T429821 | New addition to Hall of Fame, dependency updates

Overview

This project is in response to https://phabricator.wikimedia.org/T429821, a request to addition to the Security Hall of Fame. When testing locally, I found that some dependencies had moved, so I updated the Gemfile

Dependency updates

These gems used to be loaded from the standard library, but no longer are. You get errors like these:

bundle exec jekyll build -d public_html/
/opt/homebrew/lib/ruby/gems/4.0.0/gems/jekyll-4.1.1/lib/jekyll.rb:28: warning: csv used to be loaded from the standard library, but is not part of the default gems since Ruby 3.4.0.


You can add csv to your Gemfile or gemspec to fix this error.
bundler: failed to load command: jekyll (/opt/homebrew/lib/ruby/gems/4.0.0/bin/jekyll)

rscout@wmf3868 security-landing-page % bundle exec jekyll build -d public_html/
/opt/homebrew/lib/ruby/gems/4.0.0/gems/safe_yaml-1.0.5/lib/safe_yaml/transform.rb:1: warning: base64 used to be loaded from the standard library, but is not part of the default gems since Ruby 3.4.0.


You can add base64 to your Gemfile or gemspec to fix this error.
bundler: failed to load command: jekyll (/opt/homebrew/lib/ruby/gems/4.0.0/bin/jekyll)
/opt/homebrew/Cellar/ruby/4.0.5/lib/ruby/4.0.0/bundled_gems.rb:60:in 'Kernel.require': cannot load such file -- base64 (LoadError)

Since we're just using Jekyll to compile static HTML, I didn't go real deep in to the packages, but did ask Claude Opus 4.6 High to take a look from a security standpoint:

\>>>Please take a look at the gems for base64, csv, and bigdecimal. Take a look for obvious security concerns in the gems, particularly things that would send information outside or allow an attacker to takeover or gain access.

I'll locate these gems and examine their source. Let me start by finding where they're installed.

Searched for 1 pattern, listed 1 directory, ran 4 shell commands

These are the standard Ruby-bundled gems (symlinked from Homebrew's Ruby 4.0.5). Let me read the actual source.

Ran 1 shell command

I'll examine each gem for security concerns. Let me read the key source files and scan for risky patterns.

Read 1 file, ran 1 shell command

base64 is clean — it's pure pack/unpack wrappers, no I/O, no network, no eval. Let me scan csv and bigdecimal properly (my grep broke on a backtick).

Read 1 file, ran 2 shell commands

I reviewed all three. They're the official Ruby default gems (symlinked from Homebrew's Ruby 4.0.5 Cellar), not third-party packages. No security concerns of the kind you described.

base64 (0.3.0) — lib/base64.rb only. Pure thin wrappers around Array#pack/String#unpack ("m"/"m0"). No network, file, exec, or eval. Clean.

csv (3.3.5) — pure Ruby (csv.rb, parser.rb, writer.rb, row.rb, table.rb, etc.). No sockets, Net::, open-uri, eval, system/exec, Marshal, or YAML. It reads/writes whatever IO you hand it; it never opens connections or files on its own. Clean.

bigdecimal (4.1.2) — C extension plus Ruby helpers. The only matches to risky patterns are benign:

• extconf.rb:59 reads ENV['BIGDECIMAL_USE_VP_TEST_METHODS'] — a build-time test-method toggle; standard mkmf config only (no exec, no download).
• Remaining hits are comments (JSON docs, Kernel.BigDecimal references).

No exfiltration, no remote access, no code-execution sinks in any of the three: nothing opens a socket/HTTP connection, spawns processes, evals strings, or deserialises untrusted data. Two general caveats (inherent library behavi- Base64.decode64 silently ignores invalid cse strict_decode64 when you need to rejectmalformed input.- bigdecimal's heavy lifting is in compiled it for the patterns above but did not auditit for memory-safety bugs (buffer overflows,, say so and I'll dig into the C.One provenance note worth flagging for your ymlinks into/opt/homebrew/Cellar/ruby/4.0.5/.... The intn your Homebrew Ruby install, not on Bundlerhaving verified a checksum. If supply-chain y against ruby -e "require 'digest'" checksums or the upstream ruby/bigdecimal, rtags.

Actual changes

I added two entries for the reporter's contributions and placed them in the chronological locations.

The reporter asked if we could use their native script, but does provide an alternative if not permitted. It seems to render fine, so I went with it.

I compiled the static pages with Jekyll.

Testing Evidence

Using Jekyll serve, I tested the site locally. I also clicked each link to make sure they opened (tabs along top).

Bug: T429821