Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add a limit to the size of the metadata and checksums files in a gem package. #7568

Merged
merged 2 commits into from Apr 30, 2024
Merged

Add a limit to the size of the metadata and checksums files in a gem package. #7568

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a596e3c
Add a limit to the size of the metadata and checksums files in a gem …
segiddins Apr 11, 2024
c4e75b9
Update lib/rubygems/package.rb
segiddins Apr 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
17 changes: 12 additions & 5 deletions lib/rubygems/package.rb
View file
Open in desktop
Expand Up @@ -528,12 +528,13 @@ def normalize_path(pathname)
# Loads a Gem::Specification from the TarEntry +entry+

def load_spec(entry) # :nodoc:
limit = 10 * 1024 * 1024
case entry.full_name
when "metadata" then
@spec = Gem::Specification.from_yaml entry.read
@spec = Gem::Specification.from_yaml limit_read(entry, "metadata", limit)
when "metadata.gz" then
Zlib::GzipReader.wrap(entry, external_encoding: Encoding::UTF_8) do |gzio|
@spec = Gem::Specification.from_yaml gzio.read
@spec = Gem::Specification.from_yaml limit_read(gzio, "metadata.gz", limit)
end
end
end
Expand All @@ -557,7 +558,7 @@ def read_checksums(gem)

@checksums = gem.seek "checksums.yaml.gz" do |entry|
Zlib::GzipReader.wrap entry do |gz_io|
Gem::SafeYAML.safe_load gz_io.read
Gem::SafeYAML.safe_load limit_read(gz_io, "checksums.yaml.gz", 10 * 1024 * 1024)
end
end
end
Expand Down Expand Up @@ -664,7 +665,7 @@ def verify_entry(entry)

case file_name
when /\.sig$/ then
@signatures[$`] = entry.read if @security_policy
@signatures[$`] = limit_read(entry, file_name, 1024 * 1024) if @security_policy
return
else
digest entry
Expand Down Expand Up @@ -715,7 +716,7 @@ def verify_gz(entry) # :nodoc:
raise Gem::Package::FormatError.new(e.message, entry.full_name)
end

if RUBY_ENGINE == "truffleruby"
if RUBY_ENGINE == "truffleruby" && RUBY_ENGINE_VERSION < "23.1.2"
segiddins marked this conversation as resolved.
Show resolved Hide resolved
def copy_stream(src, dst) # :nodoc:
dst.write src.read
end
Expand All @@ -724,6 +725,12 @@ def copy_stream(src, dst) # :nodoc:
IO.copy_stream(src, dst)
end
end

def limit_read(io, name, limit)
bytes = io.read(limit + 1)
raise Gem::Package::FormatError, "#{name} is too big (over #{limit} bytes)" if bytes.size > limit
bytes
end
end

require_relative "package/digest_io"
Expand Down