bundler-audit 0.1.1 → 0.2.0

metadata

@@ -1,166 +1,159 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: bundler-audit
-version: !ruby/object:Gem::Version 
-  hash: 25
-  prerelease: 
-  segments: 
-  - 0
-  - 1
-  - 1
-  version: 0.1.1
+version: !ruby/object:Gem::Version
+  version: 0.2.0
 platform: ruby
-authors: 
+authors:
 - Postmodern
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2013-02-12 00:00:00 Z
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 2013-08-27 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: bundler
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        hash: 15
-        segments: 
-        - 1
-        - 0
-        version: "1.0"
+      - !ruby/object:Gem::Version
+        version: '1.2'
   type: :runtime
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: yard
-  prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ~>
-      - !ruby/object:Gem::Version 
-        hash: 27
-        segments: 
-        - 0
-        - 8
-        version: "0.8"
-  type: :development
-  version_requirements: *id002
-- !ruby/object:Gem::Dependency 
-  name: rubygems-tasks
-  prerelease: false
-  requirement: &id003 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ~>
-      - !ruby/object:Gem::Version 
-        hash: 15
-        segments: 
-        - 0
-        - 2
-        version: "0.2"
-  type: :development
-  version_requirements: *id003
-- !ruby/object:Gem::Dependency 
-  name: rspec
   prerelease: false
-  requirement: &id004 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
     - - ~>
-      - !ruby/object:Gem::Version 
-        hash: 11
-        segments: 
-        - 2
-        - 4
-        version: "2.4"
-  type: :development
-  version_requirements: *id004
+      - !ruby/object:Gem::Version
+        version: '1.2'
 description: bundler-audit provides patch-level verification for Bundled apps.
 email: postmodern.mod3@gmail.com
-executables: 
+executables:
 - bundle-audit
 extensions: []
-
-extra_rdoc_files: 
+extra_rdoc_files:
 - COPYING.txt
 - ChangeLog.md
 - README.md
-files: 
+files:
 - .document
 - .gitignore
+- .gitmodules
 - .rspec
+- .travis.yml
 - .yardopts
 - COPYING.txt
 - ChangeLog.md
+- Gemfile
 - README.md
 - Rakefile
 - bin/bundle-audit
 - bundler-audit.gemspec
-- data/bundler/audit/json/2013-0269.yml
-- data/bundler/audit/mail/2011-0739.yml
-- data/bundler/audit/mail/2012-2139.yml
-- data/bundler/audit/mail/2012-2140.yml
-- data/bundler/audit/rack-cache/2012-267.yml
-- data/bundler/audit/rack/2013-0263.yml
-- data/bundler/audit/rails/2012-1098.yml
-- data/bundler/audit/rails/2012-1099.yml
-- data/bundler/audit/rails/2012-2660.yml
-- data/bundler/audit/rails/2012-2661.yml
-- data/bundler/audit/rails/2012-3424.yml
-- data/bundler/audit/rails/2012-3463.yml
-- data/bundler/audit/rails/2012-3464.yml
-- data/bundler/audit/rails/2012-3465.yml
-- data/bundler/audit/rails/2013-0155.yml
-- data/bundler/audit/rails/2013-0156.yml
-- data/bundler/audit/rails/2013-0276.yml
-- data/bundler/audit/rails/2013-0277.yml
-- data/bundler/audit/rails/2013-0333.yml
 - gemspec.yml
 - lib/bundler/audit.rb
 - lib/bundler/audit/advisory.rb
 - lib/bundler/audit/cli.rb
 - lib/bundler/audit/database.rb
+- lib/bundler/audit/scanner.rb
 - lib/bundler/audit/version.rb
 - spec/advisory_spec.rb
 - spec/audit_spec.rb
-- spec/bundle/Gemfile
-- spec/bundle/Gemfile.lock
+- spec/bundle/insecure_sources/Gemfile
+- spec/bundle/secure/Gemfile
+- spec/bundle/unpatched_gems/Gemfile
 - spec/database_spec.rb
+- spec/integration_spec.rb
+- spec/scanner_spec.rb
 - spec/spec_helper.rb
-homepage: https://github.com/postmodern/bundler-audit#readme
-licenses: 
+- data/ruby-advisory-db/.rspec
+- data/ruby-advisory-db/CONTRIBUTING.md
+- data/ruby-advisory-db/CONTRIBUTORS.md
+- data/ruby-advisory-db/Gemfile
+- data/ruby-advisory-db/LICENSE.txt
+- data/ruby-advisory-db/README.md
+- data/ruby-advisory-db/Rakefile
+- data/ruby-advisory-db/gems/actionpack/OSVDB-79727.yml
+- data/ruby-advisory-db/gems/actionpack/OSVDB-84243.yml
+- data/ruby-advisory-db/gems/actionpack/OSVDB-84513.yml
+- data/ruby-advisory-db/gems/actionpack/OSVDB-84515.yml
+- data/ruby-advisory-db/gems/actionpack/OSVDB-89026.yml
+- data/ruby-advisory-db/gems/actionpack/OSVDB-91452.yml
+- data/ruby-advisory-db/gems/actionpack/OSVDB-91454.yml
+- data/ruby-advisory-db/gems/activerecord/OSVDB-82403.yml
+- data/ruby-advisory-db/gems/activerecord/OSVDB-82610.yml
+- data/ruby-advisory-db/gems/activerecord/OSVDB-89025.yml
+- data/ruby-advisory-db/gems/activerecord/OSVDB-90072.yml
+- data/ruby-advisory-db/gems/activerecord/OSVDB-90073.yml
+- data/ruby-advisory-db/gems/activerecord/OSVDB-91453.yml
+- data/ruby-advisory-db/gems/activesupport/OSVDB-79726.yml
+- data/ruby-advisory-db/gems/activesupport/OSVDB-84516.yml
+- data/ruby-advisory-db/gems/activesupport/OSVDB-89594.yml
+- data/ruby-advisory-db/gems/activesupport/OSVDB-91451.yml
+- data/ruby-advisory-db/gems/command_wrap/OSVDB-91450.yml
+- data/ruby-advisory-db/gems/crack/OSVDB-90742.yml
+- data/ruby-advisory-db/gems/cremefraiche/OSVDB-93395.yml
+- data/ruby-advisory-db/gems/curl/OSVDB-91230.yml
+- data/ruby-advisory-db/gems/devise/OSVDB-89642.yml
+- data/ruby-advisory-db/gems/dragonfly/OSVDB-90647.yml
+- data/ruby-advisory-db/gems/enum_column3/OSVDB-94679.yml
+- data/ruby-advisory-db/gems/extlib/OSVDB-90740.yml
+- data/ruby-advisory-db/gems/fastreader/OSVDB-91232.yml
+- data/ruby-advisory-db/gems/fileutils/OSVDB-90715.yml
+- data/ruby-advisory-db/gems/fileutils/OSVDB-90716.yml
+- data/ruby-advisory-db/gems/fileutils/OSVDB-90717.yml
+- data/ruby-advisory-db/gems/flash_tool/OSVDB-90829.yml
+- data/ruby-advisory-db/gems/ftpd/OSVDB-90784.yml
+- data/ruby-advisory-db/gems/gtk2/OSVDB-40774.yml
+- data/ruby-advisory-db/gems/httparty/OSVDB-90741.yml
+- data/ruby-advisory-db/gems/json/OSVDB-90074.yml
+- data/ruby-advisory-db/gems/karteek-docsplit/OSVDB-92117.yml
+- data/ruby-advisory-db/gems/kelredd-pruview/OSVDB-92228.yml
+- data/ruby-advisory-db/gems/ldoce/OSVDB-91870.yml
+- data/ruby-advisory-db/gems/loofah/OSVDB-90945.yml
+- data/ruby-advisory-db/gems/mail/OSVDB-70667.yml
+- data/ruby-advisory-db/gems/mail/OSVDB-81631.yml
+- data/ruby-advisory-db/gems/mail/OSVDB-81632.yml
+- data/ruby-advisory-db/gems/md2pdf/OSVDB-92290.yml
+- data/ruby-advisory-db/gems/mini_magick/OSVDB-91231.yml
+- data/ruby-advisory-db/gems/multi_xml/OSVDB-89148.yml
+- data/ruby-advisory-db/gems/newrelic_rpm/OSVDB-90189.yml
+- data/ruby-advisory-db/gems/nori/OSVDB-90196.yml
+- data/ruby-advisory-db/gems/omniauth-oauth2/OSVDB-90264.yml
+- data/ruby-advisory-db/gems/pdfkit/OSVDB-90867.yml
+- data/ruby-advisory-db/gems/rack-cache/OSVDB-83077.yml
+- data/ruby-advisory-db/gems/rack/OSVDB-89939.yml
+- data/ruby-advisory-db/gems/rdoc/OSVDB-90004.yml
+- data/ruby-advisory-db/gems/rgpg/OSVDB-95948.yml
+- data/ruby-advisory-db/gems/ruby_parser/OSVDB-90561.yml
+- data/ruby-advisory-db/gems/spree/OSVDB-91216.yml
+- data/ruby-advisory-db/gems/spree/OSVDB-91217.yml
+- data/ruby-advisory-db/gems/spree/OSVDB-91218.yml
+- data/ruby-advisory-db/gems/spree/OSVDB-91219.yml
+- data/ruby-advisory-db/gems/thumbshooter/OSVDB-91839.yml
+- data/ruby-advisory-db/lib/scrape.rb
+- data/ruby-advisory-db/spec/advisory_example.rb
+- data/ruby-advisory-db/spec/gems_spec.rb
+- data/ruby-advisory-db/spec/spec_helper.rb
+homepage: https://github.com/rubysec/bundler-audit#readme
+licenses:
 - GPLv3
+metadata: {}
 post_install_message: 
 rdoc_options: []
-
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - '>='
+    - !ruby/object:Gem::Version
+      version: 1.8.0
 requirements: []
-
 rubyforge_project: 
-rubygems_version: 1.8.24
+rubygems_version: 2.0.5
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: Patch-level verification for Bundler
 test_files: []
-

data/data/bundler/audit/mail/2011-0739.yml

@@ -1,17 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/70667
-title: |
-  Mail Gem for Ruby lib/mail/network/delivery_methods/sendmail.rb Email From:
-  Address Arbitrary Shell Command Injection 
-
-description: > 
-  Mail Gem for Ruby contains a flaw related to the failure to properly
-  sanitise input passed from an email from address in the 'deliver()'
-  function in 'lib/mail/network/delivery_methods/sendmail.rb' before
-  being used as a command line argument. This may allow a remote
-  attacker to inject arbitrary shell commands.
-
-cvss_v2: 6.8
-
-patched_versions:
-  - ">= 2.2.15"

data/data/bundler/audit/mail/2012-2139.yml

@@ -1,16 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/81631
-title: Mail Gem for Ruby File Delivery Method to Parameter Traversal Arbitrary File Manipulation 
-
-description: > 
-  Mail Gem for Ruby contains a flaw that allows a remote
-  attacker to traverse outside of a restricted path. The issue is due
-  to the program not properly sanitizing user input, specifically
-  directory traversal style attacks (e.g., ../../) supplied via the
-  'to' parameter within the delivery method. This directory traversal
-  attack would allow the attacker to modify arbitrary files.
-
-cvss_v2: 5.0
-
-patched_versions:
-  - ">= 2.4.4"

data/data/bundler/audit/mail/2012-2140.yml

@@ -1,13 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/81632
-title: Mail Gem for Ruby Multiple Delivery Method Remote Shell Command Executio
-
-description: > 
-  Mail Gem for Ruby contains a flaw that occurs within
-  the sendmail and exim delivery methods, which may allow an attacker
-  to execute arbitrary shell commands..
-
-cvss_v2: 7.5
-
-patched_versions:
-  - ">= 2.4.4"

data/data/bundler/audit/rack-cache/2012-267.yml

@@ -1,14 +0,0 @@
----
-url: http://osvdb.org/83077
-title: rack-cache Rubygem Sensitive HTTP Header Caching Weakness 
-
-description: | 
-  Rack::Cache (rack-cache) contains a flaw related to the
-  rubygem caching sensitive HTTP headers. This will result in a
-  weakness that may make it easier for an attacker to gain access to a
-  user's session via a specially crafted header.
-
-cvss_v2: 7.5
-
-patched_versions:
-  - ">= 1.2"

data/data/bundler/audit/rails/2012-1098.yml

@@ -1,19 +0,0 @@
----
-url: http://osvdb.org/79726
-title: Ruby on Rails SafeBuffer Object [] Direct Manipulation XSS 
-
-description: >
-  Ruby on Rails contains a flaw that allows a remote cross-site
-  scripting (XSS) attack. This flaw exists because athe application
-  does not validate direct manipulations of SafeBuffer objects via
-  '[]' and other methods. This may allow a user to create a specially
-  crafted request that would execute arbitrary script code in a user's
-  browser within the trust relationship between their browser and the
-  server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.0.12
-  - ~> 3.1.4
-  - ">= 3.2.2"

data/data/bundler/audit/rails/2012-1099.yml

@@ -1,19 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/79727
-title: Ruby on Rails actionpack/lib/action_view/helpers/form_options_helper.rb Manually Generated Select Tag Options XSS
-
-description: >
-  Ruby on Rails contains a flaw that allows a remote cross-site
-  scripting (XSS) attack. This flaw exists because the application does
-  not validate manually generated 'select tag options' upon submission
-  to actionpack/lib/action_view/helpers/form_options_helper.rb. This may
-  allow a user to create a specially crafted request that would execute
-  arbitrary script code in a user's browser within the trust
-  relationship between their browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.0.12
-  - ~> 3.1.4
-  - ">= 3.2.2"

data/data/bundler/audit/rails/2012-2660.yml

@@ -1,17 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/82610
-title: Ruby on Rails ActiveRecord Class Rack Query Parameter Parsing SQL Query Arbitrary IS NULL Clause Injection 
-
-description: >
-  Ruby on Rails contains a flaw related to the way ActiveRecord handles
-  parameters in conjunction with the way Rack parses query parameters.
-  This issue may allow an attacker to inject arbitrary 'IS NULL' clauses
-  in to application SQL queries. This may also allow an attacker to have
-  the SQL query check for NULL in arbitrary places.
-
-cvss_v2: 7.5
-
-patched_versions:
-  - ~> 3.0.13
-  - ~> 3.1.5
-  - ">= 3.2.4"

data/data/bundler/audit/rails/2012-2661.yml

@@ -1,18 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/82403
-title: Ruby on Rails where Method ActiveRecord Class SQL Injection 
-
-description: > 
-  Ruby on Rails (RoR) contains a flaw that may allow an attacker to
-  carry out an SQL injection attack. The issue is due to the
-  ActiveRecord class not properly sanitizing user-supplied input to
-  the 'where' method. This may allow an attacker to inject or
-  manipulate SQL queries in an application built on RoR, allowing for
-  the manipulation or disclosure of arbitrary data.
-
-cvss_v2: 5.0
-
-patched_versions:
-  - ~> 3.0.13
-  - ~> 3.1.5
-  - ">= 3.2.4"

data/data/bundler/audit/rails/2012-3463.yml

@@ -1,19 +0,0 @@
----
-url: http://osvdb.org/84515
-title: Ruby on Rails select_tag Helper Method prompt Value XSS 
-
-description: >
-  Ruby on Rails contains a flaw that allows a remote cross-site
-  scripting (XSS) attack. This flaw exists because input passed via the
-  prompt value is not properly sanitized by the select_tag helper method
-  before returning it to the user. This may allow a user to create a
-  specially crafted request that would execute arbitrary script code in
-  a user's browser within the trust relationship between their browser
-  and the server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.0.17
-  - ~> 3.1.8
-  - ">= 3.2.8"

data/data/bundler/audit/rails/2012-3464.yml

@@ -1,18 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/84516
-title: Ruby on Rails HTML Escaping Code XSS 
-
-description: > 
-  Ruby on Rails contains a flaw that allows a remote
-  cross-site scripting (XSS) attack. This flaw exists because the HTML
-  escaping code functionality does not properly escape a single quote
-  character. This may allow a user to create a specially crafted
-  request that would execute arbitrary script code in a user's browser
-  within the trust relationship between their browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.0.17
-  - ~> 3.1.8
-  - ">= 3.2.8"

data/data/bundler/audit/rails/2012-3465.yml

@@ -1,19 +0,0 @@
----
-url: http://www.osvdb.org/show/osvdb/84513
-title: Ruby on Rails strip_tags Helper Method XSS 
-
-description: >
-  Ruby on Rails contains a flaw that allows a remote cross-site
-  scripting (XSS) attack. This flaw exists because the application
-  does not validate input passed via the 'strip_tags' helper method
-  before returning it to the user. This may allow a user to create a
-  specially crafted request that would execute arbitrary script code
-  in a user's browser within the trust relationship between their
-  browser and the server.
-
-cvss_v2: 4.3
-
-patched_versions:
-  - ~> 3.0.17
-  - ~> 3.1.8
-  - ">= 3.2.8"

data/spec/bundle/Gemfile.lock

@@ -1,92 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actionmailer (3.2.10)
-      actionpack (= 3.2.10)
-      mail (~> 2.4.4)
-    actionpack (3.2.10)
-      activemodel (= 3.2.10)
-      activesupport (= 3.2.10)
-      builder (~> 3.0.0)
-      erubis (~> 2.7.0)
-      journey (~> 1.0.4)
-      rack (~> 1.4.0)
-      rack-cache (~> 1.2)
-      rack-test (~> 0.6.1)
-      sprockets (~> 2.2.1)
-    activemodel (3.2.10)
-      activesupport (= 3.2.10)
-      builder (~> 3.0.0)
-    activerecord (3.2.10)
-      activemodel (= 3.2.10)
-      activesupport (= 3.2.10)
-      arel (~> 3.0.2)
-      tzinfo (~> 0.3.29)
-    activeresource (3.2.10)
-      activemodel (= 3.2.10)
-      activesupport (= 3.2.10)
-    activesupport (3.2.10)
-      i18n (~> 0.6)
-      multi_json (~> 1.0)
-    arel (3.0.2)
-    builder (3.0.4)
-    erubis (2.7.0)
-    hike (1.2.1)
-    i18n (0.6.1)
-    journey (1.0.4)
-    jquery-rails (2.2.0)
-      railties (>= 3.0, < 5.0)
-      thor (>= 0.14, < 2.0)
-    json (1.7.6)
-    mail (2.4.4)
-      i18n (>= 0.4.0)
-      mime-types (~> 1.16)
-      treetop (~> 1.4.8)
-    mime-types (1.20.1)
-    multi_json (1.5.0)
-    polyglot (0.3.3)
-    rack (1.4.4)
-    rack-cache (1.2)
-      rack (>= 0.4)
-    rack-ssl (1.3.3)
-      rack
-    rack-test (0.6.2)
-      rack (>= 1.0)
-    rails (3.2.10)
-      actionmailer (= 3.2.10)
-      actionpack (= 3.2.10)
-      activerecord (= 3.2.10)
-      activeresource (= 3.2.10)
-      activesupport (= 3.2.10)
-      bundler (~> 1.0)
-      railties (= 3.2.10)
-    railties (3.2.10)
-      actionpack (= 3.2.10)
-      activesupport (= 3.2.10)
-      rack-ssl (~> 1.3.2)
-      rake (>= 0.8.7)
-      rdoc (~> 3.4)
-      thor (>= 0.14.6, < 2.0)
-    rake (10.0.3)
-    rdoc (3.12.1)
-      json (~> 1.4)
-    sprockets (2.2.2)
-      hike (~> 1.2)
-      multi_json (~> 1.0)
-      rack (~> 1.0)
-      tilt (~> 1.1, != 1.3.0)
-    sqlite3 (1.3.7)
-    thor (0.17.0)
-    tilt (1.3.3)
-    treetop (1.4.12)
-      polyglot
-      polyglot (>= 0.3.1)
-    tzinfo (0.3.35)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  jquery-rails
-  rails (= 3.2.10)
-  sqlite3