Skip to content

Conversation

@stevenjackson
Copy link
Member

This feels kind of gross and a "where will it end" kind of situation.

For example, we could filter out begin, rescue, etc and it still wouldn't be enough for something like this:

      begin
        v = find_version_from_server
      rescue
        puts "something bad happened"
      ensure
        v = "1.0"
      end

      gem 'super-secret-internal', v

      def find_version_from_server
        class Finder < Other
          def initialize
            super
          end
        end
        Finder.go!
      end

I'm kind of ok with return UNKNOWN for Finder.go!, but I could imagine a version of this that defines a gem method and eval's it. But that would put a crimp on any future plans of hosting this tool since we'd be doing RCE all over the place.

We could also split "Gemfile" evaluation from "no Gemfile" evaluation, they're lumped together because it was easy, but maybe not prudent.

This feels kind of gross and a "where will it end" kind of situation.

For example we could filter out `begin`, `rescue`, etc and it still wouldn't
be enough for something like this:

```
      begin
        v = find_version_from_server
      rescue
        puts "something bad happened"
      ensure
        v = "1.0"
      end

      gem 'super-secret-internal', v

      def find_version_from_server
        class Finder < Other
          def initialize
            super
          end
        end
        Finder.go!
      end
```

I'm kind of ok with return UNKNOWN for `Finder.go!`, but I could imagine
a version of this that defines a `gem` method and eval's it.  But that
would put a crimp on any future plans of hosting this tool since we'd be
doing RCE all over the place.
@Daniel-N-Huss
Copy link
Collaborator

Taking the "where does it end" to an extreme, is there a world where instead of leaning on bundled versions, we utilize an abstract syntax tree to try plucking out evaluations we want to care about?

I'd imagine yagni applies more than anything, so I like what you've added in the changes here. I'd say lets take it gemfile by gemfile, and I'll look forward to arriving at the place where we need a better representation of parsing valid gem names.

Copy link
Collaborator

@Daniel-N-Huss Daniel-N-Huss left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "official" review now that I have write access!

@Daniel-N-Huss Daniel-N-Huss merged commit 3ad9e9e into main Aug 15, 2023
@Daniel-N-Huss Daniel-N-Huss deleted the more-parsing branch August 15, 2023 21:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants