aeb7a05799 (master): [ruby/rubygems] Check the resolved parent directory before extracting old format gems
0 views
Skip to first unread message
Hiroshi SHIBATA
3:30 AM (9 hours ago) 3:30 AM
to ruby...@g.ruby-lang.org
Hiroshi SHIBATA 2026-08-03 02:38:39 +0000 (Mon, 03 Aug 2026)
New Revision: aeb7a05799
https://github.com/ruby/ruby/commit/aeb7a05799
Log:
[ruby/rubygems] Check the resolved parent directory before extracting old format gems
Gem::Package::Old#extract_files only validated entry paths by string
expansion, so a preexisting symlink in the extraction directory redirected
writes outside of it. Gem::Package#extract_tar_gz already re-resolves the
parent directory with File.realpath, so extract the shared check into
verify_extraction_dir and call it from both.
https://github.com/ruby/rubygems/commit/20e729f9a5
Co-Authored-By: Claude Opus 5 <nor...@anthropic.com>
Modified files:
lib/rubygems/package.rb
lib/rubygems/package/old.rb
test/rubygems/test_gem_package_old.rb
New Revision: aeb7a05799
https://github.com/ruby/ruby/commit/aeb7a05799
Log:
[ruby/rubygems] Check the resolved parent directory before extracting old format gems
Gem::Package::Old#extract_files only validated entry paths by string
expansion, so a preexisting symlink in the extraction directory redirected
writes outside of it. Gem::Package#extract_tar_gz already re-resolves the
parent directory with File.realpath, so extract the shared check into
verify_extraction_dir and call it from both.
https://github.com/ruby/rubygems/commit/20e729f9a5
Co-Authored-By: Claude Opus 5 <nor...@anthropic.com>
Modified files:
lib/rubygems/package.rb
lib/rubygems/package/old.rb
test/rubygems/test_gem_package_old.rb
Reply all
Reply to author
Forward
0 new messages