Remove Rope entirely due to security issues

[jorgenschaefer]

The Rope library is barely maintained and now has security issues:

https://nvd.nist.gov/vuln/detail/CVE-2014-3539

Elpy already only uses Rope minimally for refactoring these days, but in light of the lack of maintenance, it might be a good idea to get rid of it entirely?

[galaunay]

I never really used it so I am not opposed to removing it.
Should not be too tricky to do.

[sten0]

When was the CVE made public? Some time in 2014? It was patched Thu, 26 Jan 2017 14:04:41 +0900 in Debian, and the general consensus of security minded folks seems to be that pickle is terrible and should never be used, and anything that uses pickle ought to be shunned. SUSE and some other distributions fixed it incredibly quickly back in 2015 though! Also, upstream Rope only fixed the CVE Wed Aug 8 11:10:45 2018 -0700 and cited the wrong CVE number in the commit message... Was it fixed in Pypi or were macOS users exposed until last month?

[jorgenschaefer]

From the CVE page:

NVD Published Date:
04/06/2018

Thanks for noting Rope patched the problem. Apparently, upgrading Rope to a newer version fixes Github nagging about it. But Rope for Python3 has not been updated in ages, and most likely suffers from the same issue?

[sten0]

From the CVE page:

NVD Published Date:
04/06/2018

Oh my...many (most?) users were unpatched for four years. It's also very strange that there was such a huge lag between the RedHat-identification of the issue and the CVE...

https://bugzilla.redhat.com/show_bug.cgi?id=1116485
python-rope/rope#107

Thanks for noting Rope patched the problem. Apparently, upgrading Rope to a newer version fixes > > Github nagging about it. But Rope for Python3 has not been updated in ages, and most likely suffers > from the same issue?

Sorry, I don't know if the Python3 variant was fixed. In principle I believe an upstream that leaves a critical remote vulnerability that doesn't require a user-initiated trigger unpatched for four years should be dropped...

[sten0]

@galaunay whatever happened to this issue? I was surprised to learn that Rope was still part of Elpy when a Debian user (who submits patches, so maybe developer!) submitted this bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=940660

@jorgenschaefer wrote "I can not in good conscience recommend to use rope at all." at #1518 (comment), so it seems like the only thing delaying its release is the loss of code refactoring functionality.

Sadly Jedi does not yet provide a solution from what I've read, but here's what looks like a promising alternative: https://github.com/facebookincubator/Bowler

[galaunay]

I barely use refactoring in Elpy, so I don't know how bad it is.
But I made some quick tests just now, and it seems to do a decent job (for simple stuff at least).
We also didn't had any reported issues regarding rope in ages (which may or may not be an indicator of rope working well...).

I just didn't wanted to remove rope without something to replace it.
So we could go for bowler, but it require a decent amount of work, and may not happen soon...
Redbaron may be an alternative, with the advantage of already having an emacs package: redbaron4emacs ?