[#114181] [Ruby master Bug#19767] [Not really a bug, but more a not ideal notification] "historical binary regexp match" when using the "n" modifier in a ruby regex — "rubyFeedback (robert heiler) via ruby-core" <ruby-core@...>
SXNzdWUgIzE5NzY3IGhhcyBiZWVuIHJlcG9ydGVkIGJ5IHJ1YnlGZWVkYmFjayAocm9iZXJ0IGhl
3 messages
2023/07/14
[ruby-core:114176] [Ruby master Feature#19630] [RFC] Deprecate `Kernel.open("|command-here")` due to frequent security issues
From:
"mdalessio (Mike Dalessio) via ruby-core" <ruby-core@...>
Date:
2023-07-14 01:51:24 UTC
List:
ruby-core #114176
Issue #19630 has been updated by mdalessio (Mike Dalessio).
@hsbt Do you think I should also deprecate pipe commends in `URI.open` as suggested in https://bugs.ruby-lang.org/issues/19723 ?
It seems like @matz may be encouraging this by saying "all open methods" above.
----------------------------------------
Feature #19630: [RFC] Deprecate `Kernel.open("|command-here")` due to frequent security issues
https://bugs.ruby-lang.org/issues/19630#change-103863
* Author: postmodern (Hal Brodigan)
* Status: Open
* Priority: Normal
----------------------------------------
`Kernel.open()` is the source of numerous [1] security [2] issues [3], due to the fact that it can be used to execute commands if given a String argument of the form `"|command-here"`. However, in most uses of `Kernel.open()` the developer appears to either want to open a local file, or if 'open-uri' was explicitly required open a remote URI. We should deprecate calling `Kernel.open()` with a `"|command-here"` style arguments, with a warning message instructing the developer to use `IO.popen()` instead. Eventually, support for `Kernel.open("|command-here")` could be removed completely, in favor of having the developer explicitly call `IO.popen()` or `URI.open()`.
[1]: https://45w1nkv.medium.com/ruby-code-vulnerability-analysis-confirmsnssubscription-rce-8a902d9afdd7
[2]: https://bishopfox.com/blog/ruby-vulnerabilities-exploits
[3]: https://blog.heroku.com/identifying-ruby-ftp-cve
--
https://bugs.ruby-lang.org/
______________________________________________
ruby-core mailing list -- [email protected]
To unsubscribe send an email to [email protected]
ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/