bundler-audit-ng 0.6.1

data/data/ruby-advisory-db.ts

@@ -0,0 +1 @@
+2017-06-13 16:51:56 UTC

data/gemspec.yml

@@ -0,0 +1,14 @@
+name: bundler-audit-ng
+summary: Patch-level verification for Bundler
+description: bundler-audit provides patch-level verification for Bundled apps.
+license: GPL-3.0+
+authors: Postmodern, pxlpnk
+email: rubygems@an-ti.eu
+homepage: https://github.com/pxlpnk/bundler-audit-ng
+
+required_ruby_version: ">= 1.9.3"
+required_rubygems_version: ">= 1.8.0"
+
+dependencies:
+  thor: ~> 0.18
+  bundler: ">= 1.2.0, < 3"

data/lib/bundler/audit.rb

@@ -0,0 +1,19 @@
+#
+# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'bundler/audit/database'
+require 'bundler/audit/version'

data/lib/bundler/audit/advisory.rb

@@ -0,0 +1,177 @@
+#
+# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'yaml'
+
+module Bundler
+  module Audit
+    class Advisory < Struct.new(:path,
+                                :id,
+                                :url,
+                                :title,
+                                :date,
+                                :description,
+                                :cvss_v2,
+                                :cve,
+                                :osvdb,
+                                :ghsa,
+                                :unaffected_versions,
+                                :patched_versions)
+
+      #
+      # Loads the advisory from a YAML file.
+      #
+      # @param [String] path
+      #   The path to the advisory YAML file.
+      #
+      # @return [Advisory]
+      #
+      # @api semipublic
+      #
+      def self.load(path)
+        id   = File.basename(path).chomp('.yml')
+        data = YAML.load_file(path)
+
+        unless data.kind_of?(Hash)
+          raise("advisory data in #{path.dump} was not a Hash")
+        end
+
+        parse_versions = lambda { |versions|
+          Array(versions).map do |version|
+            Gem::Requirement.new(*version.split(', '))
+          end
+        }
+
+        return new(
+          path,
+          id,
+          data['url'],
+          data['title'],
+          data['date'],
+          data['description'],
+          data['cvss_v2'],
+          data['cve'],
+          data['osvdb'],
+          data['ghsa'],
+          parse_versions[data['unaffected_versions']],
+          parse_versions[data['patched_versions']]
+        )
+      end
+
+      #
+      # The CVE identifier.
+      #
+      # @return [String, nil]
+      #
+      def cve_id
+        "CVE-#{cve}" if cve
+      end
+
+      #
+      # The OSVDB identifier.
+      #
+      # @return [String, nil]
+      #
+      def osvdb_id
+        "OSVDB-#{osvdb}" if osvdb
+      end
+
+      #
+      # The GHSA (GitHub Security Advisory) identifier
+      #
+      # @return [String, nil]
+      #
+      def ghsa_id
+        "GHSA-#{ghsa}" if ghsa
+      end
+
+      #
+      # Return a compacted list of all ids
+      def identifiers
+        [
+          cve_id,
+          osvdb_id,
+          ghsa_id
+        ].compact
+      end
+
+      #
+      # Determines how critical the vulnerability is.
+      #
+      # @return [:low, :medium, :high]
+      #   The criticality of the vulnerability based on the CVSSv2 score.
+      #
+      def criticality
+        case cvss_v2
+        when 0.0..3.3  then :low
+        when 3.3..6.6  then :medium
+        when 6.6..10.0 then :high
+        end
+      end
+
+      #
+      # Checks whether the version is not affected by the advisory.
+      #
+      # @param [Gem::Version] version
+      #   The version to compare against {#unaffected_versions}.
+      #
+      # @return [Boolean]
+      #   Specifies whether the version is not affected by the advisory.
+      #
+      # @since 0.2.0
+      #
+      def unaffected?(version)
+        unaffected_versions.any? do |unaffected_version|
+          unaffected_version === version
+        end
+      end
+
+      #
+      # Checks whether the version is patched against the advisory.
+      #
+      # @param [Gem::Version] version
+      #   The version to compare against {#patched_versions}.
+      #
+      # @return [Boolean]
+      #   Specifies whether the version is patched against the advisory.
+      #
+      # @since 0.2.0
+      #
+      def patched?(version)
+        patched_versions.any? do |patched_version|
+          patched_version === version
+        end
+      end
+
+      #
+      # Checks whether the version is vulnerable to the advisory.
+      #
+      # @param [Gem::Version] version
+      #   The version to compare against {#patched_versions}.
+      #
+      # @return [Boolean]
+      #   Specifies whether the version is vulnerable to the advisory or not.
+      #
+      def vulnerable?(version)
+        !patched?(version) && !unaffected?(version)
+      end
+
+      alias to_s id
+
+    end
+  end
+end

data/lib/bundler/audit/cli.rb

@@ -0,0 +1,155 @@
+#
+# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'bundler/audit/scanner'
+require 'bundler/audit/version'
+
+require 'thor'
+require 'bundler'
+require 'bundler/vendored_thor'
+
+module Bundler
+  module Audit
+    class CLI < ::Thor
+
+      default_task :check
+      map '--version' => :version
+
+      desc 'check', 'Checks the Gemfile.lock for insecure dependencies'
+      method_option :quiet, :type => :boolean, :aliases => '-q'
+      method_option :verbose, :type => :boolean, :aliases => '-v'
+      method_option :ignore, :type => :array, :aliases => '-i'
+      method_option :update, :type => :boolean, :aliases => '-u'
+
+      def check
+        update if options[:update]
+
+        scanner    = Scanner.new
+        vulnerable = false
+
+        scanner.scan(:ignore => options.ignore) do |result|
+          vulnerable = true
+
+          case result
+          when Scanner::InsecureSource
+            print_warning "Insecure Source URI found: #{result.source}"
+          when Scanner::UnpatchedGem
+            print_advisory result.gem, result.advisory
+          end
+        end
+
+        if vulnerable
+          say "Vulnerabilities found!", :red
+          exit 1
+        else
+          say("No vulnerabilities found", :green) unless options.quiet?
+        end
+      end
+
+      desc 'update', 'Updates the ruby-advisory-db'
+      method_option :quiet, :type => :boolean, :aliases => '-q'
+
+      def update
+        say("Updating ruby-advisory-db ...") unless options.quiet?
+
+        case Database.update!(quiet: options.quiet?)
+        when true
+          say("Updated ruby-advisory-db", :green) unless options.quiet?
+        when false
+          say "Failed updating ruby-advisory-db!", :red
+          exit 1
+        when nil
+          say "Skipping update", :yellow
+        end
+
+        unless options.quiet?
+          puts("ruby-advisory-db: #{Database.new.size} advisories")
+        end
+      end
+
+      desc 'version', 'Prints the bundler-audit version'
+      def version
+        database = Database.new
+
+        puts "#{File.basename($0)} #{VERSION} (advisories: #{database.size})"
+      end
+
+      protected
+
+      def say(message="", color=nil)
+        color = nil unless $stdout.tty?
+        super(message.to_s, color)
+      end
+
+      def print_warning(message)
+        say message, :yellow
+      end
+
+      def print_advisory(gem, advisory)
+        say "Name: ", :red
+        say gem.name
+
+        say "Version: ", :red
+        say gem.version
+
+        say "Advisory: ", :red
+
+        if advisory.cve
+          say advisory.cve_id
+        elsif advisory.osvdb
+          say advisory.osvdb_id
+        elsif advisory.ghsa
+          say advisory.ghsa_id
+        end
+
+        say "Criticality: ", :red
+        case advisory.criticality
+        when :low    then say "Low"
+        when :medium then say "Medium", :yellow
+        when :high   then say "High", [:red, :bold]
+        else              say "Unknown"
+        end
+
+        say "URL: ", :red
+        say advisory.url
+
+        if options.verbose?
+          say "Description:", :red
+          say
+
+          print_wrapped advisory.description, :indent => 2
+          say
+        else
+
+          say "Title: ", :red
+          say advisory.title
+        end
+
+        unless advisory.patched_versions.empty?
+          say "Solution: upgrade to ", :red
+          say advisory.patched_versions.join(', ')
+        else
+          say "Solution: ", :red
+          say "remove or disable this gem until a patch is available!", [:red, :bold]
+        end
+
+        say
+      end
+
+    end
+  end
+end

data/lib/bundler/audit/database.rb

@@ -0,0 +1,248 @@
+#
+# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'bundler/audit/advisory'
+
+require 'time'
+require 'yaml'
+
+module Bundler
+  module Audit
+    #
+    # Represents the directory of advisories, grouped by gem name
+    # and CVE number.
+    #
+    class Database
+
+      # Git URL of the ruby-advisory-db
+      URL = 'https://github.com/rubysec/ruby-advisory-db.git'
+
+      # Default path to the ruby-advisory-db
+      VENDORED_PATH =  File.expand_path(File.join(File.dirname(__FILE__),'..','..','..','data','ruby-advisory-db'))
+
+      # Timestamp for when the database was last updated
+      VENDORED_TIMESTAMP = Time.parse(File.read("#{VENDORED_PATH}.ts")).utc
+
+      # Path to the user's copy of the ruby-advisory-db
+      USER_PATH = File.expand_path(File.join(ENV['HOME'],'.local','share','ruby-advisory-db'))
+
+      # The path to the advisory database
+      attr_reader :path
+
+      #
+      # Initializes the Advisory Database.
+      #
+      # @param [String] path
+      #   The path to the advisory database.
+      #
+      # @raise [ArgumentError]
+      #   The path was not a directory.
+      #
+      def initialize(path=self.class.path)
+        unless File.directory?(path)
+          raise(ArgumentError,"#{path.dump} is not a directory")
+        end
+
+        @path = path
+      end
+
+      #
+      # The default path for the database.
+      #
+      # @return [String]
+      #   The path to the database directory.
+      #
+      def self.path
+        if File.directory?(USER_PATH)
+          t1 = Dir.chdir(USER_PATH) { Time.parse(`git log --date=iso8601 --pretty="%cd" -1`) }
+          t2 = VENDORED_TIMESTAMP
+
+          if t1 >= t2 then USER_PATH
+          else             VENDORED_PATH
+          end
+        else
+          VENDORED_PATH
+        end
+      end
+
+      #
+      # Updates the ruby-advisory-db.
+      #
+      # @param [Boolean, quiet]
+      #   Specify whether `git` should be `--quiet`.
+      #
+      # @return [Boolean, nil]
+      #   Specifies whether the update was successful.
+      #   A `nil` indicates no update was performed.
+      #
+      # @note
+      #   Requires network access.
+      #
+      # @since 0.3.0
+      #
+      def self.update!(options={})
+        raise "Invalid option(s)" unless (options.keys - [:quiet]).empty?
+        if File.directory?(USER_PATH)
+          if File.directory?(File.join(USER_PATH, ".git"))
+            Dir.chdir(USER_PATH) do
+              command = %w(git pull --no-rebase)
+              command << '--quiet' if options[:quiet]
+              command << 'origin' << 'master'
+              system *command
+            end
+          end
+        else
+          command = %w(git clone)
+          command << '--quiet' if options[:quiet]
+          command << URL << USER_PATH
+          system *command
+        end
+      end
+
+      #
+      # Enumerates over every advisory in the database.
+      #
+      # @yield [advisory]
+      #   If a block is given, it will be passed each advisory.
+      #
+      # @yieldparam [Advisory] advisory
+      #   An advisory from the database.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def advisories(&block)
+        return enum_for(__method__) unless block_given?
+
+        each_advisory_path do |path|
+          yield Advisory.load(path)
+        end
+      end
+
+      #
+      # Enumerates over advisories for the given gem.
+      #
+      # @param [String] name
+      #   The gem name to lookup.
+      #
+      # @yield [advisory]
+      #   If a block is given, each advisory for the given gem will be yielded.
+      #
+      # @yieldparam [Advisory] advisory
+      #   An advisory for the given gem.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def advisories_for(name)
+        return enum_for(__method__,name) unless block_given?
+
+        each_advisory_path_for(name) do |path|
+          yield Advisory.load(path)
+        end
+      end
+
+      #
+      # Verifies whether the gem is effected by any advisories.
+      #
+      # @param [Gem::Specification] gem
+      #   The gem to verify.
+      #
+      # @yield [advisory]
+      #   If a block is given, it will be passed advisories that effect
+      #   the gem.
+      #
+      # @yieldparam [Advisory] advisory
+      #   An advisory that effects the specific version of the gem.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def check_gem(gem)
+        return enum_for(__method__,gem) unless block_given?
+
+        advisories_for(gem.name) do |advisory|
+          if advisory.vulnerable?(gem.version)
+            yield advisory
+          end
+        end
+      end
+
+      #
+      # The number of advisories within the database.
+      #
+      # @return [Integer]
+      #   The number of advisories.
+      #
+      def size
+        each_advisory_path.count
+      end
+
+      #
+      # Converts the database to a String.
+      #
+      # @return [String]
+      #   The path to the database.
+      #
+      def to_s
+        @path
+      end
+
+      #
+      # Inspects the database.
+      #
+      # @return [String]
+      #   The inspected database.
+      #
+      def inspect
+        "#<#{self.class}:#{self}>"
+      end
+
+      protected
+
+      #
+      # Enumerates over every advisory path in the database.
+      #
+      # @yield [path]
+      #   The given block will be passed each advisory path.
+      #
+      # @yieldparam [String] path
+      #   A path to an advisory `.yml` file.
+      #
+      def each_advisory_path(&block)
+        Dir.glob(File.join(@path,'gems','*','*.yml'),&block)
+      end
+
+      #
+      # Enumerates over the advisories for the given gem.
+      #
+      # @param [String] name
+      #   The gem of the gem.
+      #
+      # @yield [path]
+      #   The given block will be passed each advisory path.
+      #
+      # @yieldparam [String] path
+      #   A path to an advisory `.yml` file.
+      #
+      def each_advisory_path_for(name,&block)
+        Dir.glob(File.join(@path,'gems',name,'*.yml'),&block)
+      end
+
+    end
+  end
+end