bundler-audit 0.4.0 → 0.7.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 9660b06fce10c2532f0c7aaa5fef6ca2d5c99067
-  data.tar.gz: 751d7e542727defa267b6d8abf2ad0b3f391ab70
+SHA256:
+  metadata.gz: c1c2ead83ab8d3dac034093a5ac034fbf3235fed7077e47c2f491a9f8fa24d6c
+  data.tar.gz: c520084f591d25b66f1524a1bfaa900297a6c4517e000f38ce46bc66fbdb812a
 SHA512:
-  metadata.gz: 2a3cb90acc0cecc82ee931fedd43ab4d0439fd2436bc29563a45a4a328862c9038f243f7bff68a9e394bb0c12fee6f83b1496347187783b3a6d972435169dbf3
-  data.tar.gz: 89a771db86e3baf43430b5448bee5664e1b73f017fed9c48756ea8a58f6f4515c761d4c46333a93e9bcde71e3c6777271ec799a933d5662a76df9504a29dd09d
+  metadata.gz: becd1a0bf6735ab08c3db5bd18199ceea5682e240a18ea2da88b8f9ff7c121ca11e5912613b559dc5916ff5db3e8e1d93627ead52e5a5bfc9f89ea574efb867d
+  data.tar.gz: 8a111e0b5e19eff5777bbe117560cc16f6d70a113fbb3d5059457557647a31ecef80f54956bb4f44d866d970579ed1fe19b0279aceed5355100b95a307a79491

data/.gitignore

@@ -5,7 +5,6 @@ doc/
 .yardoc/
 coverage/
 pkg/
-spec/bundle/*/Gemfile.lock
 spec/bundle/*/.bundle/
 vendor/bundle/
 tmp/

data/.travis.yml

@@ -1,7 +1,14 @@
+language: ruby
 rvm:
-  - 1.9.3
-  - 2.0
-  - 2.1
-  - 2.2
-before_install:
-  - gem install rspec
+  - 2.3
+  - 2.4
+  - 2.5
+  - 2.6
+  - 2.7
+  - jruby
+  - truffleruby
+
+matrix:
+  allow_failures:
+    - rvm: jruby
+    - rvm: truffleruby

data/ChangeLog.md

@@ -1,3 +1,44 @@
+### 0.7.0.1 / 2020-06-12
+
+* Forgot to populate `data/ruby-advisory-db`.
+
+### 0.7.0 / 2020-06-12
+
+* Require [thor] >= 0.18, < 2.
+* Added {Bundler::Audit::Advisory#ghsa} (@rschultheis).
+* Added {Bundler::Audit::Advisory#cvss_v3} (@ahamlin-nr).
+* Added {Bundler::Audit::Advisory#identifiers} (@rschultheis).
+* Updated {Bundler::Audit::Advisory#criticality} ranges (@reedloden).
+* Avoid rebasing the ruby-advisory-db when updating (@nicknovitski).
+* Fixed issue with Bundler 2.x where source URIs are no longer parsed as
+  `URI::HTTP` objects, but as `Bundler::URI::HTTP` objects. (@milgner)
+
+### 0.6.1 / 2019-01-17
+
+* Require bundler `>= 1.2.0, < 3` to support [bundler] 2.0.
+
+### 0.6.0 / 2017-07-18
+
+* Added `--quiet` option to `check` and `update` commands (@jaredbeck).
+* Added `bin/bundler-audit` which will be executed when `bundle audit` is ran
+  (@vassilevsky).
+
+### 0.5.0 / 2016-02-28
+
+* Added {Bundler::Audit::Task}.
+* Added {Bundler::Audit::Advisory#date}.
+* Added {Bundler::Audit::Advisory#cve_id}.
+* Added {Bundler::Audit::Advisory#osvdb_id}.
+* Allow insecure gem sources (`http://` and `git://`), if they are hosted on a
+  private network.
+
+#### CLI
+
+* Added the `--update` option to `bundle-audit check`.
+* `bundle-audit update` now returns a non-zero exit status on error.
+* `bundle-audit update` only updates `~/.local/share/ruby-advisory-db`, if it is a git
+  repository.
+
 ### 0.4.0 / 2015-06-30
 
 * Require ruby >= 1.9.3 due to i18n gem deprecating < 1.9.3.
@@ -100,4 +141,5 @@
 * [CVE-2013-0333](http://osvdb.org/show/osvdb/89594)
 
 [bundler]: http://gembundler.com/
+[thor]: http://whatisthor.com/
 [ruby-advisory-db]: https://github.com/rubysec/ruby-advisory-db#readme

data/Gemfile

@@ -3,11 +3,11 @@ source 'https://rubygems.org/'
 gemspec
 
 group :development do
-  gem 'rake',           '~> 10.0'
+  gem 'rake'
   gem 'kramdown',       '~> 0.14'
 
   gem 'rubygems-tasks', '~> 0.2'
   gem 'rspec',          '~> 3.0'
-  gem 'yard',           '~> 0.8'
+  gem 'yard',           '~> 0.9'
   gem 'simplecov',      '~> 0.7', :require => false
 end

data/README.md

@@ -1,15 +1,15 @@
 # bundler-audit
+[![Build Status](https://travis-ci.org/rubysec/bundler-audit.svg?branch=master)](https://travis-ci.org/rubysec/bundler-audit)
+[![Code Climate](https://codeclimate.com/github/rubysec/bundler-audit.svg)](https://codeclimate.com/github/rubysec/bundler-audit)
 
 * [Homepage](https://github.com/rubysec/bundler-audit#readme)
 * [Issues](https://github.com/rubysec/bundler-audit/issues)
 * [Documentation](http://rubydoc.info/gems/bundler-audit/frames)
-* [Email](mailto:rubysec.mod3 at gmail.com)
-* [![Build Status](https://travis-ci.org/rubysec/bundler-audit.png)](https://travis-ci.org/rubysec/bundler-audit)
-* [![Code Climate](https://codeclimate.com/github/rubysec/bundler-audit.png)](https://codeclimate.com/github/rubysec/bundler-audit)
+* [Email](mailto:postmodern.mod3 at gmail.com)
 
 ## Description
 
-Patch-level verification for [Bundler][bundler].
+Patch-level verification for [bundler].
 
 ## Features
 
@@ -21,7 +21,7 @@ Patch-level verification for [Bundler][bundler].
 
 ## Synopsis
 
-Audit a projects `Gemfile.lock`:
+Audit a project's `Gemfile.lock`:
 
     $ bundle-audit
     Name: actionpack
@@ -31,7 +31,7 @@ Audit a projects `Gemfile.lock`:
     URL: http://www.osvdb.org/show/osvdb/91452
     Title: XSS vulnerability in sanitize_css in Action Pack
     Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
-    
+
     Name: actionpack
     Version: 3.2.10
     Advisory: OSVDB-91454
@@ -39,7 +39,7 @@ Audit a projects `Gemfile.lock`:
     URL: http://osvdb.org/show/osvdb/91454
     Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
     Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
-    
+
     Name: actionpack
     Version: 3.2.10
     Advisory: OSVDB-89026
@@ -47,7 +47,7 @@ Audit a projects `Gemfile.lock`:
     URL: http://osvdb.org/show/osvdb/89026
     Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
     Solution: upgrade to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
-    
+
     Name: activerecord
     Version: 3.2.10
     Advisory: OSVDB-91453
@@ -55,7 +55,7 @@ Audit a projects `Gemfile.lock`:
     URL: http://osvdb.org/show/osvdb/91453
     Title: Symbol DoS vulnerability in Active Record
     Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
-    
+
     Name: activerecord
     Version: 3.2.10
     Advisory: OSVDB-90072
@@ -63,7 +63,7 @@ Audit a projects `Gemfile.lock`:
     URL: http://direct.osvdb.org/show/osvdb/90072
     Title: Ruby on Rails Active Record attr_protected Method Bypass
     Solution: upgrade to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
-    
+
     Name: activerecord
     Version: 3.2.10
     Advisory: OSVDB-89025
@@ -71,7 +71,7 @@ Audit a projects `Gemfile.lock`:
     URL: http://osvdb.org/show/osvdb/89025
     Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
     Solution: upgrade to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
-    
+
     Name: activesupport
     Version: 3.2.10
     Advisory: OSVDB-91451
@@ -79,10 +79,10 @@ Audit a projects `Gemfile.lock`:
     URL: http://www.osvdb.org/show/osvdb/91451
     Title: XML Parsing Vulnerability affecting JRuby users
     Solution: upgrade to ~> 3.1.12, >= 3.2.13
-    
+
     Unpatched versions found!
 
-Update the [ruby-advisory-db] that `bundle-audit` uses:
+Update the [ruby-advisory-db] that `bundle audit` uses:
 
     $ bundle-audit update
     Updating ruby-advisory-db ...
@@ -108,24 +108,43 @@ Update the [ruby-advisory-db] that `bundle-audit` uses:
      create mode 100644 gems/wicked/OSVDB-98270.yml
     ruby-advisory-db: 64 advisories
 
+Update the [ruby-advisory-db] and check `Gemfile.lock` (useful for CI runs):
+
+    $ bundle-audit check --update
+
 Ignore specific advisories:
 
     $ bundle-audit check --ignore OSVDB-108664
 
+Rake task:
+
+```ruby
+require 'bundler/audit/task'
+Bundler::Audit::Task.new
+
+task default: 'bundle:audit'
+```
+
 ## Requirements
 
-* [Ruby] >= 1.9.3
-* [RubyGems] >= 1.8
-* [thor] ~> 0.18
+* [ruby] >= 1.9.3
+* [rubygems] >= 1.8
+* [thor] >= 0.18, < 2
 * [bundler] ~> 1.2
 
 ## Install
 
-    $ gem install bundler-audit
+    $ [sudo] gem install bundler-audit
+
+## Contributing
+
+1. Clone the repo
+2. `git submodule update --init` # To populate data/ruby-advisory-db
+3. `bundle exec rake`
 
 ## License
 
-Copyright (c) 2013-2015 Hal Brodigan (postmodern.mod3 at gmail.com)
+Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 
 bundler-audit is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
@@ -140,8 +159,8 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
 
-[Ruby]: https://ruby-lang.org
-[RubyGems]: https://rubygems.org
+[ruby]: https://ruby-lang.org
+[rubygems]: https://rubygems.org
 [thor]: http://whatisthor.com/
 [bundler]: https://github.com/carlhuda/bundler#readme
 

data/Rakefile

@@ -14,16 +14,20 @@ require 'time'
 require 'rubygems/tasks'
 Gem::Tasks.new
 
+directory 'data/ruby-advisory-db' do
+  sh 'git', 'submodule', 'update', '--init'
+end
+
 namespace :db do
   desc 'Updates data/ruby-advisory-db'
-  task :update do
+  task :update => 'data/ruuby-advsisory-db' do
     timestamp = nil
 
     chdir 'data/ruby-advisory-db' do
       sh 'git', 'pull', 'origin', 'master'
 
       File.open('../ruby-advisory-db.ts','w') do |file|
-        file.write Time.parse(`git log --pretty="%cd" -1`).utc
+        file.write Time.parse(`git log --date=iso8601 --pretty="%cd" -1`).utc
       end
     end
 
@@ -36,18 +40,20 @@ end
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new
 
-namespace :spec do
-  task :bundle do
-    root = 'spec/bundle'
+%w[secure unpatched_gems insecure_sources].each do |bundle|
+  bundle_dir   = File.join('spec/bundle',bundle)
+  gemfile      = File.join(bundle_dir,'Gemfile')
+  gemfile_lock = File.join(bundle_dir,'Gemfile.lock')
 
-    %w[secure unpatched_gems insecure_sources].each do |bundle|
-      chdir(File.join(root,bundle)) do
-        sh 'unset BUNDLE_BIN_PATH BUNDLE_GEMFILE RUBYOPT && bundle install --path ../../../vendor/bundle'
-      end
+  file gemfile_lock => gemfile do
+    chdir(bundle_dir) do
+      sh 'unset BUNDLE_BIN_PATH BUNDLE_GEMFILE RUBYOPT && bundle install --path ../../../vendor/bundle'
     end
   end
+
+  desc "Generates the spec/bundler/*/Gemfile.lock files"
+  task 'spec:bundle' => gemfile_lock
 end
-task :spec => 'spec:bundle'
 
 task :test    => :spec
 task :default => :spec

data/bin/bundler-audit

@@ -0,0 +1,3 @@
+#!/usr/bin/env ruby
+
+load File.expand_path('../bundle-audit', __FILE__)

data/data/ruby-advisory-db.ts

@@ -1 +1 @@
-2014-02-11 00:45:58 UTC
+2020-06-12 22:55:28 UTC

data/data/ruby-advisory-db/.gitignore

@@ -1 +1 @@
-Gemfile.lock
+_site

data/data/ruby-advisory-db/.travis.yml

@@ -0,0 +1,12 @@
+language: ruby
+
+sudo: false
+
+cache: bundler
+
+notifications:
+  irc: chat.freenode.net#rubysec
+
+env:
+  global:
+  - secure: ZXwsZdbCej15IcIazEIjy12o5v5EI8/Hle/VP1EabfbHsA5Mw+lrliMAV80C8Iy+p4mI66WIO/3Ovm64L1nGDBGs3dKUjtDvNPCKHlK2xK7AhvkcJnzbjWTAzWZY17STJO45DUdr/vuVbvQZ8llLosSOBs+grGsszCSEIOibqjU=

data/data/ruby-advisory-db/CONTRIBUTING.md

@@ -1,6 +1,71 @@
 # Contributing Guidelines
 
-## Style
+* All text must be within 80 columns.
+* YAML must be indented by 2 spaces.
+* Have any questions? Feel free to open an issue.
+* Prior to submitting a pull request, run the tests:
 
-1. All text must be within 80 columns.
-2. YAML must be indented by 2 spaces.
+```
+bundle install
+bundle exec rspec
+```
+
+* Follow the schema. Here is an example advisory:
+
+```yaml
+    ---
+    gem: examplegem
+    cve: 2013-0156
+    date: 2013-05-01
+    url: https://github.com/rubysec/ruby-advisory-db/issues/123456
+    title: |
+      Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
+      Remote Code Execution
+
+    description: |
+      Ruby on Rails contains a flaw in params_parser.rb of the Action Pack.
+      The issue is triggered when a type casting error occurs during the parsing
+      of parameters. This may allow a remote attacker to potentially execute
+      arbitrary code.
+
+    cvss_v2: 10.0
+    cvss_v3: 9.8
+
+    patched_versions:
+      - ~> 2.3.15
+      - ~> 3.0.19
+      - ~> 3.1.10
+      - ">= 3.2.11"
+    unaffected_versions:
+      - ~> 2.4.3
+
+    related:
+      cve:
+        - 2013-1234567
+        - 2013-1234568
+      url:
+        - https://github.com/rubysec/ruby-advisory-db/issues/123457
+
+```
+### Schema
+
+* `gem` \[String\] (required): Name of the affected gem.
+* `framework` \[String\] (optional): Name of the framework which the affected gem belongs to.
+* `platform` \[String\] (optional): If this vulnerability is platform-specific, name of platform this vulnerability affects (e.g. jruby)
+* `cve` \[String\] (optional): Common Vulnerabilities and Exposures (CVE) ID.
+* `osvdb` \[Integer\] (optional): Open Sourced Vulnerability Database (OSVDB) ID.
+* `ghsa` \[String\] (optional): GitHub Security Advisory (GHSA) ID.
+* `url` \[String\] (required): The URL to the full advisory.
+* `title` \[String\] (required): The title of the advisory or individual vulnerability.
+* `date` \[Date\] (required): The public disclosure date of the advisory.
+* `description` \[String\] (required): One or more paragraphs describing the vulnerability.
+* `cvss_v2` \[Float\] (optional): The [CVSSv2] score for the vulnerability.
+* `cvss_v3` \[Float\] (optional): The [CVSSv3] score for the vulnerability.
+* `unaffected_versions` \[Array\<String\>\] (optional): The version requirements for the
+  unaffected versions of the Ruby library.
+* `patched_versions` \[Array\<String\>\] (optional): The version requirements for the
+  patched versions of the Ruby library.
+* `related` \[Hash\<Array\<String\>\>\] (optional): Sometimes an advisory references many urls and cves. Supported keys: `cve` and `url`
+
+[CVSSv2]: https://www.first.org/cvss/v2/guide
+[CVSSv3]: https://www.first.org/cvss/user-guide

data/data/ruby-advisory-db/CONTRIBUTORS.md

@@ -1,8 +1,7 @@
 ### Acknowledgements
 
-This database would not be possible without volunteers willing to submit pull requests.
+This database would not be possible without volunteers willing to submit pull requests. In no particular order, we'd like to thank:
 
-Thanks,
 * [Postmodern](https://github.com/postmodern/)
 * [Max Veytsman](https://twitter.com/mveytsman)
 * [Pietro Monteiro](https://github.com/pietro)
@@ -21,3 +20,22 @@ Thanks,
 * [Jeremy Olliver](https://github.com/jeremyolliver)
 * [Vasily Vasinov](https://github.com/vasinov)
 * [Phill MV](https://twitter.com/phillmv)
+* [Jon Kessler](https://github.com/jonkessler)
+* [James Harton](https://github.com/jamesotron)
+* [Justin Collins](https://github.com/presidentbeef)
+* [Andy Brody](https://github.com/ab)
+* [Alexey Zapparov](https://github.com/ixti)
+* [Toni Reina](https://github.com/areina)
+* [Bernard Lambeau](https://github.com/blambeau)
+* [Don Morrison](https://github.com/elskwid)
+* [John Poulin](https://github.com/forced-request)
+* [Neal Harris](https://github.com/nealharris)
+* [Justin Bull](https://github.com/f3ndot)
+* [Andrew Selder](https://github.com/aselder)
+* [Vanessa Henderson](https://github.com/VanessaHenderson)
+* [Reed Loden](https://github.com/reedloden)
+* [ecneladis](https://github.com/ecneladis)
+* [Brendan Coles](https://github.com/bcoles)
+* [Florian Wininger](https://github.com/fwininger)
+
+The rubysec.com domain was graciously donated by [Jordi Massaguer](https://github.com/jordimassaguerpla).

data/data/ruby-advisory-db/Gemfile

@@ -1,3 +1,11 @@
 source 'https://rubygems.org'
-gem 'pry'
-gem 'mechanize'
+
+gem 'faraday'
+gem 'rake'
+gem 'kwalify'
+gem 'rspec'
+
+group :development do
+  gem 'pry'
+  gem 'nokogiri'
+end