Keep lockfile parsing from loading Bundler source plugins

A PLUGIN SOURCE section sends Bundler::Plugin.from_lock looking for the
plugin that handles it, and finding one loads and runs that plugin's
`plugins.rb`. The plugin index is read from the lockfile directory, so a
repository could run code just by being installed from with
`gem install -g`. Nothing here can use a plugin source anyway.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: hsbt

lib/rubygems/request_set.rb

@@ -348,6 +348,14 @@ def load_lockfile(lock_file) # :nodoc:
     Bundler.instance_variable_set(:@root, Pathname.new(File.expand_path(File.dirname(lock_file))))
     root_swapped = true
 
+    # A PLUGIN SOURCE section otherwise sends Bundler::Plugin.from_lock looking
+    # for the plugin that handles it, which loads and runs that plugin's
+    # `plugins.rb`. Nothing here can use a plugin source anyway, so borrow the
+    # flag Bundler itself uses to keep lockfile parsing inert.
+    previous_gemfile_parse = Bundler::Plugin.instance_variable_get(:@gemfile_parse)
+    Bundler::Plugin.instance_variable_set(:@gemfile_parse, true)
+    gemfile_parse_swapped = true
+
     parser = Bundler::LockfileParser.new(File.read(lock_file), lockfile_path: lock_file)
 
     locked_versions = {}
@@ -410,6 +418,7 @@ def load_lockfile(lock_file) # :nodoc:
     end
   ensure
     Bundler.instance_variable_set(:@root, previous_root) if root_swapped
+    Bundler::Plugin.instance_variable_set(:@gemfile_parse, previous_gemfile_parse) if gemfile_parse_swapped
   end
 
   def pretty_print(q) # :nodoc:

test/rubygems/test_gem_request_set.rb

@@ -549,6 +549,69 @@ def test_load_gemdeps_with_lockfile_path_section_newer_than_lockfile
     assert_equal %w[a-2], vendor_set.find_all(dep("a", "= 2")).map(&:full_name)
   end
 
+  def test_load_lockfile_does_not_load_plugins_for_a_plugin_source_section
+    require "bundler"
+    require "bundler/plugin"
+
+    plugin = File.join @tempdir, ".bundle", "plugin", "plugins", "example"
+    loaded = File.join @tempdir, "plugin-was-loaded"
+
+    FileUtils.mkdir_p File.join(plugin, "lib")
+
+    File.open File.join(@tempdir, "Gemfile"), "w" do |io|
+      io.puts 'source "https://rubygems.org"'
+    end
+
+    File.open File.join(plugin, "plugins.rb"), "w" do |io|
+      io.puts "File.write #{loaded.dump}, \"loaded\""
+      io.puts "class ExampleSource"
+      io.puts "  include Bundler::Plugin::API::Source"
+      io.puts "end"
+      io.puts 'Bundler::Plugin::API.source("example_type", ExampleSource)'
+    end
+
+    File.open File.join(@tempdir, ".bundle", "plugin", "index"), "w" do |io|
+      io.puts <<~INDEX
+        ---
+        commands:
+        hooks:
+        load_paths:
+          example:
+          - plugins/example/lib
+        plugin_paths:
+          example: plugins/example
+        sources:
+          example_type: example
+      INDEX
+    end
+
+    File.open "gem.deps.rb.lock", "w" do |io|
+      io.puts <<~LOCKFILE
+        PLUGIN SOURCE
+          remote: https://gems.example/
+          type: example_type
+          specs:
+            a (1)
+
+        PLATFORMS
+          #{Gem::Platform::RUBY}
+
+        DEPENDENCIES
+          a!
+      LOCKFILE
+    end
+
+    Bundler::Plugin.reset!
+
+    rs = Gem::RequestSet.new
+    rs.load_lockfile "gem.deps.rb.lock"
+
+    assert_path_not_exist loaded
+    assert_equal [dep("a")], rs.dependencies
+  ensure
+    Bundler::Plugin.reset!
+  end
+
   def test_load_lockfile_keeps_bundler_root_when_it_cannot_be_swapped
     require "bundler"