> If you have YARD installed, and you install this gem, then YARD will load and run whatever is in ./script.rb from inside the gem.
How is that not a security issue in of itself?
> If you have YARD installed, and you install this gem, then YARD will load and run whatever is in ./script.rb from inside the gem.
How is that not a security issue in of itself?
A lot of packages for interpreted languages that use a C or Rust library (either for performance, or because it offers the functionality you want, so just wrap it in a $INTERP_LANG API that calls into it) will use packaging code execution to fall back to trying to compile code if there isn't a pre-existing artefact that was compiled for your version/arch/etc.
I'm most familiar with Python where you get tarred up source distributions that then execute setup.py, but more commonly, wheels, pre-built binaries which don't execute code upon install - and in my company, I've been able to advocate for the work needed to upgrade to a newer Python because available wheels don't support Ye Olde version of Python because a) sdists are a security risk and b) if you're trying to install a package that wants to compile C or Rust, suddenly you get to do the fun "install the the particular version of clang this thing needs, the Python header files, and then set the env vars for the compiler and linkers" dance that slows developers right down.
But then there's the JVM world, where JARs don't execute arbitrary code upon installation - and it's rather uncommon to have packages that call out to a C lib for performance, but you'll get some that wrap existing libraries for functionality like RocksDB.
I think it is common that in installing packages you have hooks to execute code anyway.
This should not be common.
It wouldn't help much. Why would you install a gem other than to run it? And if you run it, it can execute arbitary code.
What we need is actually sandboxed dev environments.
Many gems are used as imports by another program and are not directly run.
I am not sure why the norm for scripted gems/packages seems to be running code on install but it’s very insecure as a way to distribute dev dependencies.
The current situation is that you have to go out of your way with things like `pip install --only-binary`. There is a lot of implicit trust in developer tooling.