Reported by Alexandr Savca in https://hackerone.com/reports/1178562
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67950 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This fixes CVE-2021-31810.
Reported by Alexandr Savca.
Co-authored-by: Shugo Maeda <shugo@ruby-lang.org>
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67949 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ruby/rdoc] Use File.open to fix the OS Command Injection vulnerability in CVE-2021-31799
https://github.com/ruby/rdoc/commit/a7f5d6ab88
The test for command injection on Unix platforms should be omitted on Windows
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67947 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[Bug #17780] Fix Method#super_method for module alias
Method#super_method crashes for aliased module methods because they are
not defined on a class. This bug was introduced in
c60aaed1856b2b6f90de0992c34771830019e021 as part of bug #17130.
---
proc.c | 2 +-
test/ruby/test_method.rb | 13 +++++++++++++
2 files changed, 14 insertions(+), 1 deletion(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67945 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix singleton class cloning
Before this commit, `clone` gave different results depending on whether the original object
had an attached singleton class or not.
Consider the following setup:
```
class Foo; end
Foo.singleton_class.define_method(:foo) {}
obj = Foo.new
obj.singleton_class if $call_singleton
clone = obj.clone
```
When `$call_singleton = false`, neither `obj.singleton_class.singleton_class` nor
`clone.singleton_class.singleton_class` own any methods.
However, when `$call_singleton = true`, `clone.singleton_class.singleton_class` would own a copy of
`foo` from `Foo.singleton_class`, even though `obj.singleton_class.singleton_class` does not.
The latter case is unexpected and results in a visibly different clone, depending on if the original object
had an attached class or not.
Co-authored-by: Ufuk Kayserilioglu <ufuk.kayserilioglu@shopify.com>
---
class.c | 31 ++++++++++++++++++++++---------
test/ruby/test_class.rb | 47 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 69 insertions(+), 9 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67935 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Don't double fractional seconds when passing timezone object to Time.new
I found that fractional seconds were doubled when using the timezone
feature of Time in Sequel's named_timezones extension (which uses
TZInfo for the timezone object), and traced the problem to this code.
There is no subsecx being modified in the utc_to_local call below
this, and I'm not sure why you would want to add in the fractional
seconds unless you assumed the timezone conversion would drop the
existing fractional seconds (TZInfo doesn't drop fractional seconds).
Subsecond of Time::tm should be 0
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67934 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix Method#super_method for aliased methods
Previously, Method#super_method looked at the called_id to
determine the method id to use, but that isn't correct for
aliased methods, because the super target depends on the
original method id, not the called_id.
Additionally, aliases can reference methods defined in other
classes and modules, and super lookup needs to start in the
super of the defined class in such cases.
This adds tests for Method#super_method for both types of
aliases, one that uses VM_METHOD_TYPE_ALIAS and another that
does not. Both check that the results for calling super
methods return the expected values.
To find the defined class for alias methods, add an rb_ prefix
to find_defined_class_by_owner in vm_insnhelper.c and make it
non-static, so that it can be called from method_super_method
in proc.c.
This bug was original discovered while researching [Bug #11189].
Fixes [Bug #17130]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67933 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Remove sender/message_id pair after response received in resolv
Once a response for a given DNS request has been received (which
requires a matching message id), the [sender, message_id] pair
should be removed from the list of valid senders. This makes it
so duplicate responses from the same sender are ignored.
Fixes [Bug #12838]
---
lib/resolv.rb | 2 +-
test/resolv/test_dns.rb | 113 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 114 insertions(+), 1 deletion(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67929 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Capture to reserved name variables if already defined [Bug #17533]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67927 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Adjust sp for `x = false; y = (return until x unless x)` [Bug #16695]
test/ruby/test_syntax.rb: avoid "warning: assigned but unused
variable"
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67925 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Add operator info to OP_ASGN2 of RubyVM::AbstractSyntaxTree.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67921 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fixed infinite loop at error in printing cause [Bug #17033]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67913 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Correctly remove temporary directory if path yielded is mutated
Another approach would be to freeze the string, but that could
cause backwards compatibility issues.
Fixes [Bug #16918]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67910 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
brace the fact that lchmod(2) can EOPNOTSUPP
Musl libc has this function as a tiny wrapper of fchmodat(3posix). On
the other hand Linux kernel does not support changing modes of a symlink.
The operation always fails with EOPNOTSUPP. This fchmodat behaviour is
defined in POSIX. We have to take care of such exceptions.
---
lib/fileutils.rb | 3 ++-
test/pathname/test_pathname.rb | 2 +-
test/ruby/test_notimp.rb | 19 ++++++++++++-------
3 files changed, 15 insertions(+), 9 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67907 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ripper] fix mismatched indentations warning [Bug #16981]
The scanner location has to be set from lex.ptok before it is
flushed by dispatching the scanner event.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67906 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fix wrong "void value expression" error
* parse.y (value_expr_check): if either of then or else statements is not a void value expression, the whole if is not also a void value expression. [Bug #15932]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67903 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Don't display singleton class in Method#inspect unless method defined there
Previously, if an object has a singleton class, and you call
Object#method on the object, the resulting string would include
the object's singleton class, even though the method was not
defined in the singleton class.
Change this so the we only show the singleton class if the method
is defined in the singleton class.
Fixes [Bug #15608]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67902 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Fixed symbol misused as ID
rb_funcallv_public and rb_respond_to require an ID, not a
Symbol. [Bug #16649]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67901 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
hash in a pattern.
[Backport #16632][Bacport #16950]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67899 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
compile.c: stop wrong peephole optimization when covearge is enabled
jump-jump optimization ignores the event flags of the jump instruction
being skipped, which leads to overlook of line events.
This changeset stops the wrong optimization when coverage measurement is
neabled and when the jump instruction has any event flag.
Note that this issue is not only for coverage but also for TracePoint,
and this change does not fix TracePoint.
However, fixing it fundamentally is tough (which requires revamp of
the compiler). This issue is critical in terms of coverage measurement,
but minor for TracePoint (ko1 said), so we here choose a stopgap
measurement.
[Bug #15980] [Bug #16397]
Note for backporters: this changeset can be viewed by `git diff -w`.
---
compile.c | 232 +++++++++++++++++++++++------------------
test/coverage/test_coverage.rb | 12 +++
2 files changed, 141 insertions(+), 103 deletions(-)
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67898 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
test/net/http/test_https.rb: Stop the error due to openssl 1.1.1h
On some environments that uses OpenSSL 1.1.1h, the two tests now fail.
http://rubyci.s3.amazonaws.com/android29-x86_64/ruby-master/log/20200924T062352Z.fail.html.gzhttps://github.com/ruby/ruby/runs/1159288773?check_suite_focus=true
```
1) Failure:
TestNetHTTPS#test_get [/data/data/com.termux/files/home/cb/tmp/build/20200924T062352Z/ruby/test/net/http/test_https.rb:47]:
<"0\x82\x03\xED0\x82\x02\xD5\xA0\x03..."> expected but was
<"0\x82\x03\xE30\x82\x02\xCB\xA0\x03...">.
```
Not sure why, but verify_callback now seems to receive only SERVER_CERT
but not CA_CERT.
It would be good to investigate the issue furthermore, but tentatively,
I want to stop the failures.
test/net/http/test_https.rb: the order of verify_callback seems to
vary
... depending upon the environment.
test/net/http/test_https.rb: The test logic was buggy
The expected certs must be `[CA_CERT, SERVER_CERT]` before 1.1.1g and
`[SERVER_CERT]` after 1.1.1h.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67886 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
[ruby/psych] Fixing compatibility with libyaml 0.2.5
The main issue is that commas aren't allowed in local tags. libyaml
was updated to follow the spec, and our tests were out of date.
See: https://github.com/yaml/libyaml/issues/196https://github.com/ruby/psych/commit/3f5e520fd3
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67884 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Make RbConfig::CONFIG values mutable [Bug #16738]
As `RbConfig.expand` modifies the argument and involved `CONFIG`
values, its values should be mutable.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67859 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
check ar_table after `#hash` call
ar_table can be converted to st_table just after `ar_do_hash()`
function which calls `#hash` method. We need to check
the representation to detect this mutation.
[Bug #16676]
check ar_table first.
RHASH_AR_TABLE_SIZE() has assertion that it is a ar_talbe.
The last commit breaks this assumption so check ar_table first.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67858 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Skip jit_test on some new RubyCI envs for now
Propagate JIT skip to all tests
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67854 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Check MJIT support in one place
to fix test failure on trunk-no-mjit
https://gist.github.com/ko1/32ab982ffd7555988818773c08f97123
Prefer using MJIT_CC for JIT support check
because Solaris might have CC=cc and we'd like to check full path
MJIT_CC=/opt/developerstudio12.5/bin/cc instead.
test/lib/jit_support.rb: Update the regexp for icc
MJIT_CC is always an absolute path.
test/lib/jit_support.rb: The path to icc was changed
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67853 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
