bundler-audit 0.1.1 → 0.2.0

data/lib/bundler/audit/cli.rb

@@ -15,11 +15,11 @@
 # along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
 #
 
-require 'bundler/audit/database'
+require 'bundler/audit/scanner'
 require 'bundler/audit/version'
 
-require 'bundler/vendored_thor'
 require 'bundler'
+require 'bundler/vendored_thor'
 
 module Bundler
   module Audit
@@ -30,21 +30,26 @@ module Bundler
 
       desc 'check', 'Checks the Gemfile.lock for insecure dependencies'
       method_option :verbose, :type => :boolean, :aliases => '-v'
+      method_option :ignore, :type => :array, :aliases => '-i'
 
       def check
-        environment = Bundler.load
-        database    = Database.new
-        vulnerable  = false
+        scanner    = Scanner.new
+        vulnerable = false
 
-        database.check_bundle(environment) do |gem,advisory|
+        scanner.scan(:ignore => options.ignore) do |result|
           vulnerable = true
 
-          print_advisory gem, advisory
+          case result
+          when Scanner::InsecureSource
+            print_warning "Insecure Source URI found: #{result.source}"
+          when Scanner::UnpatchedGem
+            print_advisory result.gem, result.advisory
+          end
         end
 
         if vulnerable
           say "Unpatched versions found!", :red
-          return -1
+          exit 1
         else
           say "No unpatched versions found", :green
         end
@@ -59,6 +64,15 @@ module Bundler
 
       protected
 
+      def say(string="", color=nil)
+        color = nil unless $stdout.tty?
+        super(string, color)
+      end
+
+      def print_warning(message)
+        say message, :yellow
+      end
+
       def print_advisory(gem, advisory)
         say "Name: ", :red
         say gem.name
@@ -66,14 +80,15 @@ module Bundler
         say "Version: ", :red
         say gem.version
 
-        say "CVE: ", :red
-        say advisory.cve
+        say "Advisory: ", :red
+        say advisory.id
 
         say "Criticality: ", :red
         case advisory.criticality
         when :low    then say "Low"
         when :medium then say "Medium", :yellow
         when :high   then say "High", [:red, :bold]
+        else              say "Unknown"
         end
 
         say "URL: ", :red

data/lib/bundler/audit/database.rb

@@ -28,7 +28,7 @@ module Bundler
     class Database
 
       # directory containing advisories
-      PATH =  File.expand_path(File.join(File.dirname(__FILE__),'..','..','..','data','bundler','audit'))
+      PATH =  File.expand_path(File.join(File.dirname(__FILE__),'..','..','..','data','ruby-advisory-db','gems'))
 
       # The path to the advisory database
       attr_reader :path
@@ -119,35 +119,6 @@ module Bundler
         end
       end
 
-      #
-      # Verifies whether the bundled gems are effected by any advisories.
-      #
-      # @param [Bundle::Environment] environment
-      #   The bundled gems.
-      #
-      # @yield [gem, advisory]
-      #   If a block is given, each advisory that effects a gem within the
-      #   bundle will be passed.
-      #
-      # @yieldparam [Gem::Specification] gem
-      #   The gem effected by the advisory.
-      #
-      # @yieldparam [Advisory] advisory
-      #   An advisory that effects a gem within the bundle.
-      #
-      # @return [Enumerator]
-      #   If no block is given, an Enumerator will be returned.
-      #
-      def check_bundle(environment)
-        return enum_for(__method__,environment) unless block_given?
-
-        environment.gems.each do |gem|
-          check_gem(gem) do |advisory|
-            yield gem, advisory
-          end
-        end
-      end
-
       #
       # The number of advisories within the database.
       #

data/lib/bundler/audit/scanner.rb

@@ -0,0 +1,97 @@
+require 'bundler'
+require 'bundler/audit/database'
+require 'bundler/lockfile_parser'
+
+require 'set'
+
+module Bundler
+  module Audit
+    class Scanner
+
+      # Represents a plain-text source
+      InsecureSource = Struct.new(:source)
+
+      # Represents a gem that is covered by an Advisory
+      UnpatchedGem = Struct.new(:gem, :advisory)
+
+      # The advisory database
+      #
+      # @return [Database]
+      attr_reader :database
+
+      # Project root directory
+      attr_reader :root
+
+      # The parsed `Gemfile.lock` from the project
+      #
+      # @return [Bundler::LockfileParser]
+      attr_reader :lockfile
+
+      #
+      # Initializes a scanner.
+      #
+      # @param [String] root
+      #   The path to the project root.
+      #
+      def initialize(root=Dir.pwd)
+        @root     = File.expand_path(root)
+        @database = Database.new
+        @lockfile = LockfileParser.new(
+          File.read(File.join(@root,'Gemfile.lock'))
+        )
+      end
+
+      #
+      # Scans the project for issues.
+      #
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @option options [Array<String>] :ignore
+      #   The advisories to ignore.
+      #
+      # @yield [result]
+      #   The given block will be passed the results of the scan.
+      #
+      # @yieldparam [InsecureSource, UnpatchedGem] result
+      #   A result from the scan.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def scan(options={})
+        return enum_for(__method__,options) unless block_given?
+
+        ignore = Set[]
+        ignore += options[:ignore] if options[:ignore]
+
+        @lockfile.sources.map do |source|
+          case source
+          when Source::Git
+            case source.uri
+            when /^git:/, /^http:/
+              yield InsecureSource.new(source.uri)
+            end
+          when Source::Rubygems
+            source.remotes.each do |uri|
+              if uri.scheme == 'http'
+                yield InsecureSource.new(uri.to_s)
+              end
+            end
+          end
+        end
+
+        @lockfile.specs.each do |gem|
+          @database.check_gem(gem) do |advisory|
+            unless ignore.include?(advisory.id)
+              yield UnpatchedGem.new(gem,advisory)
+            end
+          end
+        end
+
+        return self
+      end
+
+    end
+  end
+end

data/lib/bundler/audit/version.rb

@@ -18,6 +18,6 @@
 module Bundler
   module Audit
     # bundler-audit version
-    VERSION = "0.1.1"
+    VERSION = '0.2.0'
   end
 end

data/spec/advisory_spec.rb

@@ -4,16 +4,16 @@ require 'bundler/audit/advisory'
 
 describe Bundler::Audit::Advisory do
   let(:root) { Bundler::Audit::Database::PATH }
-  let(:gem)  { 'rails' }
-  let(:cve)  { '2013-0156' }
-  let(:path) { File.join(root,gem,"#{cve}.yml") }
+  let(:gem)  { 'actionpack' }
+  let(:id)   { 'OSVDB-84243' }
+  let(:path) { File.join(root,gem,"#{id}.yml") }
 
   describe "load" do
     let(:data) { YAML.load_file(path) }
 
     subject { described_class.load(path) }
 
-    its(:cve)         { should == cve                 }
+    its(:id)          { should == id                  }
     its(:url)         { should == data['url']         }
     its(:title)       { should == data['title']       }
     its(:cvss_v2)     { should == data['cvss_v2']     }
@@ -54,10 +54,50 @@ describe Bundler::Audit::Advisory do
     end
   end
 
+  describe "#unaffected?" do
+    subject { described_class.load(path) }
+
+    context "when passed a version that matches one unaffected version" do
+      let(:version) { Gem::Version.new('2.3.10') }
+
+      it "should return true" do
+        subject.unaffected?(version).should be_true
+      end
+    end
+
+    context "when passed a version that matches no unaffected version" do
+      let(:version) { Gem::Version.new('3.0.9') }
+
+      it "should return false" do
+        subject.unaffected?(version).should be_false
+      end
+    end
+  end
+
+  describe "#patched?" do
+    subject { described_class.load(path) }
+
+    context "when passed a version that matches one patched version" do
+      let(:version) { Gem::Version.new('3.1.11') }
+
+      it "should return true" do
+        subject.patched?(version).should be_true
+      end
+    end
+
+    context "when passed a version that matches no patched version" do
+      let(:version) { Gem::Version.new('2.9.0') }
+
+      it "should return false" do
+        subject.patched?(version).should be_false
+      end
+    end
+  end
+
   describe "#vulnerable?" do
     subject { described_class.load(path) }
 
-    context "when passed a version that matches one patched_version" do
+    context "when passed a version that matches one patched version" do
       let(:version) { Gem::Version.new('3.1.11') }
 
       it "should return false" do
@@ -65,12 +105,32 @@ describe Bundler::Audit::Advisory do
       end
     end
 
-    context "when passed a version that matches no patched_version" do
-      let(:version) { Gem::Version.new('3.1.9') }
+    context "when passed a version that matches no patched version" do
+      let(:version) { Gem::Version.new('2.9.0') }
 
       it "should return true" do
         subject.vulnerable?(version).should be_true
       end
+
+      context "when unaffected_versions is not empty" do
+        subject { described_class.load(path) }
+     
+        context "when passed a version that matches one unaffected version" do
+          let(:version) { Gem::Version.new('2.3.12') }
+
+          it "should return false" do
+            subject.vulnerable?(version).should be_false
+          end
+        end
+
+        context "when passed a version that matches no unaffected version" do
+          let(:version) { Gem::Version.new('1.2.3') }
+
+          it "should return true" do
+            subject.vulnerable?(version).should be_true
+          end
+        end
+      end
     end
   end
 end

data/spec/bundle/insecure_sources/Gemfile

@@ -0,0 +1,39 @@
+source 'http://rubygems.org'
+
+gem 'rails', '3.2.12'
+
+# Bundle edge Rails instead:
+# gem 'rails', :git => 'git://github.com/rails/rails.git'
+
+gem 'sqlite3'
+
+
+# Gems used only for assets and not required
+# in production environments by default.
+group :assets do
+  # gem 'sass-rails',   '~> 3.2.3'
+  # gem 'coffee-rails', '~> 3.2.1'
+
+  # See https://github.com/sstephenson/execjs#readme for more supported runtimes
+  # gem 'therubyracer', :platforms => :ruby
+
+  # gem 'uglifier', '>= 1.0.3'
+end
+
+gem 'jquery-rails', :git => 'git://github.com/rails/jquery-rails.git',
+                    :tag => 'v2.2.1'
+
+# To use ActiveModel has_secure_password
+# gem 'bcrypt-ruby', '~> 3.0.0'
+
+# To use Jbuilder templates for JSON
+# gem 'jbuilder'
+
+# Use unicorn as the app server
+# gem 'unicorn'
+
+# Deploy with Capistrano
+# gem 'capistrano'
+
+# To use debugger
+# gem 'debugger'

data/spec/bundle/secure/Gemfile

@@ -0,0 +1,38 @@
+source 'https://rubygems.org'
+
+gem 'rails', '3.2.14'
+
+# Bundle edge Rails instead:
+# gem 'rails', :git => 'git://github.com/rails/rails.git'
+
+gem 'sqlite3'
+
+
+# Gems used only for assets and not required
+# in production environments by default.
+group :assets do
+  # gem 'sass-rails',   '~> 3.2.3'
+  # gem 'coffee-rails', '~> 3.2.1'
+
+  # See https://github.com/sstephenson/execjs#readme for more supported runtimes
+  # gem 'therubyracer', :platforms => :ruby
+
+  # gem 'uglifier', '>= 1.0.3'
+end
+
+gem 'jquery-rails'
+
+# To use ActiveModel has_secure_password
+# gem 'bcrypt-ruby', '~> 3.0.0'
+
+# To use Jbuilder templates for JSON
+# gem 'jbuilder'
+
+# Use unicorn as the app server
+# gem 'unicorn'
+
+# Deploy with Capistrano
+# gem 'capistrano'
+
+# To use debugger
+# gem 'debugger'

data/spec/database_spec.rb

@@ -1,7 +1,5 @@
 require 'spec_helper'
 require 'bundler/audit/database'
-
-require 'bundler'
 require 'tmpdir'
 
 describe Bundler::Audit::Database do
@@ -44,7 +42,7 @@ describe Bundler::Audit::Database do
   describe "#check_gem" do
     let(:gem) do
       Gem::Specification.new do |s|
-        s.name    = 'rails'
+        s.name    = 'actionpack'
         s.version = '3.1.9'
       end
     end
@@ -71,35 +69,6 @@ describe Bundler::Audit::Database do
     end
   end
 
-  describe "#check_bundle" do
-    let(:path) { File.join(File.dirname(__FILE__),'bundle') }
-    let(:bundle) do
-      Dir.chdir(path) { Bundler.load }
-    end
-
-    context "when given a block" do
-      it "should yield every advisory effecting the bundle" do
-        advisories = []
-
-        subject.check_bundle(bundle) do |gem,advisory|
-          advisories << [gem, advisory]
-        end
-
-        advisories.should_not be_empty
-        advisories.all? { |gem,advisory|
-          gem.kind_of?(Gem::Specification) &&
-            advisory.kind_of?(Bundler::Audit::Advisory)
-        }.should be_true
-      end
-    end
-
-    context "when given no block" do
-      it "should return an Enumerator" do
-        subject.check_bundle(bundle).should be_kind_of(Enumerable)
-      end
-    end
-  end
-
   describe "#size" do
     it { subject.size.should > 0 }
   end

data/spec/integration_spec.rb

@@ -0,0 +1,132 @@
+require 'spec_helper'
+
+describe "CLI" do
+  include Helpers
+
+  let(:command) do
+    File.expand_path(File.join(File.dirname(__FILE__),'..','bin','bundle-audit'))
+  end
+
+  context "when auditing a bundle with unpatched gems" do
+    let(:bundle)    { 'unpatched_gems' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+
+    subject do
+      Dir.chdir(directory) { sh(command, :fail => true) }
+    end
+
+    it "should print a warning" do
+      subject.should include("Unpatched versions found!")
+    end
+
+    it "should print advisory information for the vulnerable gems" do
+      expect = %{
+Name: actionpack
+Version: 3.2.10
+Advisory: OSVDB-91452
+Criticality: Medium
+URL: http://www.osvdb.org/show/osvdb/91452
+Title: XSS vulnerability in sanitize_css in Action Pack
+Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+
+Name: actionpack
+Version: 3.2.10
+Advisory: OSVDB-91454
+Criticality: Medium
+URL: http://osvdb.org/show/osvdb/91454
+Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
+Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+
+Name: actionpack
+Version: 3.2.10
+Advisory: OSVDB-89026
+Criticality: High
+URL: http://osvdb.org/show/osvdb/89026
+Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
+Solution: upgrade to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
+
+Name: activerecord
+Version: 3.2.10
+Advisory: OSVDB-91453
+Criticality: High
+URL: http://osvdb.org/show/osvdb/91453
+Title: Symbol DoS vulnerability in Active Record
+Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+
+Name: activerecord
+Version: 3.2.10
+Advisory: OSVDB-90072
+Criticality: Medium
+URL: http://direct.osvdb.org/show/osvdb/90072
+Title: Ruby on Rails Active Record attr_protected Method Bypass
+Solution: upgrade to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
+
+Name: activerecord
+Version: 3.2.10
+Advisory: OSVDB-89025
+Criticality: High
+URL: http://osvdb.org/show/osvdb/89025
+Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
+Solution: upgrade to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
+
+Name: activesupport
+Version: 3.2.10
+Advisory: OSVDB-91451
+Criticality: High
+URL: http://www.osvdb.org/show/osvdb/91451
+Title: XML Parsing Vulnerability affecting JRuby users
+Solution: upgrade to ~> 3.1.12, >= 3.2.13
+
+Unpatched versions found!
+      }.strip.split "\n\n"
+
+      subject.strip.split("\n\n").should =~ expect
+    end
+  end
+
+  context "when auditing a bundle with ignored gems" do
+    let(:bundle)    { 'unpatched_gems' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+
+    let(:command) do
+      File.expand_path(File.join(File.dirname(__FILE__),'..','bin','bundle-audit -i OSVDB-89026'))
+    end
+
+    subject do
+      Dir.chdir(directory) { sh(command, :fail => true) }
+    end
+
+    it "should not print advisory information for ignored gem" do
+      subject.should_not include("OSVDB-89026")
+    end
+  end
+
+  context "when auditing a bundle with insecure sources" do
+    let(:bundle)    { 'insecure_sources' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+
+    subject do
+      Dir.chdir(directory) { sh(command, :fail => true) }
+    end
+
+    it "should print warnings about insecure sources" do
+      subject.should include(%{
+Insecure Source URI found: git://github.com/rails/jquery-rails.git
+Insecure Source URI found: http://rubygems.org/
+      }.strip)
+    end
+  end
+
+  context "when auditing a secure bundle" do
+    let(:bundle)    { 'secure' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+
+    subject do
+      Dir.chdir(directory) { sh(command) }
+    end
+
+    it "should print nothing when everything is fine" do
+      subject.strip.should == "No unpatched versions found"
+    end
+  end
+end

data/spec/scanner_spec.rb

@@ -0,0 +1,74 @@
+require 'spec_helper'
+require 'bundler/audit/scanner'
+
+describe Scanner do
+  describe "#scan" do
+    let(:bundle)    { 'unpatched_gems' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+
+    subject { described_class.new(directory) }
+
+    it "should yield results" do
+      results = []
+
+      subject.scan { |result| results << result }
+
+      results.should_not be_empty
+    end
+
+    context "when not called with a block" do
+      it "should return an Enumerator" do
+        subject.scan.should be_kind_of(Enumerable)
+      end
+    end
+  end
+
+  context "when auditing a bundle with unpatched gems" do
+    let(:bundle)    { 'unpatched_gems' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+    let(:scanner)  { described_class.new(directory)    }
+
+    subject { scanner.scan.to_a }
+
+    it "should match unpatched gems to their advisories" do
+      subject.all? { |result|
+        result.advisory.vulnerable?(result.gem.version)
+      }.should be_true
+    end
+
+    context "when the :ignore option is given" do
+      subject { scanner.scan(:ignore => ['OSVDB-89026']) }
+
+      it "should ignore the specified advisories" do
+        ids = subject.map { |result| result.advisory.id }
+        
+        ids.should_not include('OSVDB-89026')
+      end
+    end
+  end
+
+  context "when auditing a bundle with insecure sources" do
+    let(:bundle)    { 'insecure_sources' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+    let(:scanner)   { described_class.new(directory)    }
+
+    subject { scanner.scan.to_a }
+
+    it "should match unpatched gems to their advisories" do
+      subject[0].source.should == 'git://github.com/rails/jquery-rails.git'
+      subject[1].source.should == 'http://rubygems.org/'
+    end
+  end
+
+  context "when auditing a secure bundle" do
+    let(:bundle)    { 'secure' }
+    let(:directory) { File.join('spec','bundle',bundle) }
+    let(:scanner)   { described_class.new(directory)    }
+
+    subject { scanner.scan.to_a }
+
+    it "should print nothing when everything is fine" do
+      subject.should be_empty
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -1,5 +1,18 @@
-gem 'rspec', '~> 2.4'
 require 'rspec'
 require 'bundler/audit/version'
 
+module Helpers
+  def sh(command, options={})
+    Bundler.with_clean_env do
+      result = `#{command} 2>&1`
+      raise "FAILED #{command}\n#{result}" if $?.success? == !!options[:fail]
+      result
+    end
+  end
+
+  def decolorize(string)
+    string.gsub(/\e\[\d+m/, "")
+  end
+end
+
 include Bundler::Audit