    show_install_errors dinst.errors
   end
 
   def install_gems # :nodoc:
diff --git a/lib/rubygems/commands/owner_command.rb b/lib/rubygems/commands/owner_command.rb
index 9fcabaa9f8..f8e68c48e7 100644
--- a/lib/rubygems/commands/owner_command.rb
+++ b/lib/rubygems/commands/owner_command.rb
@@ -2,9 +2,11 @@
 require 'rubygems/command'
 require 'rubygems/local_remote_options'
 require 'rubygems/gemcutter_utilities'
+require 'rubygems/text'
 
 class Gem::Commands::OwnerCommand < Gem::Command
 
+  include Gem::Text
   include Gem::LocalRemoteOptions
   include Gem::GemcutterUtilities
 
@@ -68,7 +70,7 @@ permission to.
     end
 
     with_response response do |resp|
-      owners = Gem::SafeYAML.load resp.body
+      owners = Gem::SafeYAML.load clean_text(resp.body)
 
       say "Owners for gem: #{name}"
       owners.each do |owner|
@@ -89,11 +91,6 @@ permission to.
     owners.each do |owner|
       begin
         response = send_owner_request(method, name, owner)
-
-        if need_otp? response
-          response = send_owner_request(method, name, owner, true)
-        end
-
         action = method == :delete ? "Removing" : "Adding"
 
         with_response response, "#{action} #{owner}"
@@ -105,11 +102,11 @@ permission to.
 
   private
 
-  def send_owner_request(method, name, owner, use_otp = false)
+  def send_owner_request(method, name, owner)
     rubygems_api_request method, "api/v1/gems/#{name}/owners" do |request|
       request.set_form_data 'email' => owner
       request.add_field "Authorization", api_key
-      request.add_field "OTP", options[:otp] if use_otp
+      request.add_field "OTP", options[:otp] if options[:otp]
     end
   end
 
diff --git a/lib/rubygems/commands/push_command.rb b/lib/rubygems/commands/push_command.rb
index 7fd1119ff9..41e6c7ec30 100644
--- a/lib/rubygems/commands/push_command.rb
+++ b/lib/rubygems/commands/push_command.rb
@@ -119,22 +119,18 @@ You can upgrade or downgrade to the latest release version with:
 
     response = send_push_request(name, args)
 
-    if need_otp? response
-      response = send_push_request(name, args, true)
-    end
-
     with_response response
   end
 
   private
 
-  def send_push_request(name, args, use_otp = false)
+  def send_push_request(name, args)
     rubygems_api_request(*args) do |request|
       request.body = Gem.read_binary name
       request.add_field "Content-Length", request.body.size
       request.add_field "Content-Type",   "application/octet-stream"
       request.add_field "Authorization",  api_key
-      request.add_field "OTP", options[:otp] if use_otp
+      request.add_field "OTP", options[:otp] if options[:otp]
     end
   end
 
diff --git a/lib/rubygems/commands/update_command.rb b/lib/rubygems/commands/update_command.rb
index c44dcf0bd8..4b182396f3 100644
--- a/lib/rubygems/commands/update_command.rb
+++ b/lib/rubygems/commands/update_command.rb
@@ -97,8 +97,8 @@ command to remove old versions.
     if options[:explain]
       say "Gems to update:"
 
-      gems_to_update.each do |(name, version)|
-        say "  #{name}-#{version}"
+      gems_to_update.each do |name_tuple|
+        say "  #{name_tuple.full_name}"
       end
 
       return
@@ -146,18 +146,18 @@ command to remove old versions.
     hig
   end
 
-  def highest_remote_version(spec) # :nodoc:
+  def highest_remote_name_tuple(spec) # :nodoc:
     spec_tuples = fetch_remote_gems spec
 
     matching_gems = spec_tuples.select do |g,_|
       g.name == spec.name and g.match_platform?
     end
 
-    highest_remote_gem = matching_gems.max_by { |g,_| g.version }
+    highest_remote_gem = matching_gems.max
 
     highest_remote_gem ||= [Gem::NameTuple.null]
 
-    highest_remote_gem.first.version
+    highest_remote_gem.first
   end
 
   def install_rubygems(version) # :nodoc:
@@ -194,7 +194,7 @@ command to remove old versions.
     }
 
     gems_to_update = which_to_update hig, options[:args], :system
-    _, up_ver = gems_to_update.first
+    up_ver = gems_to_update.first.version
 
     target = if update_latest
                up_ver
@@ -226,8 +226,8 @@ command to remove old versions.
   end
 
   def update_gems(gems_to_update)
-    gems_to_update.uniq.sort.each do |(name, version)|
-      update_gem name, version
+    gems_to_update.uniq.sort.each do |name_tuple|
+      update_gem name_tuple.name, name_tuple.version
     end
 
     @updated
@@ -271,10 +271,12 @@ command to remove old versions.
       next if not gem_names.empty? and
               gem_names.none? { |name| name == l_spec.name }
 
-      highest_remote_ver = highest_remote_version l_spec
+      highest_remote_tup = highest_remote_name_tuple l_spec
+      highest_remote_ver = highest_remote_tup.version
+      highest_installed_ver = l_spec.version
 
-      if system or (l_spec.version < highest_remote_ver)
-        result << [l_spec.name, [l_spec.version, highest_remote_ver].max]
+      if system or (highest_installed_ver < highest_remote_ver)
+        result << Gem::NameTuple.new(l_spec.name, [highest_installed_ver, highest_remote_ver].max, highest_remote_tup.platform)
       end
     end
 
diff --git a/lib/rubygems/commands/yank_command.rb b/lib/rubygems/commands/yank_command.rb
index be675fa460..3ca05756f6 100644
--- a/lib/rubygems/commands/yank_command.rb
+++ b/lib/rubygems/commands/yank_command.rb
@@ -33,6 +33,7 @@ data you will need to change them immediately and yank your gem.
 
     add_version_option("remove")
     add_platform_option("remove")
+    add_otp_option
 
     add_option('--host HOST',
                'Yank from another gemcutter-compatible host',
@@ -62,7 +63,10 @@ data you will need to change them immediately and yank your gem.
 
   def yank_gem(version, platform)
     say "Yanking gem from #{self.host}..."
-    yank_api_request(:delete, version, platform, "api/v1/gems/yank")
+    args = [:delete, version, platform, "api/v1/gems/yank"]
+    response = yank_api_request(*args)
+
+    say response.body
   end
 
   private
@@ -71,6 +75,7 @@ data you will need to change them immediately and yank your gem.
     name = get_one_gem_name
     response = rubygems_api_request(method, api, host) do |request|
       request.add_field("Authorization", api_key)
+      request.add_field("OTP", options[:otp]) if options[:otp]
 
       data = {
         'gem_name' => name,
@@ -80,7 +85,7 @@ data you will need to change them immediately and yank your gem.
 
       request.set_form_data data
     end
-    say response.body
+    response
   end
 
   def get_version_from_requirements(requirements)
diff --git a/lib/rubygems/dependency_list.rb b/lib/rubygems/dependency_list.rb
index eec2223077..db7a2f5ada 100644
--- a/lib/rubygems/dependency_list.rb
+++ b/lib/rubygems/dependency_list.rb
@@ -135,7 +135,7 @@ class Gem::DependencyList
   end
 
   ##
-  # Is is ok to remove a gemspec from the dependency list?
+  # It is ok to remove a gemspec from the dependency list?
   #
   # If removing the gemspec creates breaks a currently ok dependency, then it
   # is NOT ok to remove the gemspec.
diff --git a/lib/rubygems/gemcutter_utilities.rb b/lib/rubygems/gemcutter_utilities.rb
index 877205b619..a125664ce5 100644
--- a/lib/rubygems/gemcutter_utilities.rb
+++ b/lib/rubygems/gemcutter_utilities.rb
@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 require 'rubygems/remote_fetcher'
+require 'rubygems/text'
 
 ##
 # Utility methods for using the RubyGems API.
 
 module Gem::GemcutterUtilities
 
+  include Gem::Text
+
   # TODO: move to Gem::Command
   OptionParser.accept Symbol do |value|
     value.to_sym
@@ -94,8 +97,22 @@ module Gem::GemcutterUtilities
     uri = URI.parse "#{self.host}/#{path}"
 
     request_method = Net::HTTP.const_get method.to_s.capitalize
+    response = Gem::RemoteFetcher.fetcher.request(uri, request_method, &block)
+    return response unless mfa_unauthorized?(response)
+
+    Gem::RemoteFetcher.fetcher.request(uri, request_method) do |req|
+      req.add_field "OTP", get_otp
+      block.call(req)
+    end
+  end
 
-    Gem::RemoteFetcher.fetcher.request(uri, request_method, &block)
+  def mfa_unauthorized?(response)
+    response.kind_of?(Net::HTTPUnauthorized) && response.body.start_with?('You have enabled multifactor authentication')
+  end
+
+  def get_otp
+    say 'You have enabled multi-factor authentication. Please enter OTP code.'
+    ask 'Code: '
   end
 
   ##
@@ -123,13 +140,7 @@ module Gem::GemcutterUtilities
     response = rubygems_api_request(:get, "api/v1/api_key",
                                     sign_in_host) do |request|
       request.basic_auth email, password
-    end
-
-    if need_otp? response
-      response = rubygems_api_request(:get, "api/v1/api_key", sign_in_host) do |request|
-        request.basic_auth email, password
-        request.add_field "OTP", options[:otp]
-      end
+      request.add_field "OTP", options[:otp] if options[:otp]
     end
 
     with_response response do |resp|
@@ -164,30 +175,24 @@ module Gem::GemcutterUtilities
       if block_given?
         yield response
       else
-        say response.body
+        say clean_text(response.body)
       end
     else
       message = response.body
       message = "#{error_prefix}: #{message}" if error_prefix
 
-      say message
+      say clean_text(message)
       terminate_interaction 1 # TODO: question this
     end
   end
 
   ##
   # Returns true when the user has enabled multifactor authentication from
-  # +response+ text.
+  # +response+ text and no otp provided by options.
+
+
 
-  def need_otp?(response)
-    return unless response.kind_of?(Net::HTTPUnauthorized) &&
-        response.body.start_with?('You have enabled multifactor authentication')
-    return true if options[:otp]
 
-    say 'You have enabled multi-factor authentication. Please enter OTP code.'
-    options[:otp] = ask 'Code: '
-    true
-  end
 
   def set_api_key(host, key)
     if host == Gem::DEFAULT_HOST
diff --git a/lib/rubygems/installer.rb b/lib/rubygems/installer.rb
index b64ba17be6..1415a14f22 100644
--- a/lib/rubygems/installer.rb
+++ b/lib/rubygems/installer.rb
@@ -729,9 +729,26 @@ class Gem::Installer
       unpack or File.writable?(gem_home)
   end
 
-  def verify_spec_name
-    return if spec.name =~ Gem::Specification::VALID_NAME_PATTERN
-    raise Gem::InstallError, "#{spec} has an invalid name"
+  def verify_spec
+    unless spec.name =~ Gem::Specification::VALID_NAME_PATTERN
+      raise Gem::InstallError, "#{spec} has an invalid name"
+    end
+
+    if spec.raw_require_paths.any?{|path| path =~ /\R/ }
+      raise Gem::InstallError, "#{spec} has an invalid require_paths"
+    end
+
+    if spec.extensions.any?{|ext| ext =~ /\R/ }
+      raise Gem::InstallError, "#{spec} has an invalid extensions"
+    end
+
+    unless spec.specification_version.to_s =~ /\A\d+\z/
+      raise Gem::InstallError, "#{spec} has an invalid specification_version"
+    end
+
+    if spec.dependencies.any? {|dep| dep.type =~ /\R/ || dep.name =~ /\R/ }
+      raise Gem::InstallError, "#{spec} has an invalid dependencies"
+    end
   end
 
   ##
@@ -844,7 +861,7 @@ TEXT
   # without the full gem installed.
 
   def extract_bin
-    @package.extract_files gem_dir, "bin/*"
+    @package.extract_files gem_dir, "#{spec.bindir}/*"
   end
 
   ##
@@ -880,9 +897,11 @@ TEXT
   def pre_install_checks
     verify_gem_home options[:unpack]
 
-    ensure_loadable_spec
+    # The name and require_paths must be verified first, since it could contain
+    # ruby code that would be eval'ed in #ensure_loadable_spec
+    verify_spec
 
-    verify_spec_name
+    ensure_loadable_spec
 
     if options[:install_as_default]
       Gem.ensure_default_gem_subdirectories gem_home
diff --git a/lib/rubygems/installer_test_case.rb b/lib/rubygems/installer_test_case.rb
index 6fdc2d6337..1c16959f5f 100644
--- a/lib/rubygems/installer_test_case.rb
+++ b/lib/rubygems/installer_test_case.rb
@@ -120,9 +120,9 @@ class Gem::InstallerTestCase < Gem::TestCase
   # The executable is also written to the bin dir in @tmpdir and the installed
   # gem directory for +spec+.
 
-  def util_make_exec(spec = @spec, shebang = "#!/usr/bin/ruby")
+  def util_make_exec(spec = @spec, shebang = "#!/usr/bin/ruby", bindir = "bin")
     spec.executables = %w[executable]
-    spec.files << 'bin/executable'
+    spec.bindir = bindir
 
     exec_path = spec.bin_file "executable"
     write_file exec_path do |io|
diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
index 278ada8514..16cf0c173a 100644
--- a/lib/rubygems/package.rb
+++ b/lib/rubygems/package.rb
@@ -459,6 +459,16 @@ EOM
     raise Gem::Package::PathError.new(destination, destination_dir) unless
       destination.start_with? destination_dir + '/'
 
+    begin
+      real_destination = File.expand_path(File.realpath(destination))
+    rescue
+      # it's fine if the destination doesn't exist, because rm -rf'ing it can't cause any damage
+      nil
+    else
+      raise Gem::Package::PathError.new(real_destination, destination_dir) unless
+        real_destination.start_with? destination_dir + '/'
+    end
+
     destination.untaint
     destination
   end
diff --git a/lib/rubygems/requirement.rb b/lib/rubygems/requirement.rb
index 918404f2cd..34ae4b808d 100644
--- a/lib/rubygems/requirement.rb
+++ b/lib/rubygems/requirement.rb
@@ -130,7 +130,6 @@ class Gem::Requirement
       @requirements = [DefaultRequirement]
     else
       @requirements = requirements.map! { |r| self.class.parse r }
-      sort_requirements!
     end
   end
 
@@ -144,7 +143,6 @@ class Gem::Requirement
     new = new.map { |r| self.class.parse r }
 
     @requirements.concat new
-    sort_requirements!
   end
 
   ##
@@ -186,7 +184,7 @@ class Gem::Requirement
   end
 
   def hash # :nodoc:
-    requirements.hash
+    requirements.sort.hash
   end
 
   def marshal_dump # :nodoc:
@@ -295,14 +293,6 @@ class Gem::Requirement
     end
   end
 
-  def sort_requirements! # :nodoc:
-    @requirements.sort! do |l, r|
-      comp = l.last <=> r.last # first, sort by the requirement's version
-      next comp unless comp == 0
-      l.first <=> r.first # then, sort by the operator (for stability)
-    end
-  end
-
 end
 
 class Gem::Version
diff --git a/lib/rubygems/resolver/activation_request.rb b/lib/rubygems/resolver/activation_request.rb
index 78e8a46674..7fbabbff50 100644
--- a/lib/rubygems/resolver/activation_request.rb
+++ b/lib/rubygems/resolver/activation_request.rb
@@ -77,7 +77,7 @@ class Gem::Resolver::ActivationRequest
   # The full name of the specification to be activated.
 
   def full_name
-    @spec.full_name
+    name_tuple.full_name
   end
 
   alias_method :to_s, :full_name
@@ -183,4 +183,17 @@ class Gem::Resolver::ActivationRequest
     @spec.version
   end
 
+  ##
+  # The platform of this activation request's specification
+
+  def platform
+    @spec.platform
+  end
+
+  private
+
+  def name_tuple
+    @name_tuple ||= Gem::NameTuple.new(name, version, platform)
+  end
+
 end
diff --git a/lib/rubygems/test_case.rb b/lib/rubygems/test_case.rb
index 5f2bbd7b86..958d157465 100644
--- a/lib/rubygems/test_case.rb
+++ b/lib/rubygems/test_case.rb
@@ -134,6 +134,12 @@ class Gem::TestCase < (defined?(Minitest::Test) ? Minitest::Test : MiniTest::Uni
     assert File.exist?(path), msg
   end
 
+  def assert_directory_exists(path, msg = nil)
+    msg = message(msg) { "Expected path '#{path}' to be a directory" }
+    assert_path_exists path
+    assert File.directory?(path), msg
+  end
+
   ##
   # Sets the ENABLE_SHARED entry in RbConfig::CONFIG to +value+ and restores
   # the original value when the block ends
diff --git a/lib/rubygems/test_utilities.rb b/lib/rubygems/test_utilities.rb
index 069ecccabe..5d02b04897 100644
--- a/lib/rubygems/test_utilities.rb
+++ b/lib/rubygems/test_utilities.rb
@@ -13,6 +13,13 @@ require 'rubygems/remote_fetcher'
 #   @fetcher.data['http://gems.example.com/yaml'] = source_index.to_yaml
 #   Gem::RemoteFetcher.fetcher = @fetcher
 #
+#   use nested array if multiple response is needed
+#
+#   @fetcher.data['http://gems.example.com/sequence'] = [['Success', 200, 'OK'], ['Failed', 401, 'Unauthorized']]
+#
+#   @fetcher.fetch_path('http://gems.example.com/sequence') # => ['Success', 200, 'OK']
+#   @fetcher.fetch_path('http://gems.example.com/sequence') # => ['Failed', 401, 'Unauthorized']
+#
 #   # invoke RubyGems code
 #
 #   paths = @fetcher.paths
@@ -32,7 +39,7 @@ class Gem::FakeFetcher
     @paths = []
   end
 
-  def find_data(path)
+  def find_data(path, nargs = 3)
     return File.read path.path if URI === path and 'file' == path.scheme
 
     if URI === path and "URI::#{path.scheme.upcase}" != path.class.name
@@ -48,7 +55,10 @@ class Gem::FakeFetcher
       raise Gem::RemoteFetcher::FetchError.new("no data for #{path}", path)
     end
 
-    @data[path]
+    data = @data[path]
+
+    data.flatten! and return data.shift(nargs) if data.respond_to?(:flatten!)
+    data
   end
 
   def fetch_path(path, mtime = nil, head = false)
@@ -60,7 +70,6 @@ class Gem::FakeFetcher
       if path.to_s =~ /gz$/ and not data.nil? and not data.empty?
         data = Gem::Util.gunzip data
       end
-
       data
     end
   end
diff --git a/lib/rubygems/user_interaction.rb b/lib/rubygems/user_interaction.rb
index ecd1454e2d..a0f74f1079 100644
--- a/lib/rubygems/user_interaction.rb
+++ b/lib/rubygems/user_interaction.rb
@@ -7,6 +7,7 @@
 
 require 'rubygems/util'
 require 'rubygems/deprecate'
+require 'rubygems/text'
 
 ##
 # Module that defines the default UserInteraction.  Any class including this
@@ -14,6 +15,8 @@ require 'rubygems/deprecate'
 
 module Gem::DefaultUserInteraction
 
+  include Gem::Text
+
   ##
   # The default UI is a class variable of the singleton class for this
   # module.
@@ -162,7 +165,7 @@ module Gem::UserInteraction
   # is true.
 
   def verbose(msg = nil)
-    say(msg || yield) if Gem.configuration.really_verbose
+    say(clean_text(msg || yield)) if Gem.configuration.really_verbose
   end
 end
 
-- 
cgit v1.2.3