rubysec / ruby-advisory-db

A database of vulnerable Ruby Gems
https://rubysec.com
Other
1.01k stars 218 forks source link

How to handle OS-specific issues in a gem or ruby engine #186

Open reedloden opened 9 years ago

reedloden commented 9 years ago

We need a way to track operating system specific issues affecting a gem or ruby engine.

Here's one example:

While it affects cross-platform code, seems to only be exploitable on mingw32

Separately, looks like at least one Ruby developer disputes that this a security issue, so there's that to deal with as well.

Perhaps add an os field to the YAML format?

reedloden commented 9 years ago

or we could just change platform to be what rubygems actually considers platforms... java, x86-mingw32, x64-mingw32, linux, mswin, etc.

We'll change all jruby uses to java. I think that's the only case where we use platform right now.

The default platform is ruby, so we'll not require it in that case.