3 ms·
> In other words, if you publish a gem on RubyGems.org, you can execute arbitrary code on RubyDoc.info. Shades of the build.rs problem. We really need sandboxe
by swiftcoder 13d ago
> In other words, if you publish a gem on RubyGems.org, you can execute arbitrary code on RubyDoc.info.
Shades of the build.rs problem. We really need sandboxed builds in every language ecosystem at this point.
- evgenysokov 13d agoThe sandbox was already there, Rubydoc runs yard inside docker, the problem is that container still has network access
- swiftcoder 13d agoPresumably the docker container has network access because something else in the build system requires it? I don't think sandboxing the entire build process is the right level of granularity here - one ideally wants to be able sandbox each package's build scripts individually.
- chrisjj 13d agoSo, not a sandbox then.
- citizen204 13d ago[flagged]