CVE-2018-1000077: Improper Input Validation (CWE-20)
value: RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
CVSS v3 base score: 5.3
Published: 2018-03-13T15:29Z
Repository: https://github.com/rubygems/rubygems
Language: Ruby
Files changed: lib/rubygems/specification.rb, test/rubygems/test_gem_specification.rb
Commit date: 2018-02-15 22:19:03 -0800
Commit message: Enforce URL validation on spec homepage attribute

Diff: diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
index efc08c4738..be20cb9ea5 100644
--- a/lib/rubygems/specification.rb
+++ b/lib/rubygems/specification.rb
@@ -13,10 +13,11 @@
 require 'rubygems/deprecate'
 require 'rubygems/basic_specification'
 require 'rubygems/stub_specification'
 require 'rubygems/util/list'
 require 'stringio'
+require 'uri'
 
 ##
 # The Specification class contains the information for a Gem.  Typically
 # defined in a .gemspec file or a Rakefile, and looks like this:
 #
@@ -2820,14 +2821,20 @@ def validate packaging = true
 
     if summary =~ /FI XME|TO DO/x then
       raise Gem::InvalidSpecificationException, "#{lazy} is not a summary"
     end
 
-    if homepage and not homepage.empty? and
-       homepage !~ /\A[a-z][a-z\d+.-]*:/i then
-      raise Gem::InvalidSpecificationException,
-            "\"#{homepage}\" is not a URI"
+    # Make sure a homepage is valid HTTP/HTTPS URI
+    if homepage and not homepage.empty?
+      begin
+        homepage_uri = URI.parse(homepage)
+        unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
+          raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a URI"
+        end
+      rescue URI::InvalidURIError
+        raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a URI"
+      end
     end
 
     # Warnings
 
     %w[author homepage summary files].each do |attribute|
diff --git a/test/rubygems/test_gem_specification.rb b/test/rubygems/test_gem_specification.rb
index b1087c9f59..600e74cc5f 100644
--- a/test/rubygems/test_gem_specification.rb
+++ b/test/rubygems/test_gem_specification.rb
@@ -2885,10 +2885,23 @@ def test_validate_homepage
       e = assert_raises Gem::InvalidSpecificationException do
         @a1.validate
       end
 
       assert_equal '"over at my cool site" is not a URI', e.message
+
+      @a1.homepage = 'ftp://rubygems.org'
+
+      e = assert_raises Gem::InvalidSpecificationException do
+        @a1.validate
+      end
+
+      assert_equal '"ftp://rubygems.org" is not a URI', e.message
+
+      @a1.homepage = 'http://rubygems.org'
+
+      assert_equal true, @a1.validate
+
     end
   end
 
   def test_validate_license
     util_setup_validate

Vulnerable code:     if homepage and not homepage.empty? and
       homepage !~ /\A[a-z][a-z\d+.-]*:/i then
      raise Gem::InvalidSpecificationException,
            "\"#{homepage}\" is not a URI"
Fixed code: require 'uri'
    # Make sure a homepage is valid HTTP/HTTPS URI
    if homepage and not homepage.empty?
      begin
        homepage_uri = URI.parse(homepage)
        unless [URI::HTTP, URI::HTTPS].member? homepage_uri.class
          raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a URI"
        end
      rescue URI::InvalidURIError
        raise Gem::InvalidSpecificationException, "\"#{homepage}\" is not a URI"
      end

      @a1.homepage = 'ftp://rubygems.org'

      e = assert_raises Gem::InvalidSpecificationException do
        @a1.validate
      end

      assert_equal '"ftp://rubygems.org" is not a URI', e.message

      @a1.homepage = 'http://rubygems.org'

      assert_equal true, @a1.validate