Validate spec name before writing to the spec cache

lib/rubygems/source.rb

@@ -109,6 +109,13 @@ def fetch_spec(name_tuple)
 
     spec_file_name = name_tuple.spec_name
 
+    # The name tuple comes from a remote index and is not otherwise
+    # validated, so refuse anything that would escape the spec cache
+    # directory when used as a path component.
+    if File.basename(spec_file_name) != spec_file_name
+      raise Gem::Exception, "malformed spec name: #{spec_file_name.inspect}"
+    end
+
     source_uri = enforce_trailing_slash(uri) + "#{Gem::MARSHAL_SPEC_DIR}#{spec_file_name}"
 
     cache_dir = cache_dir source_uri

test/rubygems/test_gem_source.rb

@@ -121,6 +121,19 @@ def test_fetch_spec_platform_ruby
     assert_equal @specs["a-1"].full_name, spec.full_name
   end
 
+  def test_fetch_spec_path_traversal
+    escape = File.expand_path(File.join(Gem.spec_cache_dir, "..", "owned.gemspec"))
+
+    name_tuple = tuple("../owned", Gem::Version.new(1), "ruby")
+
+    e = assert_raise Gem::Exception do
+      @source.fetch_spec name_tuple
+    end
+
+    assert_includes e.message, "malformed spec name"
+    refute File.exist?(escape), "spec must not be written outside the spec cache"
+  end
+
   def test_load_specs
     released = @source.load_specs(:released).map(&:full_name)
     assert_equal %W[a-2 a-1 b-2], released