Gemfile require option allows you to require any file

Describe the problem as clearly as you can

Within the Gemfile, you can do:

gem 'foo', require: ["foo", "foo/some/other/file/in/gem"]

This is useful if you want to automatically require some other entrypoint for the gem.

Today, I just realized that this simply passes the value to Kernel.require, which means you can require any file in the filesystem.

gem 'foo', require: ["/some/ruby/file/in/fs", "../../../some/other/file/relative/to/path"]

It seems intuitive if the files that you require in the gem directive are scoped to that gem. I'm not sure if this is a vulnerability since it's code that you own/written, but I think a little lockdown here would be good. Ideally, whatever is passed through to require: [...] is validated and appended to the gem's path. The validation would simply not allow a final (computed) path in require that is outside the gem's path.

Start with the Gemfile gem directive and trace how its require option reaches Kernel.require. Determine how the requested path should be validated against the gem's path, including absolute and relative paths; done means out-of-scope files are rejected while valid gem entrypoints still load.