search

kshnurov / mandrill_dm

A basic Mandrill delivery method for Rails.
MIT License
46 stars 45 forks source link

use mandrill-api-json gem as it uses a patched version of json gem bu… #66

Closed brushbox closed 4 years ago

brushbox commented 4 years ago

…t is otherwise identical to mandrill-api gem

As per : https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ the json gem used is insecure. It is a dependency of the mandrill-api gem, which hasn't been updated in years.

There is a forked version mandrill-api-json which supports a patched version of json and is also available as a ruby gem. The only difference, other than the name, is the version of json supported.

brushbox commented 4 years ago

The build is failing on Ruby < 2.3 as the latest gem self-update require ruby >= 2.3.

I'm not familiar with that or Travis CI so I don't know how to fix it.

kshnurov commented 4 years ago

@brushbox thanks for the PR! Removing these 2 lines might work, I don't think they're needed anymore. Could you try?

brushbox commented 4 years ago

@kshnurov the build looks good now

spovich commented 4 years ago

@brushbox thanks for the PR! Looks good to me, but I didn't test it. I am no longer using Mandrill in any of my projects. @kshnurov if you are still actively using this, I'd be happy to transfer the repository over to you.

kshnurov commented 4 years ago

@brushbox great! @spovich yes, I'm using it, you can proceed with the transfer. What have you moved to and why?

spovich commented 4 years ago

@kshnurov I support lots of different legacy rails apps in my work. Some are with mailgun, postmark, sendgrid, etc. I no longer handle any apps with mandrill. So, I don't have any issues with mandrill, just not using it now. Thanks!

kshnurov commented 4 years ago

@spovich thank you!