Fix typo_squatting? false positive for rubygems.org itself

[ghost]

Description:

Correct typo_squatting behaviour to allow adding https://rubygems.org without triggering input

What was the end-user or developer problem that led to this PR?

AMI prebuilt using internal gem server + another scripted scenario for some of our builds which re-add https://rubygems.org

This triggers the prompt saying that https://rubygems.org is similar to https://rubygems.org which totally breaks the script due to a) No option to default -y b) Strict tty checks with no default which cause a failure and mean for horrible workarounds c) This specific issue which is independent but contributes to the overall problem.

What is your fix for the problem, implemented in this PR?

Ensure that correctly entered https://rubygems.org does not raise the result that it is similar, because it is not similar but identical and poses no issue with the desired effect (that stops folks accidentally configuring camped domains and getting supply chain attacks).

We do this by instead of using <= distrance_threshold (which also covers zero) by instead using a range check from 1..distance_threshold

---

Tasks:

• Describe the problem / feature
• Write tests
• Write code to solve the problem
• Get code review from coworkers / friends

I will abide by the code of conduct.

[welcome]

Thanks for opening a pull request and helping make RubyGems and Bundler better! Someone from the RubyGems team will take a look at your pull request shortly and leave any feedback. Please make sure that your pull request has tests for any changes or added functionality.

We use GitHub Actions to test and make sure your change works functionally and uses acceptable conventions, you can review the current progress of GitHub Actions in the PR status window below.

If you have any questions or concerns that you wish to ask, feel free to leave a comment in this PR or join our #rubygems or #bundler channel on Slack.

For more information about contributing to the RubyGems project feel free to review our CONTRIBUTING guide

[simi]

I do agree on handling this better than current state, but wouldn't be better to check if that source is already present and just warn nothing is happening since that source is already present (ant thus there's nothing to do)?

[sean-msmg]

The typo_squatting? check is hard-coded to rubygems.org, not based on existing sources. The bug means you can't clear out all sources then re-add rubygems.org

rubygems/lib/rubygems/commands/sources_command.rb

Line 67 in 6914b4e

if source.typo_squatting?("rubygems.org")

[ghost]

@simi this would be a workaround, I've tried to stay faithfully to ensuring the typo_squatting? method more accurately reflects what it was supposed to do as per the original case, which is to spot nearly identical but not identical matches and avoid folks becoming vulnerable to MITM/supply chain attacks.

There are a number of issues in working around it for us and this is only one of the defects really that should be raised against the current implementation. I chose the one that seemed to provide correctness in the single method implementation against the original driver.

[ghost]

The typo_squatting? check is hard-coded to rubygems.org, not based on existing sources. The bug means you can't clear out all sources then re-add rubygems.org

rubygems/lib/rubygems/commands/sources_command.rb

Line 67 in 6914b4e

if source.typo_squatting?("rubygems.org")

For clarity @simi this is what we have.

We have a cloud pipeline with servers built with configurations that already exclude https://rubygems.org in favour of our servers. We have some mechanisms for individual hosts that need to reset this on system build and this mechanism works fine with earlier versions of gem but we are trying to migrate forward to gem 3.x

[simi]

Thanks for additional info, that makes it clear.

PS: We should also support for -y or --force flag later as well to not block this quick fix.

[ghost]

Thanks for additional info, that makes it clear.

PS: We should also support for -y or --force flag later as well to not block this quick fix.

Thanks @simi , yes for the related impediments I was considering doing this also in a seperate PR.

[simi]

@andy-smith-msm I have created placeholder for followup - #3955.

[ghost]

@andy-smith-msm I have created placeholder for followup - #3955.

good stuff, I think this will also be really useful to us so I'll try to spend some time on this and quote #3955 in the commit ID

[deivid-rodriguez]

Looks good to me too!

[deivid-rodriguez]

Thanks for this @andy-smith-msm!