Merge pull request #24303 from Homebrew/tap-trust-newline

Match newlines in tap path regex

Library/Homebrew/tap_constants.rb

@@ -26,7 +26,7 @@ HOMEBREW_DEFAULT_TAP_CASK_REGEX =
 HOMEBREW_TAP_DIR_REGEX =
   %r{#{Regexp.escape(HOMEBREW_LIBRARY.to_s)}/Taps/(?<user>[^/]+)/(?<repository>[^/]+)}
 # Match taps' formula paths, e.g. `HOMEBREW_LIBRARY/Taps/someuser/sometap/someformula`.
-HOMEBREW_TAP_PATH_REGEX = Regexp.new(HOMEBREW_TAP_DIR_REGEX.source + %r{(?:/.*)?\Z}.source).freeze
+HOMEBREW_TAP_PATH_REGEX = %r{#{HOMEBREW_TAP_DIR_REGEX.source}(?:/.*)?\Z}m
 # Match official cask taps, e.g `homebrew/cask`.
 HOMEBREW_CASK_TAP_REGEX =
   %r{(?:[Cc]askroom/cask|[Hh]omebrew/(?:homebrew-)?(?:cask|cask-[\w-]+))}

Library/Homebrew/test/tap_spec.rb

@@ -150,6 +150,25 @@ RSpec.describe Tap do
       expect(described_class.from_path(path)).to eq tap
     end
 
+    test_each ["Formula/f\no/formula.rb", "Formula/f\r\no/formula.rb", "Casks/ca\nsk.rb",
+               "cmd/brew-fo\no.rb"] do |file|
+      it "returns the Tap for a path containing newlines: #{file.inspect}" do
+        expect(described_class.from_path(path/file)).to eq tap
+      end
+    end
+
+    context "when a newline precedes another tap's path" do
+      let(:tap) { described_class.fetch("thirdparty", "foo") }
+
+      after do
+        tap.uninstall
+      end
+
+      it "returns the original Tap" do
+        expect(described_class.from_path(path/"Formula/a\n#{CoreTap.instance.path}/Formula/foo.rb")).to eq tap
+      end
+    end
+
     context "when path contains a dot" do
       let(:tap) { described_class.fetch("str4d.xyz", "rage") }
 

Library/Homebrew/test/trust_spec.rb

@@ -812,6 +812,32 @@ RSpec.describe Homebrew::Trust, :trust_store do
     FileUtils.rm_rf HOMEBREW_TAP_DIRECTORY/"thirdparty"
   end
 
+  context "when an untrusted formula path contains a newline" do
+    sig { returns(Pathname) }
+    let(:formula_path) { Tap.fetch("thirdparty", "foo").formula_dir/"d\ne/default-trust.rb" }
+
+    before do
+      formula_path.dirname.mkpath
+      formula_path.write <<~RUBY
+        class DefaultTrust < Formula
+          url "https://brew.sh/default-trust-1.0.tar.gz"
+        end
+      RUBY
+    end
+
+    after do
+      FileUtils.rm_rf HOMEBREW_TAP_DIRECTORY/"thirdparty"
+    end
+
+    it "does not trust the formula file" do
+      expect(described_class.trusted_formula_file?(formula_path)).to be(false)
+    end
+
+    it "refuses to evaluate the formula" do
+      expect { Formulary.factory(formula_path) }.to raise_error(Homebrew::UntrustedTapError)
+    end
+  end
+
   it "allows explicitly named formula files when trust checks are enabled" do
     old_argv = ARGV.dup
     tap = Tap.fetch("thirdparty", "foo")