Bundler < 2.2.10 has "Source Priority" vulnerability

[jaredbeck]

The developer was able to expose (in a non-malicious way) a vulnerability present in well-known dependency managers, where given a library name they will end up preferring installing it from a public source rather than from a private source.

Unfortunately, Bundler had this vulnerability.

The issue has been fixed in bundler 2.2.10
https://bundler.io/blog/2021/02/15/a-more-secure-bundler-we-fixed-our-source-priorities.html

AFAICT, this buildpack is currently using bundler 2.1.4 (BLESSED_BUNDLER_VERSIONS).

I know that a lot of care and thought goes into bundler upgrades. So, I'm not suggesting a specific course of action, but it is a vulnerability that concerns me.

[schneems]

Thanks!

[dentarg]

The use of Bundler 2.1.4 might hide missing require "set" in apps (rubygems/rubygems#4297, in Bundler 2.2.8 and above). I guess you could run into this on Heroku (when Heroku do use 2.2.x) and you update the Bundler version in your lockfile and deploy, without verifying locally that your app works. Just noting this here, as this issue looked a bit relevant to Heroku start using Bundler 2.2.x.

[schneems]

Thanks @dentarg it looks like that fix is merged. Is it in 2.2.11? I've staged 2.2.11 on main

[dentarg]

@schneems rubygems/rubygems#4297 is in Bundler 2.2.8 according to their release notes: https://github.com/rubygems/rubygems/releases/tag/bundler-v2.2.8

[dentarg]

I guess you could run into this on Heroku (when Heroku do use 2.2.x) and you update the Bundler version in your lockfile and deploy, without verifying locally that your app works.

Okay, I think it will be much easier to run into the problem (you rely on the set gem but haven't required it) than I said, as Heroku will now use Bundler 2.2.11 for any Bundler 2.x in the lockfile.

I guess there's the risk of apps not starting after the daily dyno cycling?

$ cd /tmp
$ touch Gemfile
$ chruby 2.7.2
$ bundle -v ; bundle e ruby -e 'Set'
Bundler version 1.17.3

$ bundle _2.1.4_ -v ; bundle _2.1.4_ e ruby -e 'Set'
Bundler version 2.1.4

$ bundle _2.2.11_ -v ; bundle _2.2.11_ e ruby -e 'Set'
Bundler version 2.2.11
Traceback (most recent call last):
-e:1:in `<main>': uninitialized constant Set (NameError)

[schneems]

Ahh, so the risk is people were previously relying on Set but not explicitly requiring it because that was being done by bundler.

People won't get bundler 2.2.11 unless they make a new deploy. In that case we boot the app for rake assets:precompile as well as most people run a release phase of rake db:migrate. Hopefully it will fail there where people can add the require before it hits runtime.

Another mitigating factor (for rails apps) is Rails does a blanket Bundler.require call so anything in the Gemfile is usually required.

[dentarg]

People won't get bundler 2.2.11 unless they make a new deploy

That's great and good to know 👍🏻