rubygem-bundler/SOURCES/ruby-bundler-raise-error-in-dependency-confusion.patch

diff --git a/lib/bundler/definition.rb b/lib/bundler/definition.rb
index 8e56d4a9bc..c37946b46c 100644
--- a/lib/bundler/definition.rb
+++ b/lib/bundler/definition.rb
@@ -901,6 +901,8 @@ def source_requirements
       # Load all specs from remote sources
       index
 
+      validate_dependency_confusion! unless disable_dependency_confusion_check?
+
       # Record the specs available in each gem's source, so that those
       # specs will be available later when the resolver knows where to
       # look for that gemspec (or its dependencies)
@@ -980,5 +982,112 @@ def equivalent_rubygems_remotes?(source)
 
       Bundler.settings[:allow_deployment_source_credential_changes] && source.equivalent_remotes?(sources.rubygems_remotes)
     end
+
+    def validate_dependency_confusion!
+      # Continue if there is a scoped repository in the remote case.
+      return unless @remote && sources.non_global_rubygems_sources.size > 0
+
+      # Raise an error unless all the scope repositories implement the dependency API.
+      # When there is a non-dependency API scoped repository, we cannot get
+      # indirect dependencies used in a `Gemfile`.
+      unless sources.non_global_rubygems_sources.all?(&:dependency_api_available?)
+        non_api_sources = sources.non_global_rubygems_sources.reject(&:dependency_api_available?)
+        non_api_source_names_str = non_api_sources.map {|d| "  * #{d}" }.join("\n")
+
+        msg = String.new
+        msg << "Your Gemfile contains scoped sources that don't implement a dependency API, namely:\n\n"
+        msg << non_api_source_names_str
+        msg << "\n\nUsing the above gem servers may result in installing unexpected gems. " \
+          "To resolve this warning, make sure you use gem servers that implement dependency APIs, " \
+          "such as gemstash or geminabox gem servers."
+        raise_error_or_warn_dependency_confusion(msg)
+        return
+      end
+
+      indirect_dep_names = indirect_dependency_names_in_non_global_rubygems_soruces
+      # Get all the gem names from the index made from the default source.
+      # default_source_dep_names = @index.sources.select(&:default_source_used?).map(&:spec_names).flatten
+      # Get all the gem names from each source.
+      all_spec_names_list = @index.sources.map(&:spec_names)
+
+      # Only include the indirect dependency gems on the scoped sources that
+      # also exist on another source. The gems are included in more than 2
+      # sources (the own source + another source). If the gems don't exist on
+      # the another source, the dependency confusion doesn't happen.
+      indirect_dep_names.select! do |name|
+        source_num = all_spec_names_list.select {|all_names| all_names.include?(name) }
+        source_num.size >= 2
+      end
+
+      # Raise an error if there is an indirect dependency.
+      if indirect_dep_names.size > 0
+        dep_names_str = indirect_dep_names.join(", ")
+        source_names_str = sources.non_global_rubygems_sources.map {|d| "  * #{d}" }.join("\n")
+
+        msg = String.new
+        msg << "Your Gemfile contains implicit dependency gems #{dep_names_str} on the scoped sources, namely:\n\n"
+        msg << source_names_str
+        msg << "\n\nUsing implicit dependency gems on the above sources may result in installing unexpected gems. "
+        msg << "To suppress this message, make sure you set the gems explicitly in the Gemfile."
+        raise_error_or_warn_dependency_confusion(msg)
+        return
+      end
+    end
+
+    def raise_error_or_warn_dependency_confusion(msg)
+      if warn_on_dependnecy_confusion?
+        Bundler.ui.warn msg
+      else
+        msg = "#{msg} Or set the environment variable BUNDLE_WARN_ON_DEPENDENCY_CONFUSION."
+        raise SecurityError, msg
+      end
+    end
+
+    def indirect_dependency_names_in_non_global_rubygems_soruces
+      # Indirect dependency gem names
+      indirect_dep_names = []
+      # Direct dependency gem names
+      direct_dep_names = @dependencies.map(&:name)
+
+      sources.non_global_rubygems_sources.each do |s|
+        # If the non dependency API source is used, the `dependency_names`
+        # returns gems not only used in the `Gemfile`, but also returns ones
+        # existing in the scoped source too. This method shouldn't be used with
+        # the non dependency API sources.
+        s.specs.dependency_names.each do |dep_name|
+          # Exclude direct dependency gems.
+          next if direct_dep_names.include?(dep_name)
+
+          s.specs.local_search(dep_name).each do |spec|
+            # Debug gems with unexpected `spec.class`.
+            Bundler.ui.debug "Found dependency gem #{dep_name} (#{spec.class}) in scoped sources."
+            # StubSpecification extending RemoteSpecification: the gems by
+            #   `gem list`. Exclude the gems.
+            # EndpointSpecification: gems returned by dependency API such as
+            #   geminabox
+            # RemoteSpecification: gems returned by non dependency API such as
+            #   gem server. This method cannot be executed with the non
+            #   dependency API sources.
+            indirect_dep_names << dep_name if spec.class == EndpointSpecification
+          end
+        end
+      end
+
+      indirect_dep_names.sort.uniq
+    end
+
+    # Print a warning instead of raising an error when this option is enabled.
+    # Don't use Bundler.settings to minimize the difference to backport easily
+    # and avoid additional tests.
+    def warn_on_dependnecy_confusion?
+      @warn_on_dependnecy_confusion ||= ENV["BUNDLE_WARN_ON_DEPENDENCY_CONFUSION"]
+    end
+
+    # Disable the dependency confusion check when this option is enabled.
+    # The option can be used as a workaround if the check logic is problematic
+    # in a case such as a performance issue.
+    def disable_dependency_confusion_check?
+      @disable_dependnecy_confusion_check ||= ENV["BUNDLE_DISABLE_DEPENDENCY_CONFUSION_CHECK"]
+    end
   end
 end
diff --git a/lib/bundler/source/rubygems.rb b/lib/bundler/source/rubygems.rb
index 485b388a32..48a2ab736b 100644
--- a/lib/bundler/source/rubygems.rb
+++ b/lib/bundler/source/rubygems.rb
@@ -287,6 +287,10 @@ def dependency_names_to_double_check
         names
       end
 
+      def dependency_api_available?
+        api_fetchers.any?
+      end
+
     protected
 
       def credless_remotes
diff --git a/lib/bundler/source_list.rb b/lib/bundler/source_list.rb
index ac2adacb3d..37869878ce 100644
--- a/lib/bundler/source_list.rb
+++ b/lib/bundler/source_list.rb
@@ -64,6 +64,10 @@ def rubygems_sources
       @rubygems_sources + [default_source]
     end
 
+    def non_global_rubygems_sources
+      @rubygems_sources
+    end
+
     def rubygems_remotes
       rubygems_sources.map(&:remotes).flatten.uniq
     end