s-shemmee / ruby-101

A beginner's guide to Ruby programming. Start your journey with step-by-step tutorials, code examples, exercises, and resources. Let's code with Ruby!

A little more about me...

const s_shemmee = {
    bio: "Hey there! Shemmee here 👩🏻‍💻, a self-taught front-end developer passionate about UI/UX.",
    techStack: {
        languages: ["JavaScript", "TypeScript"],
        libraries: ["React", "Vue"],
        frameworks: ["Next.js", "Vite", "Bootstrap"],
        cssTools: ["SASS", "TailwindCSS", "Less"],
        deployment: ["Github Pages", "Firebase", "Vercel", "Netlify"],
    },
    designTools: ["Figma", "InVision", "Adobe XD", "Framer"],
    motto: "Keep it simple and stupid ✨",
};

Featured Projects

---

Always up for a chat about and geeking out on all things tech!💻<3

ruby-101's Issues

Deleted dependency detected

I'm a Cyber Security researcher and developer of PackjGuard [1] to address open-source software supply chain attacks.

Issue

During my research, I found that this repo is vulnerable to attack due to deleted dependency from the public RubyGems registry.

Details

Specifically, file Gemfile lists stock_quote as one of the dependencies. However, it has been deleted from public RubyGems. As such, an external bad actor can claim that name and register a malicious package, which will be then installed with gem install command, resulting in arbitrary remote code execution.

Impact

Not only your apps/services using https://github.com/s-shemmee/Ruby-101 repo code are vulnerable to this attack, but the users of your open-source Github repo could also fall victim.

You could read more about such attacks here: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Remediation

Please manually register a placeholder stock_quote package on RubyGems immediately or remove stock_quote dependency from Gemfile to fix this vulnerability.

To automatically fix such issues in future, please install PackjGuard Github app [1].

Thanks!

1. PackjGuard is a Github app that monitors your repos 24x7, detects vulnerable/malicious/risky open-source dependencies, and creates pull requests for auto remediation: https://github.com/marketplace/packjguard