gem 'gem_name', github: 'author/gem_name' produces insecure source URI

[vassilevsky]

Hello :)

I ran bundle-audit (https://github.com/rubysec/bundler-audit) against my app. It warned me about an insecure source URI for a gem. I examined my Gemfile and saw that I used the github: 'author/gem_name' option for this gem. As a result, Gemfile.lock had remote: git://github.com/author/gem_name.git. According to bundle-audit, it was insecure. I believe the corresponding check is here:

https://github.com/rubysec/bundler-audit/blob/master/lib/bundler/audit/scanner.rb#L72

I changed gem source to git: 'https://github.com/author/gem_name'. Ran bundle. The URI in Gemfile.lock changed to remote: https://github.com/inossidabile/wash_out. I ran bundle-audit again. All was clear.

Should I make changes to Bundler for it to use the secure URI by default?

Thanks!

[TimMoore]

Hi @vassilevsky. Thanks for your offer to change this. We already have this change made on the 2-0-dev branch (see https://github.com/bundler/bundler/blob/2-0-dev/lib/bundler/dsl.rb#L233) but we can't change it in the 1.x series, because it breaks backward compatibility. Specifically, changing the URL in the lock file can break some deployment scenarios.

You can search in this issue tracker for a more detailed discussion... this has come up several times before.

[vassilevsky]

Thank you for the info. I did search issues and found nothing. I think my search sillz ain't that mad :(

[simi]

@vassilevsky check 29fc6b5

[indirect]

@vassilevsky @simi I'm open to a pull request that adds a config flag to switch github to https, while we are waiting for 2.0 to be ready.

[TimMoore]

I think a config flag might be kind of a hassle, because it would be easy to end up with a mismatch between development and production (or different development machines for that matter).

Now that you can define custom git source shortcuts, you can override the definition in the Gemfile, which I think is a better way to do it. We might want to consider changing the default Gemfile template to include the https override by default.

[simi]

@TimMoore We are on the same page.

Something similar to example below on top of the Gemfile should solve your problem for now @vassilevsky.

git_source(:github) do |repo_name|
  repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/")
  opts["git"] = "https://github.com/#{repo_name}.git"
end

You can find more informations in documentation in "Custom git sources" and "Security" sections.

[TimMoore]

@vassilevsky here are some of the previous issues/pull requests where this has been discussed:

• Use smart http on :github dsl option #1820
• Use https:// instead of git:// on GitHub URL's #2569
• make the :github shorthand produce https urls #2859
• Change default github protocol in Gemfile via github_protocol DSL method #2872
• changing plain-git to https #2902

[weakish]

@simi Why opts["git"]? bundler.io/git.html just uses https// ....

[RobeDevOps]

I have my own gem repository. When I run bundle-audit I see this:

Insecure Source URI found: http://gems.vc.datys.cu/
Unpatched versions found!

how do I solved this ?

[indirect]

@RobeDevOps this isn't a support forum, and we don't make bundle-audit. Try Stack Overflow.

[vassilevsky]

I'm pretty sure that you need to change the line to:

source 'https://gems.vc.datys.cu/'