Merge pull request #4667 from sonalkr132/platform-validation

Verify plaform before installing

(cherry picked from commit 3aeab0d)

Author: deivid-rodriguez

Manifest.txt

@@ -538,6 +538,7 @@ test/rubygems/invalidchild_cert.pem
 test/rubygems/invalidchild_cert_32.pem
 test/rubygems/invalidchild_key.pem
 test/rubygems/packages/ascii_binder-0.1.10.1.gem
+test/rubygems/packages/ill-formatted-platform-1.0.0.10.gem
 test/rubygems/plugin/exception/rubygems_plugin.rb
 test/rubygems/plugin/load/rubygems_plugin.rb
 test/rubygems/plugin/standarderror/rubygems_plugin.rb

lib/rubygems/installer.rb

@@ -728,6 +728,10 @@ def verify_spec
       raise Gem::InstallError, "#{spec} has an invalid extensions"
     end
 
+    if spec.platform.to_s =~ /\R/
+      raise Gem::InstallError, "#{spec.platform} is an invalid platform"
+    end
+
     unless spec.specification_version.to_s =~ /\A\d+\z/
       raise Gem::InstallError, "#{spec} has an invalid specification_version"
     end

test/rubygems/packages/ill-formatted-platform-1.0.0.10.gem

@@ -1776,6 +1776,26 @@ def spec.validate(*args); end
     end
   end
 
+  def test_pre_install_checks_malicious_platform_before_eval
+    gem_with_ill_formated_platform = File.expand_path("packages/ill-formatted-platform-1.0.0.10.gem", __dir__)
+
+    installer = Gem::Installer.at(
+      gem_with_ill_formated_platform,
+      :install_dir => @gem_home,
+      :user_install => false,
+      :force => true
+    )
+
+    use_ui @ui do
+      e = assert_raise Gem::InstallError do
+        installer.pre_install_checks
+      end
+
+      assert_equal "x86-mswin32\n system('id > /tmp/nyangawa')# is an invalid platform", e.message
+      assert_empty @ui.output
+    end
+  end
+
   def test_shebang
     installer = setup_base_installer