CVE-2017-0899

@@ -10,7 +10,7 @@ module Gem::Text
   # Remove any non-printable characters and make the text suitable for
   # printing.
   def clean_text(text)
-    text.gsub(/[\u0000-\u0008\u000b-\u000c\u000e-\u001F\u007f]/, ".".freeze)
+    text.gsub(/[\000-\b\v-\f\016-\037\177]/, ".".freeze)
   end
 
   ##

@@ -132,8 +132,8 @@ def test_execute_details_cleans_text
     spec_fetcher do |fetcher|
       fetcher.spec 'a', 2 do |s|
         s.summary = 'This is a lot of text. ' * 4
-        s.authors = ["Abraham Lincoln \u0001", "\u0002 Hirohito"]
-        s.homepage = "http://a.example.com/\u0003"
+        s.authors = ["Abraham Lincoln \x01", "\x02 Hirohito"]
+        s.homepage = "http://a.example.com/\x03"
       end
 
       fetcher.legacy_platform

@@ -37,7 +37,7 @@ def test_format_text_trailing # for two spaces after .
   end
 
   def test_format_removes_nonprintable_characters
-    assert_equal "text with weird .. stuff", format_text("text with weird \u001b\u0002 stuff", 40)
+    assert_equal "text with weird .. stuff .", format_text("text with weird \x1b\x02 stuff \x7f", 40)
   end
 
   def test_min3

@@ -226,7 +226,7 @@ def output_versions output, versions
         end
       end
 
-      output << make_entry(matching_tuples, platforms)
+      output << clean_text(make_entry(matching_tuples, platforms))
     end
   end
 

@@ -6,13 +6,20 @@
 
 module Gem::Text
 
+  ##
+  # Remove any non-printable characters and make the text suitable for
+  # printing.
+  def clean_text(text)
+    text.gsub(/[\u0000-\u0008\u000b-\u000c\u000e-\u001F\u007f]/, ".".freeze)
+  end
+
   ##
   # Wraps +text+ to +wrap+ characters and optionally indents by +indent+
   # characters
 
   def format_text(text, wrap, indent=0)
     result = []
-    work = text.dup
+    work = clean_text(text)
 
     while work.length > wrap do
       if work =~ /^(.{0,#{wrap}})[ \n]/ then

@@ -116,6 +116,46 @@ def test_execute_details
     This is a lot of text. This is a lot of text. This is a lot of text.
     This is a lot of text.
 
+pl (1)
+    Platform: i386-linux
+    Author: A User
+    Homepage: http://example.com
+
+    this is a summary
+    EOF
+
+    assert_equal expected, @ui.output
+    assert_equal '', @ui.error
+  end
+
+  def test_execute_details_cleans_text
+    spec_fetcher do |fetcher|
+      fetcher.spec 'a', 2 do |s|
+        s.summary = 'This is a lot of text. ' * 4
+        s.authors = ["Abraham Lincoln \u0001", "\u0002 Hirohito"]
+        s.homepage = "http://a.example.com/\u0003"
+      end
+
+      fetcher.legacy_platform
+    end
+
+    @cmd.handle_options %w[-r -d]
+
+    use_ui @ui do
+      @cmd.execute
+    end
+
+    expected = <<-EOF
+
+*** REMOTE GEMS ***
+
+a (2)
+    Authors: Abraham Lincoln ., . Hirohito
+    Homepage: http://a.example.com/.
+
+    This is a lot of text. This is a lot of text. This is a lot of text.
+    This is a lot of text.
+
 pl (1)
     Platform: i386-linux
     Author: A User

@@ -36,6 +36,10 @@ def test_format_text_trailing # for two spaces after .
     assert_equal expected, format_text(text, 78)
   end
 
+  def test_format_removes_nonprintable_characters
+    assert_equal "text with weird .. stuff", format_text("text with weird \u001b\u0002 stuff", 40)
+  end
+
   def test_min3
     assert_equal 1, min3(1, 1, 1)
     assert_equal 1, min3(1, 1, 2)