mirror of
https://github.com/ruby/ruby.git
synced 2026-08-01 02:20:48 +08:00
145a4bba92
Bundler::CompactIndexClient::Cache#info_path and #info_etag_path join the gem name into the cache directory without validation. The name comes from the remote index, either versions lines or transitive dependency names in info files, so a crafted name like "../../../../pwn" escapes the cache directory because the special-characters branch keeps the raw name and only appends an MD5 suffix. Reject any name that is not a plain basename before constructing the path, matching the fetch_spec guard from https://github.com/ruby/rubygems/commit/56ed326cb2, and apply the same guard to the independent Gem::CompactIndexClient::Cache port. https://github.com/ruby/rubygems/commit/4b1c454526 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>