Lint your Gemfile! This will find common spelling mistakes in gems and remote sources so that you don't accidentally download code from places that you don't mean to. For example, if you have a Gemfile with the contents:
source "https://rubyems.org"
gem "rails"
gem "puma"
gem "pg"You might not be able to see the immediate issue, but there's a typo in your source declaration. While this will generally be harmless, as it will likely error, it's also possible that someone could register that domain and provide gems with modified content to execute their own code on your production system.
gemfilelint is a utility that you can run against your Gemfile that will check all of your listed sources against known trusted sources and all of your listed gems against the most commonly downloaded gems according to rubygems. This can give you some peace of mind that if you make a spelling mistake you won't accidentally open yourself up to RCE without knowing it.
Add this line to your application's Gemfile:
gem "gemfilelint"And then execute:
$ bundle install
Or install it yourself as:
$ gem install gemfilelint
Run the gemfilelint executable either in the root of your repository:
$ bundle exec gemfilelint
Or run the executable pointing to any number of gemfiles:
$ bundle exec gemfilelint gemfiles/*.gemfile
If you're receiving false positives because you're using a gem that is named similarly to a very popular gem, then you can pass the --ignore option to the CLI. This should be a comma-delimited list of gem names that should be ignored when linting. For example:
$ bundle exec gemfilelint --ignore rr
After checking out the repo, run bin/setup to install dependencies. Then, run rake test to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment.
To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/kddnewton/gemfilelint. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct.
The gem is available as open source under the terms of the MIT License.
Everyone interacting in the Gemfilelint project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.