gnu/packages/patches/ruby-rubygems-276-for-ruby24.patch

   1 diff --git lib/rubygems.rb lib/rubygems.rb
   2 index 0685bcb3c6..a5a9202e56 100644
   3 --- ruby-2.4.3/lib/rubygems.rb
   4 +++ ruby-2.4.3/lib/rubygems.rb
   5 @@ -10,7 +10,7 @@
   6  require 'thread'
   7
   8  module Gem
   9 -  VERSION = "2.6.14"
  10 +  VERSION = "2.6.14.1"
  11  end
  12
  13  # Must be first since it unloads the prelude from 1.9.2
  14 diff --git lib/rubygems/commands/owner_command.rb lib/rubygems/commands/owner_command.rb
  15 index 4b99434e87..2ee7f84462 100644
  16 --- ruby-2.4.3/lib/rubygems/commands/owner_command.rb
  17 +++ ruby-2.4.3/lib/rubygems/commands/owner_command.rb
  18 @@ -62,7 +62,7 @@ def show_owners name
  19      end
  20
  21      with_response response do |resp|
  22 -      owners = YAML.load resp.body
  23 +      owners = Gem::SafeYAML.load resp.body
  24
  25        say "Owners for gem: #{name}"
  26        owners.each do |owner|
  27 diff --git lib/rubygems/package.rb lib/rubygems/package.rb
  28 index 77811ed5ec..b5a5fe2a26 100644
  29 --- ruby-2.4.3/lib/rubygems/package.rb
  30 +++ ruby-2.4.3/lib/rubygems/package.rb
  31 @@ -378,7 +378,7 @@ def extract_tar_gz io, destination_dir, pattern = "*" # :nodoc:
  32              File.dirname destination
  33            end
  34
  35 -        FileUtils.mkdir_p mkdir, mkdir_options
  36 +        mkdir_p_safe mkdir, mkdir_options, destination_dir, entry.full_name
  37
  38          open destination, 'wb' do |out|
  39            out.write entry.read
  40 @@ -416,20 +416,35 @@ def install_location filename, destination_dir # :nodoc:
  41      raise Gem::Package::PathError.new(filename, destination_dir) if
  42        filename.start_with? '/'
  43
  44 -    destination_dir = File.realpath destination_dir if
  45 -      File.respond_to? :realpath
  46 +    destination_dir = realpath destination_dir
  47      destination_dir = File.expand_path destination_dir
  48
  49      destination = File.join destination_dir, filename
  50      destination = File.expand_path destination
  51
  52      raise Gem::Package::PathError.new(destination, destination_dir) unless
  53 -      destination.start_with? destination_dir
  54 +      destination.start_with? destination_dir + '/'
  55
  56      destination.untaint
  57      destination
  58    end
  59
  60 +  def mkdir_p_safe mkdir, mkdir_options, destination_dir, file_name
  61 +    destination_dir = realpath File.expand_path(destination_dir)
  62 +    parts = mkdir.split(File::SEPARATOR)
  63 +    parts.reduce do |path, basename|
  64 +      path = realpath path  unless path == ""
  65 +      path = File.expand_path(path + File::SEPARATOR + basename)
  66 +      lstat = File.lstat path rescue nil
  67 +      if !lstat || !lstat.directory?
  68 +        unless path.start_with? destination_dir and (FileUtils.mkdir path, mkdir_options rescue false)
  69 +          raise Gem::Package::PathError.new(file_name, destination_dir)
  70 +        end
  71 +      end
  72 +      path
  73 +    end
  74 +  end
  75 +
  76    ##
  77    # Loads a Gem::Specification from the TarEntry +entry+
  78
  79 @@ -603,6 +618,10 @@ def verify_files gem
  80        raise Gem::Package::FormatError.new \
  81                'package content (data.tar.gz) is missing', @gem
  82      end
  83 +
  84 +    if duplicates = @files.group_by {|f| f }.select {|k,v| v.size > 1 }.map(&:first) and duplicates.any?
  85 +      raise Gem::Security::Exception, "duplicate files in the package: (#{duplicates.map(&:inspect).join(', ')})"
  86 +    end
  87    end
  88
  89    ##
  90 @@ -616,6 +635,16 @@ def verify_gz entry # :nodoc:
  91      raise Gem::Package::FormatError.new(e.message, entry.full_name)
  92    end
  93
  94 +  if File.respond_to? :realpath
  95 +    def realpath file
  96 +      File.realpath file
  97 +    end
  98 +  else
  99 +    def realpath file
 100 +      file
 101 +    end
 102 +  end
 103 +
 104  end
 105
 106  require 'rubygems/package/digest_io'
 107 diff --git lib/rubygems/package/tar_header.rb lib/rubygems/package/tar_header.rb
 108 index c54bd14d57..d557357114 100644
 109 --- ruby-2.4.3/lib/rubygems/package/tar_header.rb
 110 +++ ruby-2.4.3/lib/rubygems/package/tar_header.rb
 111 @@ -104,25 +104,30 @@ def self.from(stream)
 112      fields = header.unpack UNPACK_FORMAT
 113
 114      new :name     => fields.shift,
 115 -        :mode     => fields.shift.oct,
 116 -        :uid      => fields.shift.oct,
 117 -        :gid      => fields.shift.oct,
 118 -        :size     => fields.shift.oct,
 119 -        :mtime    => fields.shift.oct,
 120 -        :checksum => fields.shift.oct,
 121 +        :mode     => strict_oct(fields.shift),
 122 +        :uid      => strict_oct(fields.shift),
 123 +        :gid      => strict_oct(fields.shift),
 124 +        :size     => strict_oct(fields.shift),
 125 +        :mtime    => strict_oct(fields.shift),
 126 +        :checksum => strict_oct(fields.shift),
 127          :typeflag => fields.shift,
 128          :linkname => fields.shift,
 129          :magic    => fields.shift,
 130 -        :version  => fields.shift.oct,
 131 +        :version  => strict_oct(fields.shift),
 132          :uname    => fields.shift,
 133          :gname    => fields.shift,
 134 -        :devmajor => fields.shift.oct,
 135 -        :devminor => fields.shift.oct,
 136 +        :devmajor => strict_oct(fields.shift),
 137 +        :devminor => strict_oct(fields.shift),
 138          :prefix   => fields.shift,
 139
 140          :empty => empty
 141    end
 142
 143 +  def self.strict_oct(str)
 144 +    return str.oct if str =~ /\A[0-7]*\z/
 145 +    raise ArgumentError, "#{str.inspect} is not an octal string"
 146 +  end
 147 +
 148    ##
 149    # Creates a new TarHeader using +vals+
 150
 151 diff --git lib/rubygems/package/tar_writer.rb lib/rubygems/package/tar_writer.rb
 152 index f68b8d4c5e..390f7851a3 100644
 153 --- ruby-2.4.3/lib/rubygems/package/tar_writer.rb
 154 +++ ruby-2.4.3/lib/rubygems/package/tar_writer.rb
 155 @@ -196,6 +196,8 @@ def add_file_signed name, mode, signer
 156        digest_name == signer.digest_name
 157      end
 158
 159 +    raise "no #{signer.digest_name} in #{digests.values.compact}" unless signature_digest
 160 +
 161      if signer.key then
 162        signature = signer.sign signature_digest.digest
 163
 164 diff --git lib/rubygems/server.rb lib/rubygems/server.rb
 165 index df4eb566d3..a7b5243ba0 100644
 166 --- ruby-2.4.3/lib/rubygems/server.rb
 167 +++ ruby-2.4.3/lib/rubygems/server.rb
 168 @@ -631,6 +631,18 @@ def root(req, res)
 169        executables = nil if executables.empty?
 170        executables.last["is_last"] = true if executables
 171
 172 +      # Pre-process spec homepage for safety reasons
 173 +      begin
 174 +        homepage_uri = URI.parse(spec.homepage)
 175 +        if [URI::HTTP, URI::HTTPS].member? homepage_uri.class
 176 +          homepage_uri = spec.homepage
 177 +        else
 178 +          homepage_uri = "."
 179 +        end
 180 +      rescue URI::InvalidURIError
 181 +        homepage_uri = "."
 182 +      end
 183 +
 184        specs << {
 185          "authors"             => spec.authors.sort.join(", "),
 186          "date"                => spec.date.to_s,
 187 @@ -640,7 +652,7 @@ def root(req, res)
 188          "only_one_executable" => (executables && executables.size == 1),
 189          "full_name"           => spec.full_name,
 190          "has_deps"            => !deps.empty?,
 191 -        "homepage"            => spec.homepage,
 192 +        "homepage"            => homepage_uri,
 193          "name"                => spec.name,
 194          "rdoc_installed"      => Gem::RDoc.new(spec).rdoc_installed?,
 195          "ri_installed"        => Gem::RDoc.new(spec).ri_installed?,
 196 diff --git lib/rubygems/specification.rb lib/rubygems/specification.rb
 197 index 40e3a70d47..0a154b9001 100644
 198 --- ruby-2.4.3/lib/rubygems/specification.rb
 199 +++ ruby-2.4.3/lib/rubygems/specification.rb
 200 @@ -15,6 +15,7 @@
 201  require 'rubygems/stub_specification'
 202  require 'rubygems/util/list'
 203  require 'stringio'
 204 +require 'uri'
 205
 206  ##
 207  # The Specification class contains the information for a Gem.  Typically
 208 @@ -2813,10 +2814,16 @@ def validate packaging = true
 209        raise Gem::InvalidSpecificationException, "#{lazy} is not a summary"
 210      end
 211
 212 -    if homepage and not homepage.empty? and
 213 -       homepage !~ /\A[a-z][a-z\d+.-]*:/i then
 214 -      raise Gem::InvalidSpecificationException,
 215 -            "\"#{homepage}\" is not a URI"
 216 +    # Make sure a homepage is valid HTTP/HTTPS URI
 217 +    if homepage and not homepage.empty?
 218 +      begin
 219 +        homepage_uri = URI.parse(homepage)
 220 +        unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
 221 +          raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
 222 +        end
 223 +      rescue URI::InvalidURIError
 224 +        raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a valid HTTP URI"
 225 +      end
 226      end
 227
 228      # Warnings
 229 diff --git test/rubygems/test_gem_commands_owner_command.rb test/rubygems/test_gem_commands_owner_command.rb
 230 index 44652c1093..53cac4ce87 100644
 231 --- ruby-2.4.3/test/rubygems/test_gem_commands_owner_command.rb
 232 +++ ruby-2.4.3/test/rubygems/test_gem_commands_owner_command.rb
 233 @@ -43,6 +43,31 @@ def test_show_owners
 234      assert_match %r{- 4}, @ui.output
 235    end
 236
 237 +  def test_show_owners_dont_load_objects
 238 +    skip "testing a psych-only API" unless defined?(::Psych::DisallowedClass)
 239 +
 240 +    response = <<EOF
 241 +---
 242 +- email: !ruby/object:Object {}
 243 +  id: 1
 244 +  handle: user1
 245 +- email: user2@example.com
 246 +- id: 3
 247 +  handle: user3
 248 +- id: 4
 249 +EOF
 250 +
 251 +    @fetcher.data["#{Gem.host}/api/v1/gems/freewill/owners.yaml"] = [response, 200, 'OK']
 252 +
 253 +    assert_raises Psych::DisallowedClass do
 254 +      use_ui @ui do
 255 +        @cmd.show_owners("freewill")
 256 +      end
 257 +    end
 258 +
 259 +  end
 260 +
 261 +
 262    def test_show_owners_setting_up_host_through_env_var
 263      response = "- email: user1@example.com\n"
 264      host = "http://rubygems.example"
 265 diff --git test/rubygems/test_gem_package.rb test/rubygems/test_gem_package.rb
 266 index 9d47f0dea4..5b93475314 100644
 267 --- ruby-2.4.3/test/rubygems/test_gem_package.rb
 268 +++ ruby-2.4.3/test/rubygems/test_gem_package.rb
 269 @@ -455,6 +455,31 @@ def test_extract_tar_gz_symlink_relative_path
 270                   File.read(extracted)
 271    end
 272
 273 +  def test_extract_symlink_parent
 274 +   skip 'symlink not supported' if Gem.win_platform?
 275 +
 276 +   package = Gem::Package.new @gem
 277 +
 278 +   tgz_io = util_tar_gz do |tar|
 279 +     tar.mkdir       'lib',               0755
 280 +     tar.add_symlink 'lib/link', '../..', 0644
 281 +     tar.add_file    'lib/link/outside.txt', 0644 do |io| io.write 'hi' end
 282 +   end
 283 +
 284 +   # Extract into a subdirectory of @destination; if this test fails it writes
 285 +   # a file outside destination_subdir, but we want the file to remain inside
 286 +   # @destination so it will be cleaned up.
 287 +   destination_subdir = File.join @destination, 'subdir'
 288 +   FileUtils.mkdir_p destination_subdir
 289 +
 290 +   e = assert_raises Gem::Package::PathError do
 291 +     package.extract_tar_gz tgz_io, destination_subdir
 292 +   end
 293 +
 294 +   assert_equal("installing into parent path lib/link/outside.txt of " +
 295 +                 "#{destination_subdir} is not allowed", e.message)
 296 +  end
 297 +
 298    def test_extract_tar_gz_directory
 299      package = Gem::Package.new @gem
 300
 301 @@ -566,6 +591,21 @@ def test_install_location_relative
 302                   "#{@destination} is not allowed", e.message)
 303    end
 304
 305 +  def test_install_location_suffix
 306 +    package = Gem::Package.new @gem
 307 +
 308 +    filename = "../#{File.basename(@destination)}suffix.rb"
 309 +
 310 +    e = assert_raises Gem::Package::PathError do
 311 +      package.install_location filename, @destination
 312 +    end
 313 +
 314 +    parent = File.expand_path File.join @destination, filename
 315 +
 316 +    assert_equal("installing into parent path #{parent} of " +
 317 +                 "#{@destination} is not allowed", e.message)
 318 +  end
 319 +
 320    def test_load_spec
 321      entry = StringIO.new Gem.gzip @spec.to_yaml
 322      def entry.full_name() 'metadata.gz' end
 323 @@ -723,6 +763,32 @@ def test_verify_nonexistent
 324      assert_match %r%nonexistent.gem$%,           e.message
 325    end
 326
 327 +  def test_verify_duplicate_file
 328 +    FileUtils.mkdir_p 'lib'
 329 +    FileUtils.touch 'lib/code.rb'
 330 +
 331 +    build = Gem::Package.new @gem
 332 +    build.spec = @spec
 333 +    build.setup_signer
 334 +    open @gem, 'wb' do |gem_io|
 335 +      Gem::Package::TarWriter.new gem_io do |gem|
 336 +        build.add_metadata gem
 337 +        build.add_contents gem
 338 +
 339 +        gem.add_file_simple 'a.sig', 0444, 0
 340 +        gem.add_file_simple 'a.sig', 0444, 0
 341 +      end
 342 +    end
 343 +
 344 +    package = Gem::Package.new @gem
 345 +
 346 +    e = assert_raises Gem::Security::Exception do
 347 +      package.verify
 348 +    end
 349 +
 350 +    assert_equal 'duplicate files in the package: ("a.sig")', e.message
 351 +  end
 352 +
 353    def test_verify_security_policy
 354      skip 'openssl is missing' unless defined?(OpenSSL::SSL)
 355
 356 @@ -780,7 +846,13 @@ def test_verify_security_policy_checksum_missing
 357
 358          # write bogus data.tar.gz to foil signature
 359          bogus_data = Gem.gzip 'hello'
 360 -        gem.add_file_simple 'data.tar.gz', 0444, bogus_data.length do |io|
 361 +        fake_signer = Class.new do
 362 +          def digest_name; 'SHA512'; end
 363 +          def digest_algorithm; Digest(:SHA512); end
 364 +          def key; 'key'; end
 365 +          def sign(*); 'fake_sig'; end
 366 +        end
 367 +        gem.add_file_signed 'data2.tar.gz', 0444, fake_signer.new do |io|
 368            io.write bogus_data
 369          end
 370
 371 diff --git test/rubygems/test_gem_package_tar_header.rb test/rubygems/test_gem_package_tar_header.rb
 372 index d33877057d..43f508df45 100644
 373 --- ruby-2.4.3/test/rubygems/test_gem_package_tar_header.rb
 374 +++ ruby-2.4.3/test/rubygems/test_gem_package_tar_header.rb
 375 @@ -143,5 +143,26 @@ def test_update_checksum
 376      assert_equal '012467', @tar_header.checksum
 377    end
 378
 379 +  def test_from_bad_octal
 380 +    test_cases = [
 381 +      "00000006,44\000", # bogus character
 382 +      "00000006789\000", # non-octal digit
 383 +      "+0000001234\000", # positive sign
 384 +      "-0000001000\000", # negative sign
 385 +      "0x000123abc\000", # radix prefix
 386 +    ]
 387 +
 388 +    test_cases.each do |val|
 389 +      header_s = @tar_header.to_s
 390 +      # overwrite the size field
 391 +      header_s[124, 12] = val
 392 +      io = TempIO.new header_s
 393 +      assert_raises ArgumentError do
 394 +        new_header = Gem::Package::TarHeader.from io
 395 +      end
 396 +      io.close! if io.respond_to? :close!
 397 +    end
 398 +  end
 399 +
 400  end
 401
 402 diff --git test/rubygems/test_gem_server.rb test/rubygems/test_gem_server.rb
 403 index 4873fac5b6..96ed9194e9 100644
 404 --- ruby-2.4.3/test/rubygems/test_gem_server.rb
 405 +++ ruby-2.4.3/test/rubygems/test_gem_server.rb
 406 @@ -336,6 +336,171 @@ def test_root_gemdirs
 407      assert_match 'z 9', @res.body
 408    end
 409
 410 +
 411 +  def test_xss_homepage_fix_289313
 412 +    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
 413 +    dir = "#{@gemhome}2"
 414 +
 415 +    spec = util_spec 'xsshomepagegem', 1
 416 +    spec.homepage = "javascript:confirm(document.domain)"
 417 +
 418 +    specs_dir = File.join dir, 'specifications'
 419 +    FileUtils.mkdir_p specs_dir
 420 +
 421 +    open File.join(specs_dir, spec.spec_name), 'w' do |io|
 422 +      io.write spec.to_ruby
 423 +    end
 424 +
 425 +    server = Gem::Server.new dir, process_based_port, false
 426 +
 427 +    @req.parse data
 428 +
 429 +    server.root @req, @res
 430 +
 431 +    assert_equal 200, @res.status
 432 +    assert_match 'xsshomepagegem 1', @res.body
 433 +
 434 +    # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a
 435 +    # valid HTTP/HTTPS URL and could be unsafe in an HTML context.  We would prefer to throw an exception here,
 436 +    # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be
 437 +    # validated in future versions of Gem::Specification.
 438 +    #
 439 +    # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
 440 +    #
 441 +    # Variant #1 - rdoc not installed
 442 +    #
 443 +    #   <b>xsshomepagegem 1</b>
 444 +    #
 445 +    #
 446 +    #  <span title="rdoc not installed">[rdoc]</span>
 447 +    #
 448 +    #
 449 +    #
 450 +    #  <a href="." title=".">[www]</a>
 451 +    #
 452 +    # Variant #2 - rdoc installed
 453 +    #
 454 +    #   <b>xsshomepagegem 1</b>
 455 +    #
 456 +    #
 457 +    #  <a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>
 458 +    #
 459 +    #
 460 +    #
 461 +    #  <a href="." title=".">[www]</a>
 462 +    regex_match = /xsshomepagegem 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/xsshomepagegem-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="\." title="\.">\[www\]<\/a>/
 463 +    assert_match regex_match, @res.body
 464 +  end
 465 +
 466 +  def test_invalid_homepage
 467 +    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
 468 +    dir = "#{@gemhome}2"
 469 +
 470 +    spec = util_spec 'invalidhomepagegem', 1
 471 +    spec.homepage = "notavalidhomepageurl"
 472 +
 473 +    specs_dir = File.join dir, 'specifications'
 474 +    FileUtils.mkdir_p specs_dir
 475 +
 476 +    open File.join(specs_dir, spec.spec_name), 'w' do |io|
 477 +      io.write spec.to_ruby
 478 +    end
 479 +
 480 +    server = Gem::Server.new dir, process_based_port, false
 481 +
 482 +    @req.parse data
 483 +
 484 +    server.root @req, @res
 485 +
 486 +    assert_equal 200, @res.status
 487 +    assert_match 'invalidhomepagegem 1', @res.body
 488 +
 489 +    # This verifies that the homepage for this spec is not displayed and is set to ".", because it's not a
 490 +    # valid HTTP/HTTPS URL and could be unsafe in an HTML context.  We would prefer to throw an exception here,
 491 +    # but spec.homepage is currently free form and not currently required to be a URL, this behavior may be
 492 +    # validated in future versions of Gem::Specification.
 493 +    #
 494 +    # There are two variant we're checking here, one where rdoc is not present, and one where rdoc is present in the same regex:
 495 +    #
 496 +    # Variant #1 - rdoc not installed
 497 +    #
 498 +    #   <b>invalidhomepagegem 1</b>
 499 +    #
 500 +    #
 501 +    #  <span title="rdoc not installed">[rdoc]</span>
 502 +    #
 503 +    #
 504 +    #
 505 +    #  <a href="." title=".">[www]</a>
 506 +    #
 507 +    # Variant #2 - rdoc installed
 508 +    #
 509 +    #   <b>invalidhomepagegem 1</b>
 510 +    #
 511 +    #
 512 +    #  <a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>
 513 +    #
 514 +    #
 515 +    #
 516 +    #  <a href="." title=".">[www]</a>
 517 +    regex_match = /invalidhomepagegem 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/invalidhomepagegem-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="\." title="\.">\[www\]<\/a>/
 518 +    assert_match regex_match, @res.body
 519 +  end
 520 +
 521 +  def test_valid_homepage_http
 522 +    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
 523 +    dir = "#{@gemhome}2"
 524 +
 525 +    spec = util_spec 'validhomepagegemhttp', 1
 526 +    spec.homepage = "http://rubygems.org"
 527 +
 528 +    specs_dir = File.join dir, 'specifications'
 529 +    FileUtils.mkdir_p specs_dir
 530 +
 531 +    open File.join(specs_dir, spec.spec_name), 'w' do |io|
 532 +      io.write spec.to_ruby
 533 +    end
 534 +
 535 +    server = Gem::Server.new dir, process_based_port, false
 536 +
 537 +    @req.parse data
 538 +
 539 +    server.root @req, @res
 540 +
 541 +    assert_equal 200, @res.status
 542 +    assert_match 'validhomepagegemhttp 1', @res.body
 543 +
 544 +    regex_match = /validhomepagegemhttp 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttp-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="http:\/\/rubygems\.org" title="http:\/\/rubygems\.org">\[www\]<\/a>/
 545 +    assert_match regex_match, @res.body
 546 +  end
 547 +
 548 +  def test_valid_homepage_https
 549 +    data = StringIO.new "GET / HTTP/1.0\r\n\r\n"
 550 +    dir = "#{@gemhome}2"
 551 +
 552 +    spec = util_spec 'validhomepagegemhttps', 1
 553 +    spec.homepage = "https://rubygems.org"
 554 +
 555 +    specs_dir = File.join dir, 'specifications'
 556 +    FileUtils.mkdir_p specs_dir
 557 +
 558 +    open File.join(specs_dir, spec.spec_name), 'w' do |io|
 559 +      io.write spec.to_ruby
 560 +    end
 561 +
 562 +    server = Gem::Server.new dir, process_based_port, false
 563 +
 564 +    @req.parse data
 565 +
 566 +    server.root @req, @res
 567 +
 568 +    assert_equal 200, @res.status
 569 +    assert_match 'validhomepagegemhttps 1', @res.body
 570 +
 571 +    regex_match = /validhomepagegemhttps 1<\/b>[\n\s]+(<span title="rdoc not installed">\[rdoc\]<\/span>|<a href="\/doc_root\/validhomepagegemhttps-1\/">\[rdoc\]<\/a>)[\n\s]+<a href="https:\/\/rubygems\.org" title="https:\/\/rubygems\.org">\[www\]<\/a>/
 572 +    assert_match regex_match, @res.body
 573 +  end
 574 +
 575    def test_specs
 576      data = StringIO.new "GET /specs.#{Gem.marshal_version} HTTP/1.0\r\n\r\n"
 577      @req.parse data
 578 diff --git test/rubygems/test_gem_specification.rb test/rubygems/test_gem_specification.rb
 579 index 0fcc11e78f..1c68826fb3 100644
 580 --- ruby-2.4.3/test/rubygems/test_gem_specification.rb
 581 +++ ruby-2.4.3/test/rubygems/test_gem_specification.rb
 582 @@ -2890,7 +2890,22 @@ def test_validate_homepage
 583          @a1.validate
 584        end
 585
 586 -      assert_equal '"over at my cool site" is not a URI', e.message
 587 +      assert_equal '"over at my cool site" is not a valid HTTP URI', e.message
 588 +
 589 +      @a1.homepage = 'ftp://rubygems.org'
 590 +
 591 +      e = assert_raises Gem::InvalidSpecificationException do
 592 +        @a1.validate
 593 +      end
 594 +
 595 +      assert_equal '"ftp://rubygems.org" is not a valid HTTP URI', e.message
 596 +
 597 +      @a1.homepage = 'http://rubygems.org'
 598 +      assert_equal true, @a1.validate
 599 +
 600 +      @a1.homepage = 'https://rubygems.org'
 601 +      assert_equal true, @a1.validate
 602 +
 603      end
 604    end
 605