bundler-audit 0.4.0 → 0.7.0.1

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-15845.yml

@@ -0,0 +1,18 @@
+---
+engine: ruby
+cve: 2019-15845
+url: https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
+title: A NUL injection vulnerability of File.fnmatch and File.fnmatch?
+date: 2019-10-01
+description: |
+  Built-in methods File.fnmatch and its alias File.fnmatch? accept the path
+  pattern as their first parameter. When the pattern contains NUL character
+  (\0), the methods recognize that the path pattern ends immediately before the
+  NUL byte. Therefore, a script that uses an external input as the pattern
+  argument, an attacker can make it wrongly match a pathname that is the second
+  parameter.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16201.yml

@@ -0,0 +1,15 @@
+---
+engine: ruby
+cve: 2019-16201
+url: https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
+title: Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication
+date: 2019-10-01
+description: |
+  Regular expression denial of service vulnerability of WEBrick’s Digest
+  authentication module was found. An attacker can exploit this vulnerability
+  to cause an effective denial of service against a WEBrick service.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16254.yml

@@ -0,0 +1,19 @@
+---
+engine: ruby
+cve: 2019-16254
+url: https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/
+title: HTTP response splitting in WEBrick (Additional fix)
+date: 2019-10-01
+description: |
+  If a program using WEBrick inserts untrusted input into the response header,
+  an attacker can exploit it to insert a newline character to split a header,
+  and inject malicious content to deceive clients.
+
+  This is the same issue as CVE-2017-17742. The previous fix was incomplete,
+  which addressed the CRLF vector, but did not address an isolated CR or an
+  isolated LF.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16255.yml

@@ -0,0 +1,20 @@
+---
+engine: ruby
+cve: 2019-16255
+url: https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
+title: A code injection vulnerability of Shell#[] and Shell#test
+date: 2019-10-01
+description: |
+  Shell#[] and its alias Shell#test defined in lib/shell.rb allow code
+  injection if the first argument (aka the “command” argument) is untrusted
+  data. An attacker can exploit this to call an arbitrary Ruby method.
+
+  Note that passing untrusted data to methods of Shell is dangerous in general.
+  Users must never do it. However, we treat this particular case as a
+  vulnerability because the purpose of Shell#[] and Shell#[] is considered file
+  testing.
+patched_versions:
+  - "~> 2.4.8"
+  - "~> 2.5.7"
+  - "~> 2.6.5"
+  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10663.yml

@@ -0,0 +1,29 @@
+---
+engine: ruby
+cve: 2020-10663
+url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
+title: Unsafe Object Creation Vulnerability in JSON (Additional fix)
+date: 2020-03-19
+description: |
+  When parsing certain JSON documents, the json gem (including the one bundled
+  with Ruby) can be coerced into creating arbitrary objects in the target
+  system.
+
+  This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
+  addressed `JSON.parse(user_input)`, but didn’t address some other styles of JSON
+  parsing including `JSON(user_input)` and `JSON.parse(user_input, nil)`.
+
+  See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
+  Denial of Service by creating many garbage-uncollectable Symbol objects, but
+  this kind of attack is no longer valid because Symbol objects are now
+  garbage-collectable. However, creating arbitrary objects may cause severe
+  security consequences depending upon the application code.
+
+  Please update the json gem to version 2.3.0 or later. You can use `gem update
+  json` to update it. If you are using bundler, please add `gem "json", ">= 2.3.0"`
+  to your Gemfile
+patched_versions:
+  - "~> 2.4.10"
+  - "~> 2.5.8"
+  - "~> 2.6.6"
+  - ">= 2.7.1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10933.yml

@@ -0,0 +1,25 @@
+---
+engine: ruby
+cve: 2020-10933
+url: https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/
+title: Heap exposure vulnerability in the socket library
+date: 2020-03-31
+description: |
+  A heap exposure vulnerability was discovered in the socket library. This
+  vulnerability has been assigned the CVE identifier CVE-2020-10933. We
+  strongly recommend upgrading Ruby.
+
+  When `BasicSocket#recv_nonblock` and `BasicSocket#read_nonblock` are invoked with
+  size and buffer arguments, they initially resize the buffer to the specified
+  size. In cases where the operation would block, they return without copying
+  any data. Thus, the buffer string will now include arbitrary data from the
+  heap. This may expose possibly sensitive data from the interpreter.
+
+  This issue is exploitable only on Linux. This issue had been since Ruby
+  2.5.0; 2.4 series is not vulnerable.
+patched_versions:
+  - "~> 2.5.8"
+  - "~> 2.6.6"
+  - ">= 2.7.1"
+unaffected_versions:
+  - "~> 2.4.0"

data/data/ruby-advisory-db/scripts/post-advisories.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -o errexit -o nounset
+
+REPO="https://${GH_TOKEN}@github.com/rubysec/rubysec.github.io.git"
+DIR="_site"
+
+git clone $REPO $DIR
+
+cd $DIR
+
+git config user.name "RubySec CI"
+git config user.email "ci@rubysec.com"
+
+bundle install --jobs=3 --retry=3
+bundle exec rake advisories
+
+git push -q

data/data/ruby-advisory-db/spec/advisories_spec.rb

@@ -0,0 +1,23 @@
+load File.join(File.dirname(__FILE__), 'spec_helper.rb')
+require 'gem_example'
+require 'library_example'
+require 'ruby_example'
+
+describe "gems" do
+  Dir.glob(File.join(File.dirname(__FILE__), '../gems/*/*')) do |path|
+    include_examples 'Gem Advisory', path
+  end
+end
+
+describe "libraries" do
+  Dir.glob(File.join(File.dirname(__FILE__), '../libraries/*/*')) do |path|
+    include_examples 'Libraries Advisory', path
+  end
+end
+
+describe "rubies" do
+  Dir.glob(File.join(File.dirname(__FILE__), '../rubies/*/*')) do |path|
+    include_examples 'Rubies Advisory', path
+  end
+end
+

data/data/ruby-advisory-db/spec/advisory_example.rb

@@ -5,38 +5,40 @@ shared_examples_for 'Advisory' do |path|
   advisory = YAML.load_file(path)
 
   describe path do
-    let(:gem) { File.basename(File.dirname(path)) }
+    let(:filename) { File.basename(path) }
+
     let(:filename_cve) do
-      if File.basename(path).start_with?('CVE-')
-        File.basename(path).gsub('CVE-','').chomp('.yml')
-      else
-        nil
+      if filename.start_with?('CVE-')
+        filename.gsub('CVE-','')
       end
     end
+
     let(:filename_osvdb) do
-      if File.basename(path).start_with?('OSVDB-')
-        File.basename(path).gsub('OSVDB-','').chomp('.yml')
-      else
-        nil
+      if filename.start_with?('OSVDB-')
+        filename.gsub('OSVDB-','')
       end
     end
-
-    it "should have CVE or OSVDB" do
-      (advisory['cve'] || advisory['osvdb']).should_not be_nil
+    
+    let(:filename_ghsa) do
+      if filename.start_with?('GHSA-')
+        filename.gsub('GHSA-','')
+      end
     end
 
-    describe "gem" do
-      subject { advisory['gem'] }
+    it "should be correctly named CVE-XXX or OSVDB-XXX or GHSA-XXX" do
+      expect(filename).
+        to match(/^(CVE-\d{4}-(0\d{3}|[1-9]\d{3,})|OSVDB-\d+|GHSA(-[a-z0-9]{4}){3})\.yml$/)
+    end
 
-      it { should be_kind_of(String) }
-      it { should == gem }
+    it "should have CVE or OSVDB or GHSA" do
+      expect(advisory['cve'] || advisory['osvdb'] || advisory['ghsa']).not_to be_nil
     end
 
     describe "framework" do
       subject { advisory['framework'] }
 
       it "may be nil or a String" do
-        [NilClass, String].should include(subject.class)
+        expect(subject).to be_kind_of(String).or(be_nil)
       end
     end
 
@@ -44,7 +46,7 @@ shared_examples_for 'Advisory' do |path|
       subject { advisory['platform'] }
 
       it "may be nil or a String" do
-        [NilClass, String].should include(subject.class)
+        expect(subject).to be_kind_of(String).or(be_nil)
       end
     end
 
@@ -52,23 +54,38 @@ shared_examples_for 'Advisory' do |path|
       subject { advisory['cve'] }
 
       it "may be nil or a String" do
-        [NilClass, String].should include(subject.class)
+        expect(subject).to be_kind_of(String).or(be_nil)
       end
       it "should be id in filename if filename is CVE-XXX" do
         if filename_cve
-          should == filename_cve
+          is_expected.to eq(filename_cve.chomp('.yml'))
         end
       end
     end
 
     describe "osvdb" do
       subject { advisory['osvdb'] }
-      it "may be nil or a Fixnum" do
-        [NilClass, Fixnum].should include(subject.class)
+
+      it "may be nil or a Integer" do
+        expect(subject).to be_kind_of(Integer).or(be_nil)
       end
+
        it "should be id in filename if filename is OSVDB-XXX" do
         if filename_osvdb
-          should == filename_osvdb.to_i
+          is_expected.to eq(filename_osvdb.to_i)
+        end
+      end
+    end
+    
+    describe "ghsa" do
+      subject { advisory['ghsa'] }
+
+      it "may be nil or a String" do
+        expect(subject).to be_kind_of(String).or(be_nil)
+      end
+      it "should be id in filename if filename is GHSA-XXX" do
+        if filename_ghsa
+          is_expected.to eq(filename_ghsa.chomp('.yml'))
         end
       end
     end
@@ -76,41 +93,62 @@ shared_examples_for 'Advisory' do |path|
     describe "url" do
       subject { advisory['url'] }
 
-      it { should be_kind_of(String) }
-      it { should_not be_empty }
+      it { is_expected.to be_kind_of(String) }
+      it { is_expected.not_to be_empty }
     end
 
     describe "title" do
       subject { advisory['title'] }
 
-      it { should be_kind_of(String) }
-      it { should_not be_empty }
+      it { is_expected.to be_kind_of(String) }
+      it { is_expected.not_to be_empty }
     end
 
     describe "date" do
       subject { advisory['date'] }
 
-      it { should be_kind_of(Date) }
+      it { is_expected.to be_kind_of(Date) }
     end
 
     describe "description" do
       subject { advisory['description'] }
 
-      it { should be_kind_of(String) }
-      it { should_not be_empty }
+      it { is_expected.to be_kind_of(String) }
+      it { is_expected.not_to be_empty }
     end
 
     describe "cvss_v2" do
       subject { advisory['cvss_v2'] }
 
       it "may be nil or a Float" do
-        [NilClass, Float].should include(subject.class)
+        expect(subject).to be_kind_of(Float).or(be_nil)
       end
 
       case advisory['cvss_v2']
       when Float
         context "when a Float" do
-          it { ((0.0)..(10.0)).should include(subject) }
+          it { expect((0.0)..(10.0)).to include(subject) }
+        end
+      end
+    end
+
+    describe "cvss_v3" do
+      subject { advisory['cvss_v3'] }
+
+      it "may be nil or a Float" do
+        expect(subject).to be_kind_of(Float).or(be_nil)
+      end
+
+      case advisory['cvss_v3']
+      when Float
+        context "when a Float" do
+          it { expect((0.0)..(10.0)).to include(subject) }
+        end
+      end
+
+      if advisory['cvss_v2']
+        it "should also provide a cvss_v2 score" do
+          expect(advisory['cvss_v2']).to_not be_nil
         end
       end
     end
@@ -119,7 +157,7 @@ shared_examples_for 'Advisory' do |path|
       subject { advisory['patched_versions'] }
 
       it "may be nil or an Array" do
-        [NilClass, Array].should include(subject.class)
+        expect(subject).to be_kind_of(Array).or(be_nil)
       end
 
       describe "each patched version" do
@@ -127,11 +165,11 @@ shared_examples_for 'Advisory' do |path|
           advisory['patched_versions'].each do |version|
             describe version do
               subject { version.split(', ') }
-              
+
               it "should contain valid RubyGem version requirements" do
-                lambda {
+                expect {
                 Gem::Requirement.new(*subject)
-                }.should_not raise_error
+                }.not_to raise_error
               end
             end
           end
@@ -143,7 +181,7 @@ shared_examples_for 'Advisory' do |path|
       subject { advisory['unaffected_versions'] }
 
       it "may be nil or an Array" do
-        [NilClass, Array].should include(subject.class)
+        expect(subject).to be_kind_of(Array).or(be_nil)
       end
 
       case advisory['unaffected_versions']
@@ -151,15 +189,40 @@ shared_examples_for 'Advisory' do |path|
         advisory['unaffected_versions'].each do |version|
           describe version do
             subject { version.split(', ') }
-            
+
             it "should contain valid RubyGem version requirements" do
-              lambda {
+              expect {
                 Gem::Requirement.new(*subject)
-              }.should_not raise_error
+              }.not_to raise_error
+            end
+          end
+        end
+      end
+    end
+
+    describe "related" do
+      subject { advisory['related'] }
+
+      it "may be nil or a Hash" do
+        expect(subject).to be_kind_of(Hash).or(be_nil)
+      end
+
+      case advisory["related"]
+      when Hash
+        advisory["related"].each_pair do |name, values|
+          describe name do
+            it "should be either a cve, an osvdb, a ghsa, or a url" do
+              expect(["cve", "osvdb", "ghsa", "url"]).to include(name)
+            end
+
+            it "should always contain an array" do
+              expect(values).to be_kind_of(Array)
             end
           end
         end
       end
     end
+
+
   end
 end

data/data/ruby-advisory-db/spec/gem_example.rb

@@ -0,0 +1,44 @@
+load File.join(File.dirname(__FILE__), 'spec_helper.rb')
+require 'advisory_example'
+
+shared_examples_for "Gem Advisory" do |path|
+  include_examples 'Advisory', path
+
+  advisory = YAML.load_file(path)
+
+  describe path do
+    let(:gem) { File.basename(File.dirname(path)) }
+
+    describe "gem" do
+      subject { advisory['gem'] }
+
+      it { is_expected.to be_kind_of(String) }
+      it "should be equal to filename (case-insensitive)" do
+        expect(subject.downcase).to eq(gem.downcase)
+      end
+    end
+
+    describe "versions" do
+      it "assumes that future versions will be patched" do
+        unaffected_versions = advisory['unaffected_versions'] || []
+        patched_versions    = advisory['patched_versions'] || []
+
+        versions = (unaffected_versions + patched_versions).sort_by do |v|
+          Gem::Version.new(v.match(/[0-9.]+\.\d+/)[0])
+        end
+
+        # If a gem is unpatched this test makes no sense
+        unless patched_versions.none?
+          expect(versions.last.match(/^>=|^>/)).to be_truthy
+        end
+      end
+    end
+
+    it "should have valid schema" do
+      schema = YAML.load_file(File.join(File.dirname(__FILE__), 'schemas/gem.yml'))
+      validator = Kwalify::Validator.new(schema)
+      errors = validator.validate(advisory)
+      expect(errors).to be_empty
+    end
+  end
+end