executables_db: avoid Formula#all
#135
Conversation
Instead, collect all formulae from their taps, then load them explicitly via `Formulary`. This should fix Homebrew#133.
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. |
|
Not stale. |
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. |
|
Not stale. |
lib/executables_db.rb
Outdated
|
|
||
| name = f.full_name | ||
| Tap.each do |tap| |
There was a problem hiding this comment.
@woodruffw Probably want to limit this to official taps only without --eval-all or just require --eval-all or HOMEBREW_EVAL_ALL to be passed to the relevant commands?
For context: the concern here is arbitrary Ruby execution from untrusted taps/formulae.
There was a problem hiding this comment.
Yeah, good call -- I'll have some time to update here in the coming days 🙂
There was a problem hiding this comment.
Thanks for the nudge, looking again today 😅
There was a problem hiding this comment.
brew which-update now takes --eval-all, which is disabled by default (meaning that, by default, only CoreTap.instance is used).
Signed-off-by: William Woodruff <[email protected]>
Signed-off-by: William Woodruff <[email protected]>
|
Thanks again @woodruffw! |
Instead, collect all formulae from their taps, then load them explicitly via
Formulary.This should fix #133.