Wpscan: bundle install should not use sudo

[erwanlr]

As mentioned by bundler itself, sudo should not be used

Don't run Bundler as root. Bundler can ask for sudo if it is needed, and
installing your bundle as root will break this application for all non-root
users on this machine.

In our readme, we use it: sudo gem install bundler && sudo bundle install --without test
I think even a sudo something && other-thing will run otherthing as sudo, isn't it ?

The readme should be checked for the need (or not, it may depends on the OS) of the sudo command for bundle install

[FireFart]

I think even a sudo something && other-thing will run otherthing as sudo, isn't it ?:

Nope:

firefart@mint ~/coding $ sudo id && id
uid=0(root) gid=0(root) groups=0(root)
uid=1000(firefart) gid=1000(firefart) groups=1000(firefart),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lpadmin),110(sambashare)

[erwanlr]

Yea, got tricked as he was already logged as root to run the command xD

Nonetheless, there is the sudo for bundle install in the Mac OSX Instructions from the readme: https://github.com/wpscanteam/wpscan/blob/master/README#L88

[FireFart]

You need the sudo in some cases:
If you are using RVM, your GEMs are installed in your home folder. If you use the ruby shipped with OSX, you need sudo because the files are installed in some system directories.
I also added a general RVM installation Instruction for this case
https://github.com/wpscanteam/wpscan/blob/master/README#L90

Mayve be should prefer the RVM installation and move the instruction to the top and mention that it is the prefered installation method?

[erwanlr]

My bad then, over-reacted :D

Dunno about moving the RVM intructions on top :x

[synthead]

Bundler seems to silently leverage my local sudo privileges to install (untracked) files globally, which is very, very bad. I now have loads of executables in /usr/bin that are not tracked via my package manager. Not a fun thing to find at random, and I have to take the time to clean this up.

At the very least, Bundler should ask before using sudo privileges. Personally, I want it to never use sudo privileges at any time, so the fact that it does this without permission is a huge miss.

[koertkuipers]

i too was shocked when i innocently played around with bundler and i found out afterwards it silently used my sudo to install things in the system. that is unacceptable.