← Back to context

Comment by swiftcoder

7 hours ago

> In other words, if you publish a gem on RubyGems.org, you can execute arbitrary code on RubyDoc.info.

Shades of the build.rs problem. We really need sandboxed builds in every language ecosystem at this point.

4 comments

swiftcoder

Reply
evgenysokov  6 hours ago

The sandbox was already there, Rubydoc runs yard inside docker, the problem is that container still has network access

  • swiftcoder  6 hours ago

    Presumably the docker container has network access because something else in the build system requires it? I don't think sandboxing the entire build process is the right level of granularity here - one ideally wants to be able sandbox each package's build scripts individually.