* ext/fiddle/handle.c: check tainted string arguments.
Patch provided by tenderlove and nobu.
* test/fiddle/test_handle.rb (class TestHandle): add test for above.
* ext/dl/handle.c (rb_dlhandle_initialize): prohibits DL::dlopen
with a tainted name of library.
Patch by sheepman <sheepman AT sheepman.sakura.ne.jp>.
* ext/dl/handle.c (rb_dlhandle_sym): ditto
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@53161 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/rubygems.rb: bump version to 2.0.14.1. this version fixed
CVE-2015-3900.
* lib/rubygems/remote_fetcher.rb: ditto.
* test/rubygems/test_gem_remote_fetcher.rb: added testcase for CVE-2015-3900
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@51628 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* ext/openssl/lib/openssl/ssl.rb: stricter hostname verification
following RFC 6125. with the patch provided by Tony Arcieri and
Hiroshi Nakamura [ruby-core:61545] [Bug #9644]
* test/openssl/test_ssl.rb: add tests for above.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@50294 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
method.h: UNDEFINED_REFINED_METHOD_P
* method.h (UNDEFINED_REFINED_METHOD_P): macro to tell if refined
original method is defined.
* vm_method.c (remove_method): When remove refined
method, raise a NameError if the method is not
defined in refined class.
But if the method is defined in refined class,
it should keep refined method and remove original
method.
Patch by Seiei Higa. [ruby-core:67722] [Bug #10765]
* class.c (method_entry_i, class_instance_method_list,
rb_obj_singleton_methods): should not include methods of
superclasses if recur is false. [ruby-dev:48854] [Bug #10826]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49738 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/mkmf.rb (try_cppflags, try_cflags, try_ldflags): get rid of
interference by modifying global variables in have_devel? method.
[ruby-core:67962] [Bug #10821]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49735 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/uri/generic.rb (URI::Generic.build):
use hostname= to detect and wrap IPv6 hosts.
Build is accepting URI components and users may not expect
that a host component needs to be wrapped with square brackets
since it's not providing a URI.
Note: initialize with arg_check => true does not wrap IPv6 hosts.
by Joe Rafaniello <jrafanie@redhat.com>
https://github.com/ruby/ruby/pull/765 fix GH-765
* test/uri/test_generic.rb: Add more tests
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49669 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/resolv.rb (Resolv::DNS::Resource#==, #hash): elements
returned by Kernel#instance_variables are Symbols now.
[ruby-core:68128] [Bug #10857]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49639 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* pack.c (str_associate, str_associated): keep associated objects
in an instance variables, instead of in the internal structure.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49447 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/rdoc/text.rb (expand_tabs): get rid of infinite loop with
CR. should check if substitution occurred too.
[ruby-dev:48813] [Bug #10732]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49445 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* vm_method.c (rb_alias): raise a NameError when creating alias to
a refined method if the original method of the refined method is
not defined. [ruby-core:67523] [Bug #10731]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49425 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* ext/readline/readline.c (readline_s_refresh_line): initialize
before rl_refresh_line(), as some function make the internal
state non-clean but rl_refresh_line() does not re-initialize it.
[ruby-core:43957] [Bug #6232]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49424 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
vm_method.c: fix change refined new method visibility
* vm_method.c (rb_export_method): bail out if the original method
is undefined when the method is refined.
[ruby-core:67387] [Bug #10706]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49423 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* test/net/http/test_http.rb (_test_send_request__HEAD): Added
failing test for send_request with HEAD method.
* lib/net/http.rb (Net::HTTP#send_request): there is no response body
with HEAD request. Patch by @rodrigosaito [fix GH-520]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49378 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/resolv.rb (Resolv::DNS::Name#==): DNS is case-insensitive, so the
comparison should be case-insensitive as well.
[ruby-core:66498] [Bug #10550]
* lib/resolv.rb (Resolv::DNS::Name): names with different dots
should be different.
* lib/resolv.rb (Resolv::DNS::Name#==): Compare an array of Label:Str
objects. Label#Str#== is case-insensitive.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49252 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/net/http/response.rb (Net::HTTPResponse): require one or more
spaces [Bug #10591].
by leriksen <leif.eriksen.au@gmail.com>
https://github.com/ruby/ruby/pull/782 fix GH-782
NOTE: graph.facebook.com returns without SP Reason-Phrase.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49250 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* eval.c (rb_frame_last_func): return the most recent frame method
name.
* thread.c (recursive_list_access): use the last method name,
instead of the current method name which can be unset in some
cases, not to use a symbol by the invalid ID.
[ruby-core:66742] [Bug #10579]
* thread.c (exec_recursive): use the same last method name as
recursive_push in the error message when recursive_pop failed.
[ruby-core:66742] [Bug #10579]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49246 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/resolv.rb: fall back if canonicalization fails.
Thanks Vit Ondruch for the patch! [ruby-core:65836]
* test/resolv/test_dns.rb: test for patch
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@49245 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* parse.y (symbol_list): fix the node type of literal symbol list
with no interpolation. [ruby-core:66343]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48635 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* proc.c (method_proc): the receiver of binding from method should
be same as the receiver of the method.
[ruby-core:65917] [Bug #10432]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48633 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* io.c (copy_stream_body): should write in binary mode. based on a
patch by godfat (Lin Jen-Shin) at [ruby-core:56556].
[ruby-core:56518] [Bug #8767]
* io.c (copy_stream_body): move common open flags.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48631 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/rexml/document.rb: add REXML::Document#document.
reported by Tomas Hoger <thoger@redhat.com> and patched by nahi.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48403 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* class.c (unknown_keyword_error): delete expected keywords
directly from raw table, so that the given block is not called.
[ruby-core:65837] [Bug #10413]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48284 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
reported and patched by Jeremy Evans at [Bug #10439]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48171 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/rexml/entity.rb: keep the entity size within the limitation.
reported by Willis Vandevanter <will@silentrobots.com> and
patched by nahi.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48162 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* vm_method.c (rb_method_entry_make): warn redefinition only for
already defined methods, but not for undefined methods.
[ruby-dev:48691] [Bug #10421]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48149 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/openssl/ssl.rb: Explicitly whitelist the default
SSL/TLS ciphers. Forbid SSLv2 and SSLv3, disable
compression by default.
Reported by Jeff Hodges.
[ruby-core:59829] [Bug #9424]
* test/openssl/test_ssl.rb: Reuse TLS default options from
OpenSSL::SSL::SSLContext::DEFAULT_PARAMS.
* ext/openssl/lib/openssl/ssl.rb (DEFAULT_PARAMS): override
options even if OpenSSL::SSL::OP_NO_SSLv3 is not defined.
this is pointed out by Stephen Touset. [ruby-core:65711] [Bug #9424]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48110 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* vm_core.h, vm.c, proc.c: fix GC mark miss on bindings.
[ruby-dev:48616] [Bug #10368]
* test/ruby/test_eval.rb: add a test code.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@48048 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* ext/stringio/stringio.c (strio_write): ASCII-8BIT StringIO
should be writable any encoding strings, without conversion.
[ruby-core:65240] [Bug #10285]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47988 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* vm_eval.c (eval_string_with_cref): fix super from eval with
scope. set klass in the current control frame to the class of
the receiver in the context to be evaluated, this class/module
must match the actual receiver to call super.
[ruby-core:65122] [Bug #10263]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47987 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* ext/pathname/lib/pathname.rb (SAME_PATHS):
Pathname#relative_path_from uses String#casecmp to compare strings
on case-insensitive filesystem platforms (e.g., Windows). This can
return nil for strings with different encodings, and the code
previously assumed that it always returned a Fixnum. [Fix GH-713]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47611 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* lib/csv.rb (CSV#<<): honor explicity given encoding. based on
the patch by DAISUKE TANIWAKI <daisuketaniwaki AT gmail.com> at
[ruby-core:62113]. [Bug #9766]
* lib/csv.rb (CSV#<<): honor explicitly given encoding. based on
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47608 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* object.c (rb_obj_copy_ivar): extract function to copy instance
variables only for T_OBJECT from init_copy.
* object.c (rb_obj_copy_ivar): allocate no memory for empty
instance variables. [ruby-core:64700] [Bug #10191]
* test/ruby/test_object.rb: extend timeout.
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47548 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* io.c (io_close): ignore only "closed stream" IOError and
NoMethodError, do not swallow other exceptions at the end of
block. [ruby-core:64463] [Bug #10153]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47503 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
* sprintf.c (GETASTER): should not use the numbered argument to be
formatted, raise ArgumentError instead.
[ruby-dev:48330] [Bug #9982]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_0_0@47497 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
usa