Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

Post by nightpool » Thu, Feb 18, 2021, 4:16 PM UTC

bslorence wrote: post #302

nightpool wrote: post #15

The article mentions that RubyGems is vulnerable to this, and that Shopify in particular downloaded and ran a gem named "shopify-cloud", but I'm curious as to how this is possible given a "normal" bundler pure-lockfile setup, or more generally the source-block directives I've seen in most Gemfiles. That is, given a Gemfile.lock like, e.g. GIT remote: https://github.com/thoughtbot/appraisal revision: 5675d17a95cfe904c…

If I'm reading bundler's docs rightly, the new 'source' syntax only appears to prevent this: https://bundler.io/man/gemfile.5.html#SOURCE-PRIORITY

I don't think this is correct—I read the earlier section of the docs ("Block Form Of Source, Git, Path, Group And Platforms") as saying that the block form is equivalent to the "source explicitly attached to the gem", the first priority item in your link

However, this section is concerning:

> The presence of a source block in a Gemfile also makes that source available as a possible global source for any other gems which do not specify explicit sources. Thus, when defining source blocks, it is recommended that you also ensure all other gems in the Gemfile are using explicit sources, either via source blocks or :source directives on individual gems.

Yikes! This is yet another easy footgun for people to reintroduce this issue

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies

Re: Dependency Confusion: How I Hacked Into Apple, Microsoft and Other Companies