kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

Followed up CVE-2022-39253 for bundler examples

Browse source
This commit is contained in:
Hiroshi SHIBATA 2022-10-20 14:36:06 +09:00
parent 0a43a040b4
commit 4f1e0bfacd
No known key found for this signature in database
GPG key ID: F9CF13417264FAC2
3 changed files with 15 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
spec/bundler/cache/git_spec.rb vendored
View file

@ -156,6 +156,9 @@ RSpec.describe "bundle cache with git" do
end
it "copies repository to vendor cache, including submodules" do
# CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
system(*%W[git config --global protocol.file.allow always])
build_git "submodule", "1.0"
git = build_git "has_submodule", "1.0" do |s|

9
spec/bundler/install/gemfile/git_spec.rb
View file

@ -865,6 +865,9 @@ RSpec.describe "bundle install with git sources" do
end
it "ignores submodules if :submodule is not passed" do
# CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
system(*%W[git config --global protocol.file.allow always])
build_git "submodule", "1.0"
build_git "has_submodule", "1.0" do |s|
s.add_dependency "submodule"
@ -884,6 +887,9 @@ RSpec.describe "bundle install with git sources" do
end
it "handles repos with submodules" do
# CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
system(*%W[git config --global protocol.file.allow always])
build_git "submodule", "1.0"
build_git "has_submodule", "1.0" do |s|
s.add_dependency "submodule"
@ -902,6 +908,9 @@ RSpec.describe "bundle install with git sources" do
end
it "does not warn when deiniting submodules" do
# CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
system(*%W[git config --global protocol.file.allow always])
build_git "submodule", "1.0"
build_git "has_submodule", "1.0"

3
spec/bundler/update/git_spec.rb
View file

@ -124,6 +124,9 @@ RSpec.describe "bundle update" do
describe "with submodules" do
before :each do
# CVE-2022-39253: https://lore.kernel.org/lkml/xmqq4jw1uku5.fsf@gitster.g/
system(*%W[git config --global protocol.file.allow always])
build_repo4 do
build_gem "submodule" do |s|
s.write "lib/submodule.rb", "puts 'GEM'"