From d08735a9958c7acf2c5631041e8d97da5ffdaac5 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 01:05:01 +0000 Subject: [PATCH 1/2] Warn against running RDoc on untrusted codebases RDoc is not designed to process untrusted input safely. Plugins loaded through rdoc/discover.rb and RDoc::Task Rakefiles can run Ruby code. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FHNhuBcKpwab7T6MS4pS8T --- README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/README.md b/README.md index 861cec4235..40cf1b427e 100644 --- a/README.md +++ b/README.md @@ -221,6 +221,15 @@ rake rdoc:server - **Full cache invalidation.** Any file change clears all cached pages. This is simple and correct — rendering is fast (~ms per page), parsing is the expensive part and is done incrementally. - **No HTTPS or HTTP/2.** The server is intended for local development preview only. +## Security + +Do not run RDoc on a codebase that you do not trust. RDoc is not designed to process untrusted input safely. Some RDoc features can run code: + +- RDoc loads plugins from installed gems that provide `rdoc/discover.rb`. A plugin can run any Ruby code when RDoc starts. +- `rake rdoc` and other `RDoc::Task` tasks run the project's `Rakefile`, which is Ruby code. + +If you must generate documentation for an untrusted codebase, run RDoc in an isolated environment, such as a container with no access to secrets. + ## Bugs See [CONTRIBUTING.md](CONTRIBUTING.md) for information on filing a bug report. It's OK to file a bug report for anything you're having a problem with. If you can't figure out how to make RDoc produce the output you like that is probably a documentation bug. From 3b4d37765e75f3238e04cbaa023e582730031082 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 31 Oct 2026 06:41:34 +0000 Subject: [PATCH 2/2] Mention library use in security note RDoc's markup formatters pass raw HTML through, so applications that render untrusted markup must sanitize the output. Suggested by kou. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01FHNhuBcKpwab7T6MS4pS8T --- README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/README.md b/README.md index 40cf1b427e..4623e41d1b 100644 --- a/README.md +++ b/README.md @@ -230,6 +230,8 @@ Do not run RDoc on a codebase that you do not trust. RDoc is not designed to pro If you must generate documentation for an untrusted codebase, run RDoc in an isolated environment, such as a container with no access to secrets. +This applies to embedding RDoc as a library too. The markup formatters (such as `RDoc::Markup::ToHtml`) are not guaranteed to be safe on untrusted text, and raw HTML in the input is passed through without filtering. If your application renders markup submitted by untrusted users, sanitize the generated HTML and do not treat RDoc markup as a safe-by-default rendering path. + ## Bugs See [CONTRIBUTING.md](CONTRIBUTING.md) for information on filing a bug report. It's OK to file a bug report for anything you're having a problem with. If you can't figure out how to make RDoc produce the output you like that is probably a documentation bug.