A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://github.com/oneclick/rubyinstaller2/issues/388 below:

Questions about automatic "system gemrc" file creation · Issue #388 · oneclick/rubyinstaller2 · GitHub

What problems are you experiencing?

No problems, but I was investigating an issue about the etc gem being activated too soon on Windows, and eventually run into some code in the operating_system.rb file shipped by RubyInstaller2 that automatically creates an empty "system gemrc" file if it does not exist already:

begin config_fname = Gem::ConfigFile::SYSTEM_WIDE_CONFIG_FILE unless File.exist?(config_fname) File.open(config_fname, File::CREAT | File::EXCL | File::WRONLY) do |fd| fd.write <<-EOT # This is the system wide config file for Rubygems. # It is generated by RubyInstaller as a security measure. # Feel free to add any rubygems config options as described on: # https://docs.ruby-lang.org/en/3.1/Gem/ConfigFile.html # But do not delete this file as otherwise it could be hijacked by # another user in a multi-user environment. --- {} EOT end end rescue => err warn RubyInstaller::Runtime::Colors.yellow("Warning: Failed to create a system wide 'gemrc' file, making Rubygems possibly insecure: #{err}") end

I got curious about the potential security issue. Does it affect more platforms other than Windows? The way I see it, system configuration is precisely intended for sharing a configuration with all users, so it's intended that a user with permissions to write files in Gem::ConfigFile::SYSTEM_WIDE_CONFIG_FILE can setup RubyGems configurations for all users. Also, it seems that the current implementation will still respect this global file if it's already there.

So I'm not fully clear about the security issue and I'm looking for a bit more insights.

Steps to reproduce

Create an empty Gemfile and observe that ruby -rbundler/setup -e 'puts Gem.loaded_specs["etc"]' activates the etc gem on Windows.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4