How to handle OS-specific issues in a gem or ruby engine

[reedloden]

We need a way to track operating system specific issues affecting a gem or ruby engine.

Here's one example:

• http://osvdb.org/show/osvdb/107478
• http://seclists.org/oss-sec/2014/q2/375
• https://bugs.ruby-lang.org/issues/9709

While it affects cross-platform code, seems to only be exploitable on mingw32

Separately, looks like at least one Ruby developer disputes that this a security issue, so there's that to deal with as well.

Perhaps add an os field to the YAML format?

[reedloden]

or we could just change platform to be what rubygems actually considers platforms...
java, x86-mingw32, x64-mingw32, linux, mswin, etc.

We'll change all jruby uses to java. I think that's the only case where we use platform right now.

The default platform is ruby, so we'll not require it in that case.

[jasnow]

Since www.osvdb.org is shutdown and no on Internet Archive, I found
another source: HERE

[jasnow]

@reedloden @rubysec/ecosystem @rubysec/maintainers - Anyone have a recent example?

[flavorjones]

@jasnow It's common for Nokogiri vulnerabilities to only affect either CRuby or JRuby. However, I think this is of relatively little value for the additional labor that will go into tracking this information.

[jasnow]

I will close this issue at COB today if we do not get any more comments.

[jasnow]

With no updates since 2015 and asking for recent evidence of these issues, I am closing this issue.
Reopen or create a new issue if you have new problems in this area.