[rubygems/rubygems] Improve insecure gem overwrite message

https://github.com/rubygems/rubygems/commit/7c71dac22e
This commit is contained in:
David Rodríguez 2024-08-30 18:47:17 +02:00 committed by git
parent 4303a02f46
commit b00b0d5f8f
3 changed files with 7 additions and 7 deletions

View File

@ -217,15 +217,15 @@ module Bundler
end
class InsecureInstallPathError < BundlerError
def initialize(path)
def initialize(name, path)
@name = name
@path = path
end
def message
"The installation path is insecure. Bundler cannot continue.\n" \
"#{@path} is world-writable (without sticky bit).\n" \
"Bundler cannot safely replace gems in world-writeable directories due to potential vulnerabilities.\n" \
"Please change the permissions of this directory or choose a different install path."
"Bundler cannot reinstall #{@name} because there's a previous installation of it at #{@path} that is unsafe to remove.\n" \
"The parent of #{@path} is world-writable and does not have the sticky bit set, making it insecure to remove due to potential vulnerabilities.\n" \
"Please change the permissions of #{File.dirname(@path)} or choose a different install path."
end
status_code(38)

View File

@ -155,7 +155,7 @@ module Bundler
parent_st = File.stat(parent)
if parent_st.world_writable? && !parent_st.sticky?
raise InsecureInstallPathError.new(parent)
raise InsecureInstallPathError.new(spec.full_name, dir)
end
begin

View File

@ -1055,7 +1055,7 @@ RSpec.describe "bundle install with gem sources" do
bundle "install --redownload", raise_on_error: false
expect(err).to include("The installation path is insecure. Bundler cannot continue.")
expect(err).to include("Bundler cannot reinstall foo-1.0.0 because there's a previous installation of it at #{gems_path}/foo-1.0.0 that is unsafe to remove")
end
end