EICAR 0.0.3 → 0.0.4
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +8 -8
- data/README.md +12 -0
- data/lib/eicar.rb +53 -11
- data/lib/eicar/version.rb +5 -1
- metadata +3 -2
checksums.yaml
CHANGED
@@ -1,15 +1,15 @@
|
|
1
1
|
---
|
2
2
|
!binary "U0hBMQ==":
|
3
3
|
metadata.gz: !binary |-
|
4
|
-
|
4
|
+
Njk4MjNmNDE3MTE5ZWRmMDA1ZjBmZDhlMmVkZDk5N2I2ZDIyNTRkNA==
|
5
5
|
data.tar.gz: !binary |-
|
6
|
-
|
6
|
+
ZTY0Y2M3YWY3MDExNzU2MjFlMTcxZmFkNzM0NzYzZTZmZjYwYjgwYw==
|
7
7
|
SHA512:
|
8
8
|
metadata.gz: !binary |-
|
9
|
-
|
10
|
-
|
11
|
-
|
9
|
+
NmViZmIxNmRjMWY5ZGI0ZTg0MGIzYTVhY2E3YjBkZGRjZDIwNGZkMjE2NDgw
|
10
|
+
NjA1MzFlNWY1Yzk5MzgxOTE1MWNkNGFmZDcxMjFmMDAwNmQ5MzU2NGNkNjcy
|
11
|
+
OTAzNzBjMTJmOWVkNWYxNTViYTljMTVhMTcxYjg3ZjgwODYzNzI=
|
12
12
|
data.tar.gz: !binary |-
|
13
|
-
|
14
|
-
|
15
|
-
|
13
|
+
ZmY2ZmM1ZmNlNDBmMzdhMjczYzQ3MTY0OWFiNjQzYmQ2N2QwMDNmMjkyYmYz
|
14
|
+
NmFjZDdkYTY0N2QxMGIzMTBhMDgxMTVjYmNlNjBjNjRiYWRmODY3NzI4ZGM2
|
15
|
+
ZDAzMzY5NzNhNzEzYzRmYWM5MDNmYWMwZjQ3Y2ZiZDlhMTZjODQ=
|
data/README.md
CHANGED
@@ -43,6 +43,18 @@ end
|
|
43
43
|
puts "A/V is active in #{ENV['GEM_HOME']}."
|
44
44
|
````
|
45
45
|
|
46
|
+
You can also write the EICAR test file to any given target directory
|
47
|
+
with this gem. For example:
|
48
|
+
|
49
|
+
````ruby
|
50
|
+
EICAR.create # Creates the EICAR test file in the default GEM_HOME location
|
51
|
+
EICAR.create "/tmp/foo.exe" # Writes to an arbitrary path
|
52
|
+
````
|
53
|
+
|
54
|
+
This can be useful for spot-checking A/V coverage on a per directory or
|
55
|
+
per filesystem basis (eg, across SMB shares).
|
56
|
+
|
57
|
+
|
46
58
|
Expected Results
|
47
59
|
================
|
48
60
|
|
data/lib/eicar.rb
CHANGED
@@ -1,29 +1,48 @@
|
|
1
1
|
require 'eicar/version'
|
2
2
|
|
3
|
+
# The EICAR mixin. It's quite useful for EICAR things.
|
3
4
|
module EICAR
|
4
5
|
|
5
|
-
#
|
6
|
+
# This is the EICAR test string, obfuscated as a downcased, ROT13
|
7
|
+
# string. Antivirus should /not/ pick this up, ever, since it's out of
|
8
|
+
# spec to try to decode it.
|
9
|
+
#
|
6
10
|
ROT13_DOWNCASE_EICAR = "k5b!c%@nc[4cmk54(c^)7pp)7}$rvpne-fgnaqneq-nagvivehf-grfg-svyr!$u+u*"
|
7
11
|
|
12
|
+
# @return [String] The library/gem version.
|
13
|
+
#
|
8
14
|
def self.version
|
9
15
|
EICAR::VERSION
|
10
16
|
end
|
11
17
|
|
18
|
+
# A generic Error class.
|
19
|
+
#
|
12
20
|
class Error < StandardError
|
13
21
|
end
|
14
22
|
|
23
|
+
# Raised when there's a problem with reading the EICAR file.
|
24
|
+
#
|
15
25
|
class EICARReadError < Error
|
16
26
|
end
|
17
27
|
|
28
|
+
# Raised when there's a problem with writing the EICAR file.
|
29
|
+
#
|
18
30
|
class EICARWriteError < Error
|
19
31
|
end
|
20
32
|
|
33
|
+
# The default path for the EICAR test file. Usually, it will be in the
|
34
|
+
# bin path of your GEM_HOME
|
35
|
+
# @return [String] the full path of the EICAR test file
|
36
|
+
#
|
21
37
|
def self.test_file_path
|
22
38
|
lib_path = File.expand_path(File.dirname(__FILE__))
|
23
39
|
bin_path = File.expand_path(File.join(lib_path, "..", "bin"))
|
24
40
|
File.join(bin_path, "eicar.com")
|
25
41
|
end
|
26
42
|
|
43
|
+
# The EICAR test string, as read from the test file path.
|
44
|
+
# @return [String] the EICAR test string
|
45
|
+
#
|
27
46
|
def self.test_string
|
28
47
|
begin
|
29
48
|
data = File.open(self.test_file_path, "rb") {|f| f.read f.stat.size}
|
@@ -32,6 +51,10 @@ module EICAR
|
|
32
51
|
end
|
33
52
|
end
|
34
53
|
|
54
|
+
# Tests if antivirus is active as far as the EICAR test file is
|
55
|
+
# concerned.
|
56
|
+
# @return [Boolean]
|
57
|
+
#
|
35
58
|
def self.antivirus_active?
|
36
59
|
begin
|
37
60
|
self.test_string
|
@@ -41,26 +64,45 @@ module EICAR
|
|
41
64
|
return false
|
42
65
|
end
|
43
66
|
|
67
|
+
# Creates a ROT13 encoded string.
|
68
|
+
# @param str [String] the string to encode
|
69
|
+
# @return [String] the encoded string
|
70
|
+
#
|
44
71
|
def self.rot13(str)
|
45
72
|
str.tr "A-Za-z", "N-ZA-Mn-za-m"
|
46
73
|
end
|
47
74
|
|
48
|
-
#
|
49
|
-
#
|
75
|
+
# Creates the EICAR test file in a given path. If successful, returns
|
76
|
+
# the path written to. Without an argument, it attempts to write to
|
77
|
+
# the expected EICAR.test_file_path For system-wide gem installs, this
|
78
|
+
# will usually need to be run as root, or else you'll raise.
|
50
79
|
#
|
51
|
-
#
|
52
|
-
#
|
80
|
+
# @param path [String] the path to write to
|
81
|
+
# @return [String] the full, non-relative path written to
|
53
82
|
#
|
54
|
-
|
55
|
-
|
56
|
-
|
83
|
+
def self.create(path=self.test_file_path)
|
84
|
+
write_data = self.rot13(ROT13_DOWNCASE_EICAR).upcase
|
85
|
+
expanded_path = File.expand_path(path)
|
86
|
+
|
57
87
|
begin
|
58
|
-
|
59
|
-
File.open(path, "wb") {|f| f.write data}
|
88
|
+
File.open(expanded_path, "wb") {|f| f.write write_data}
|
60
89
|
rescue SystemCallError
|
61
90
|
raise EICAR::EICARWriteError
|
62
91
|
end
|
63
|
-
|
92
|
+
|
93
|
+
begin
|
94
|
+
if File.readable? expanded_path
|
95
|
+
read_data = File.open(expanded_path, "rb") {|f| f.read f.stat.size}
|
96
|
+
end
|
97
|
+
rescue SystemCallError
|
98
|
+
raise EICAR::EICARReadError
|
99
|
+
end
|
100
|
+
|
101
|
+
if read_data == write_data
|
102
|
+
return File.path(expanded_path)
|
103
|
+
else
|
104
|
+
raise EICAR::Error
|
105
|
+
end
|
64
106
|
end
|
65
107
|
|
66
108
|
end
|
data/lib/eicar/version.rb
CHANGED
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: EICAR
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.4
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Tod Beardsley
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2014-03-27 00:00:00.000000000 Z
|
12
12
|
dependencies: []
|
13
13
|
description: ! "\n This gem is designed to fail in the face of anti-virus coverage\n
|
14
14
|
\ of your gem path. If you are running anti-virus systemwide, this\n gem will
|
@@ -56,3 +56,4 @@ signing_key:
|
|
56
56
|
specification_version: 4
|
57
57
|
summary: A gem to test local anti-virus filesystem coverage
|
58
58
|
test_files: []
|
59
|
+
has_rdoc:
|