Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Security: Remove all traces of therubyracer from Rails #29276

Closed
SamSaffron opened this issue May 29, 2017 · 2 comments
Closed

Security: Remove all traces of therubyracer from Rails #29276

SamSaffron opened this issue May 29, 2017 · 2 comments

Comments

@SamSaffron
Copy link
Contributor

therubyracer is a relic, it depends on an ancient version of v8 that has multiple known security vulnerabilities

https://github.com/cowboyd/therubyracer/blob/master/therubyracer.gemspec#L20

In particular this is the equivalent of shipping a dependency to Chrome version 31.

Chrome 31 was released 2013-11-12

All places that talk about therubyracer or include it in templates should be replaced with mini_racer that depends on the most recent version of v8.

@SamSaffron
Copy link
Contributor Author

Only 4 spots, so changing this should be fairly easy:

https://github.com/rails/rails/search?utf8=%E2%9C%93&q=therubyracer&type=

@maclover7
Copy link
Contributor

@SamSaffron Can you open a PR, and then we can continue the discussion there? Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants