TechPrufer
Get started
Shopify
Shopify logoShopify · Feature trail

Ruby Dependency Security and Analysis

1 post · Jan 2022 – Oct 2022

What this trail covers

Shopify has evolved its Ruby Dependency Security initiatives, focusing on analyzing the relationships between Ruby packages and their dependencies to identify potential security vulnerabilities and improve the overall security posture of the Ruby ecosystem. This includes efforts related to Multi-Factor Authentication (MFA) rollout on RubyGems, dependency analysis to uncover indirect vulnerabilities, and the development of tools and visualizations to understand these relationships. This post details the resolution of a dependency confusion vulnerability across over 600 Ruby applications by developing tooling to automate lockfile format upgrades and collaborating with the Bundler team to improve dependency management safety.

All Shopify trails
  1. Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies - ShopifyThis post details an investigation into the dependency relationships between high-download Ruby packages (gems) and lower-download packages. The author explored direct dependencies using the RubyGems API and then all transitive dependencies using Bundler. The findings revealed that some high-download gems depend on lower-download gems, creating potential security loopholes. The post also describes the creation of dependency graphs using the 'graph' gem and a custom depth-first search algorithm to visualize these relationships and identify all paths from big gems to small gems.
  2. Fixing the Dependency Confusion Vulnerability in 600+ Ruby Apps - ShopifyDeveloped a Bundler plugin to automate the upgrade of Gemfile.lock to the new format without updating gem versions, minimizing regressions. Built a CLI tool on top of the CI system to manage repository environments, run commands, and open PRs for large-scale migrations. Collaborated with the Heroku Buildpack team to update their Ruby buildpack to support the latest Bundler version. Shared learnings with the Bundler team, contributing to improvements in Bundler's lockfile regeneration capabilities. Implemented changes to local environment tooling and CI to enforce the recommended Bundler version and prevent the installation of malicious gems.