Skip to content

Commit 1cd8d05

Browse files
committed
Use :git source when bundling Rails master.
As per http://bundler.io/git.html: > `http://` and `git://` URLs are insecure. A man-in-the-middle attacker > could tamper with the code as you check it out, and potentially supply > you with malicious code instead of the code you meant to check > out. Because the `:github` shortcut uses a `git://` URL in Bundler 1.x > versions, we recommend using using HTTPS URLs or overriding the > `:github` shortcut with your own HTTPS git source. Also, as Rails master (currently 5.0.0.alpha) has a dependency on Arel master (currently 7.0.0.alpha), we must pull this in too.
1 parent 41383ea commit 1cd8d05

File tree

1 file changed

+10
-9
lines changed

1 file changed

+10
-9
lines changed

Gemfile

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,12 +11,13 @@ platforms :jruby do
1111
end
1212

1313
version = ENV['RAILS_VERSION'] || 'default'
14-
rails = case version
15-
when 'master'
16-
{ github: 'rails/rails' }
17-
when 'default'
18-
'>= 4.2'
19-
else
20-
"~> #{version}"
21-
end
22-
gem 'rails', rails
14+
15+
case version
16+
when 'master'
17+
gem 'rails', { git: 'https://github.com/rails/rails.git' }
18+
gem 'arel', { git: 'https://github.com/rails/arel.git' }
19+
when 'default'
20+
gem 'rails', '>= 4.2'
21+
else
22+
gem 'rails', "~> #{version}"
23+
end

0 commit comments

Comments
 (0)