[#100689] [Ruby master Feature#17303] Make webrick to bundled gems or remove from stdlib — hsbt@...
Issue #17303 has been reported by hsbt (Hiroshi SHIBATA).
11 messages
2020/11/02
[#100852] [Ruby master Feature#17326] Add Kernel#must! to the standard library — zimmerman.jake@...
Issue #17326 has been reported by jez (Jake Zimmerman).
24 messages
2020/11/14
[#100930] [Ruby master Feature#17333] Enumerable#many? — masafumi.o1988@...
Issue #17333 has been reported by okuramasafumi (Masafumi OKURA).
10 messages
2020/11/18
[#101071] [Ruby master Feature#17342] Hash#fetch_set — hunter_spawn@...
Issue #17342 has been reported by MaxLap (Maxime Lapointe).
26 messages
2020/11/25
[ruby-core:100693] [Ruby master Feature#17303] Make webrick to bundled gems or remove from stdlib
From:
merch-redmine@...
Date:
2020-11-02 17:04:12 UTC
List:
ruby-core #100693
Issue #17303 has been updated by jeremyevans0 (Jeremy Evans). I am in favor of this change. I prefer removing webrick from stdlib, as otherwise we are still likely to be shipping vulnerable code if there is a security issue in webrick. Moving webrick from default gems to bundled gems doesn't change much security wise, other than making it slightly more difficult to use an separately installed webrick gem. ---------------------------------------- Feature #17303: Make webrick to bundled gems or remove from stdlib https://bugs.ruby-lang.org/issues/17303#change-88333 * Author: hsbt (Hiroshi SHIBATA) * Status: Open * Priority: Normal * Assignee: hsbt (Hiroshi SHIBATA) ---------------------------------------- I propose to make webrick to bundled gems or remove from stdlib of ruby. We have a several issues related vulnerabilities in webrick gem. https://www.ruby-lang.org/en/news/2020/09/29/http-request-smuggling-cve-2020-25613/ The ruby core team don't have enough time to handle them. We should remove webrick from default gems at least. Patch for this feature: https://github.com/ruby/ruby/pull/3729 -- https://bugs.ruby-lang.org/ Unsubscribe: <mailto:[email protected]?subject=unsubscribe> <http://lists.ruby-lang.org/cgi-bin/mailman/options/ruby-core>