* test/net/http/test_https.rb: Stop the error due to openssl 1.1.1h
On some environments that uses OpenSSL 1.1.1h, the two tests now fail.
http://rubyci.s3.amazonaws.com/android29-x86_64/ruby-master/log/20200924T062352Z.fail.html.gzhttps://github.com/ruby/ruby/runs/1159288773?check_suite_focus=true
```
1) Failure:
TestNetHTTPS#test_get [/data/data/com.termux/files/home/cb/tmp/build/202 00924T062352Z/ruby/test/net/http/test_https.rb:47]:
<"0\x82\x03\xED0\x82\x02\xD5\xA0\x03..."> expected but was
<"0\x82\x03\xE30\x82\x02\xCB\xA0\x03...">.
```
Not sure why, but verify_callback now seems to receive only SERVER_CERT
but not CA_CERT.
It would be good to investigate the issue furthermore, but tentatively,
I want to stop the failures.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67887 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ruby/psych] Fixing compatibility with libyaml 0.2.5
The main issue is that commas aren't allowed in local tags. libyaml
was updated to follow the spec, and our tests were out of date.
See: https://github.com/yaml/libyaml/issues/196https://github.com/ruby/psych/commit/3f5e520fd3
Note that this is not security fix, but need for release processs.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67885 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Make RbConfig::CONFIG values mutable [Bug #16738]
As `RbConfig.expand` modifies the argument and involved `CONFIG`
values, its values should be mutable.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67872 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fixed duplicated warning
As `command_rhs` is always a "value expression", `command_asgn`
does not need the same check.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67868 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Do not turn on keyword_init for Struct subclass if keyword hash is
empty
This was accidentally turned on because there was no checking for
Qundef.
Also, since only a single keyword is currently supported, simplify
the rb_get_kwargs call.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67866 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
`Regexp` in `MatchData` can be `nil`
`String#sub` with a string pattern defers creating a `Regexp`
until `MatchData#regexp` creates a `Regexp` from the matched
string. `Regexp#last_match(group_name)` accessed its content
without creating the `Regexp` though. [Bug #16508]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67865 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
time.c (find_time_t): fix round-to-zero bug
`find_time_t` did not work correctly for year older than the Epoch
because it used C's integer division (which rounds negative to zero).
For example, `TIme.new(1933)` returned a wrong time whose year is 1922
in Asia/Kuala_Lumpur because there is no 00:00:00 1st Jan. 1933 in the
time zone.
```
$ TZ=Asia/Kuala_Lumpur ruby -e 'p Time.new(1933)'
1932-12-31 00:00:00 +0700
```
This change fixes the issue by using `DIV` macro instead of `/`.
Now `Time.new(1933)` returns a time in 1933.
```
$ TZ=Asia/Kuala_Lumpur ruby -e 'p Time.new(1933)'
1933-01-01 00:20:00 +0720
```
[Bug #16159]
Added a test for [Bug #16159]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67864 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Guard static variable first
* ext/openssl/ossl_asn1.c (Init_ossl_asn1): register the static
variable to grab an internal object, before creating the object.
otherwise the just-created object could get collected during the
global variable list allocation. [Bug #16196]
Slimed down test runtime by stressing openssl.so only [Bug #16196]
Prefer rb_gc_register_mark_object
* ext/openssl/ossl_asn1.c (Init_ossl_asn1): prefer
`rb_gc_register_mark_object`, which is better for constant
objects, over `rb_gc_register_address` for global/static
variables which can be re-assigned at runtime. [Bug #16196]
Skip very time consuming test [Bug #16196]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67863 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
marshal.c: check instance variable count
* marshal.c (w_obj_each): ensure that no instance variable was
added while dumping other instance variables. [Bug #15968]
Hoisted out w_ivar_each
marshal.c: check instance variable count
* marshal.c (w_ivar_each): ensure that no instance variable was
removed while dumping other instance variables. [Bug #15968]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67861 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
`FileTest.send(command, ...)` allows to call not only FileTest-related
methods but also any method that belongs to Kernel, Object, etc.
patched by <mame@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67814 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
WEBrick: prevent response splitting and header injection
This is a follow up to d9d4a28.
The commit prevented CRLR, but did not address an isolated CR or an
isolated LF.
Co-Authored-By: NARUSE, Yui <naruse@airemix.jp>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67813 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Loop with String#scan without creating substrings
Create the substrings necessary parts only, instead of cutting the
rest of the buffer. Also removed a useless, probable typo, regexp.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67811 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix for wrong fnmatch patttern
* dir.c (file_s_fnmatch): ensure that pattern does not contain a
NUL character. https://hackerone.com/reports/449617
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67809 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fixed heap-use-after-free
* string.c (rb_str_sub_bang): retrieves a pointer to the
replacement string buffer just before using it, for the case of
replacement with the receiver string itself. [Bug #16105]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67773 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
UTF LE is fixed at least the first 2 bytes
* io.c (io_strip_bom): if the first 2 bytes are 0xFF0xFE, it
should be a little-endian UTF, 16 or 32. [Bug #16099]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67772 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Preserve the string content at self-copying
* string.c (rb_str_init): preserve the embedded content when
self-copying with a capacity. [Bug #15937]
New buffer for shared string
* string.c (rb_str_init): allocate new buffer if the string is
shared. [Bug #15937]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67769 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Update the certificate files to make the test pass on Debian 10
The old certificate files (for example, test/rubygems/ca_cert.pem) were
signed by SHA1. This message digest is considered too weak and rejected
by OpenSSL 1.1.1 or later. Because of this, the test suite does not
pass on Debian 10.
https://rubyci.org/logs/rubyci.s3.amazonaws.com/debian/ruby-master/log/20190527T123003Z.fail.html.gz#test%2Frubygems
This change regenerates the files.
A shell script for the regeneration (util/create_certs.sh) is also
added.
* remove trailing spaces.
Removed inconsistency file from upstream repository of rubygems.
followed up ae2a904ce9bffedee7d110dc60fd51c0a2879a5b
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67768 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
String#b: Don't depend on dependent string
Registering a string that depend on a dependent string as fstring
can lead to use-after-free. See c06ddfe and 3f95620 for details.
The following script triggers use-after-free on trunk, 2.4.6, 2.5.5
and 2.6.3. Credits to @wanabe for using eval as a cross-version way
of registering a fstring.
```ruby
a = ('j' * 24).b.b
eval('', binding, a)
p a
4.times { GC.start }
p a
```
- string.c (str_replace_shared_without_enc): when given a
dependent string, depend on the root of the dependent
string.
[Bug #15934]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67767 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Get rid of indirect sharing
* string.c (str_duplicate): share the root shared string if the
original string is already sharing, so that all shared strings
refer the root shared string directly. indirect sharing can
cause a dangling pointer.
[Bug #15792]
str_duplicate: Don't share with a frozen shared string
This is a follow up for 3f9562015e651735bfc2fdd14e8f6963b673e22a.
Before this commit, it was possible to create a shared string which
shares with another shared string by passing a frozen shared string
to `str_duplicate`.
Such string looks like:
```
-------- -----------------
| root | ------ owns -----> | root's buffer |
-------- -----------------
^ ^ ^
----------- | |
| shared1 | ------ references ----- |
----------- |
^ |
----------- |
| shared2 | ------ references ---------
-----------
```
This is bad news because `rb_fstring(shared2)` can make `shared1`
independent, which severs the reference from `shared1` to `root`:
```c
/* from fstr_update_callback() */
str = str_new_frozen(rb_cString, shared2); /* can return shared1 */
if (STR_SHARED_P(str)) { /* shared1 is also a shared string */
str_make_independent(str); /* no frozen check */
}
```
If `shared1` was the only reference to `root`, then `root` can be
reclaimed by the GC, leaving `shared2` in a corrupted state:
```
----------- --------------------
| shared1 | -------- owns --------> | shared1's buffer |
----------- --------------------
^
|
----------- -------------------------
| shared2 | ------ references ----> | root's buffer (freed) |
----------- -------------------------
```
Here is a reproduction script for the situation this commit fixes.
```ruby
a = ('a' * 24).strip.freeze.strip
-a
p a
4.times { GC.start }
p a
```
- string.c (str_duplicate): always share with the root string when
the original is a shared string.
- test_rb_str_dup.rb: specifically test `rb_str_dup` to make
sure it does not try to share with a shared string.
[Bug #15792]
Closes: https://github.com/ruby/ruby/pull/2159
Update dependencies
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67766 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix SystemStackError when calling a method in an unused refinement
Fixes [Bug #15720]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67765 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
parse.y: function parser_mixed_error & parser_mixed_escape
Fix mixed encoding in heredoc
Heredocs are parsed line-by-line, so we need to keep track of the
temporary encoding of the string. Previously, a heredoc would
only detect mixed encoding errors if they were on the same line,
this changes things so they will be caught on different lines.
Fixes [Bug #15839]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67763 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
fix visibility of SecureRandom.gen_random
Aliasing a method preserves its visibility. These aliases turn
formerly-public methods into private. Should make them public
again. [Bug #15847]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67762 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Keep vm->orig_progname alive
`vm->orig_progname` can be different from `vm->progname` when user
code assigns to `$0`. While `vm->progname` is kept alive by the
global table, nothing marked `vm->orig_progname`.
[Bug #15887]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67761 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Add RB_ID_SERIAL_MAX
Hide internal IDs
* parse.y (internal_id): number the ID serial for internal use by
counting down from the neary maximum value, not to accidentally
match permanent IDs.
[Bug #15768]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67758 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Always mark the string returned by File.realpath as tainted
This string can include elements that were not in either string
passed to File.realpath, even if one of the strings is an
absolute path, due to symlinks:
```ruby
Dir.mkdir('b') unless File.directory?('b')
File.write('b/a', '') unless File.file?('b/a')
File.symlink('b', 'c') unless File.symlink?('c')
path = File.realpath('c/a'.untaint, Dir.pwd.untaint)
path # "/home/testr/ruby/b/a"
path.tainted? # should be true, as 'b' comes from file system
```
[Bug #15803]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67755 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix IO#scanf on pipes on Windows
IO.seek on a pipe on Windows raises Errno::EINVAL instead of
Errno::ESPIPE.
Fixes Ruby Bug #15199
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67754 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
regparse.c: Suppress duplicated range warning by mere \X
* regparse.c (node_extended_grapheme_cluster): as Unicode 10 has
added Grapheme_Cluster_Break properties to some characters,
remove duplicated ranges for Unicode 9.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@65086 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67752 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Windows simply causes an error to open invalid path
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67709 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
dsym should be treated as string [ruby-core:91852] [Bug #15670]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67707 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Guard out the test when it is run under root permission
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67704 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix infinite loop by ensure
* compile.c (iseq_insert_nop_between_end_and_cont): insert nop so that the end of rescue and continuing points are not same, to get rid of infinite loop. [Bug #15385]
test_optimization.rb: increase timeout for RubyCI
https://rubyci.org/logs/rubyci.s3.amazonaws.com/opensuseleap/ruby-trunk/log/20181230T040002Z.fail.html.gz
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67702 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
tmpdir.rb: permission of user given directory
* lib/tmpdir.rb (Dir.mktmpdir): check if the permission of the
parent directory only when using the default temporary
directory, and no check against user given directory. the
security is the user's responsibility in that case.
[ruby-core:91216] [Bug #15555]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67241 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
should use defined_class.
* vm_insnhelper.c (vm_call_method_each_type): we should use me->defined_class
instead of me->owner because me->owner doesn't has correct ancestors list.
[Bug #15427]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67238 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
net/http, net/ftp: fix session resumption with TLS 1.3
When TLS 1.3 is in use, the session ticket may not have been sent yet
even though a handshake has finished. Also, the ticket could change if
multiple session ticket messages are sent by the server. Use
SSLContext#session_new_cb instead of calling SSLSocket#session
immediately after a handshake. This way also works with earlier protocol
versions.
net/http, net/ftp: skip SSL/TLS session resumption tests
Due to a bug in OpenSSL 1.1.0h[1] (it's only in this specific version;
it was introduced just before the release and is already fixed in their
stable branch), the callback set by SSLContext#session_new_cb= does not
get called for clients, making net/http and net/ftp not attempt session
resumption.
Let's disable the affected test cases for now. Another option would be
to fallback to using SSLSocket#session as we did before r64234. But
since only a single version is affected and hopefully a new stable
version containing the fix will be released in near future, I chose not
to add such workaround code to lib/.
[1] https://github.com/openssl/openssl/pull/5967
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67237 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
numeric.c: fix infinite loop
* numeric.c (int_pow): fix infinite loop in the case of y equal 1
and power of x does not overflow.
[ruby-core:91734] [Bug #15651]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67219 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
