bundler-audit 0.4.0 → 0.7.0.1

data/data/ruby-advisory-db/spec/library_example.rb

@@ -0,0 +1,21 @@
+load File.join(File.dirname(__FILE__), 'spec_helper.rb')
+require 'advisory_example'
+
+shared_examples_for "Libraries Advisory" do |path|
+  include_examples 'Advisory', path
+
+  advisory = YAML.load_file(path)
+
+  describe path do
+    let(:library) { File.basename(File.dirname(path)) }
+
+    describe "library" do
+      subject { advisory['library'] }
+
+      it { is_expected.to be_kind_of(String) }
+      it "should be equal to filename (case-insensitive)" do
+        expect(subject.downcase).to eq(library.downcase)
+      end
+    end
+  end
+end

data/data/ruby-advisory-db/spec/ruby_example.rb

@@ -0,0 +1,29 @@
+load File.join(File.dirname(__FILE__), 'spec_helper.rb')
+require 'advisory_example'
+
+shared_examples_for "Rubies Advisory" do |path|
+  include_examples 'Advisory', path
+
+  advisory = YAML.load_file(path)
+
+  describe path do
+    let(:engine) { File.basename(File.dirname(path)) }
+
+    describe "engine" do
+      subject { advisory['engine'] }
+
+      it { is_expected.to be_kind_of(String) }
+      it "should be equal to filename (case-insensitive)" do
+        expect(subject.downcase).to eq(engine.downcase)
+      end
+    end
+
+    it "should have valid schema" do
+      schema = YAML.load_file(File.join(File.dirname(__FILE__), 'schemas/ruby.yml'))
+      validator = Kwalify::Validator.new(schema)
+      errors = validator.validate(advisory)
+      expect(errors).to be_empty
+    end
+  end
+end
+

data/data/ruby-advisory-db/spec/schemas/gem.yml

@@ -0,0 +1,71 @@
+type: map
+mapping:
+  "gem":
+    type: str
+    required: yes
+  "library":
+    type: str
+  "framework":
+    type: str
+  "platform":
+    type: str
+  "cve":
+    type: str
+    pattern: /\d+-\d+/
+  "osvdb":
+    type: int
+  "ghsa":
+    type: str
+    pattern: /[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/
+  "url":
+    type: str
+    required: true
+    pattern: /https?:\/\//
+  "title":
+    type: str
+    required: true
+  "date":
+    type: date
+    required: true
+  "description":
+    type: str
+    required: true
+  "cvss_v2":
+    type: float
+  "cvss_v3":
+    type: float
+  "unaffected_versions":
+    type: seq
+    sequence:
+      - type: str
+  "patched_versions":
+    type: seq
+    sequence:
+      - type: str
+  "vendor_patch":
+    type: seq
+    sequence:
+      - type: str
+        pattern: /https?:\/\//
+  "related":
+    type: map
+    mapping:
+      "cve":
+        type: seq
+        sequence:
+          - type: str
+            pattern: /\d+-\d+/
+      "ghsa":
+        type: seq
+        sequence:
+          - type: str
+            pattern: /[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/
+      "osvdb":
+        type: seq
+        sequence:
+          - type: int
+      "url":
+        type: seq
+        sequence:
+          - type: str
+            pattern: /https?:\/\//

data/data/ruby-advisory-db/spec/schemas/ruby.yml

@@ -0,0 +1,36 @@
+type: map
+mapping:
+  "engine":
+    type: str
+    required: yes
+    enum: [jruby, rbx, ruby]
+  "cve":
+    type: str
+    pattern: /\d+-\d+/
+  "osvdb":
+    type: int
+  "url":
+    type: str
+    required: true
+    pattern: /https?:\/\//
+  "title":
+    type: str
+    required: true
+  "date":
+    type: date
+    required: true
+  "description":
+    type: str
+    required: true
+  "cvss_v2":
+    type: float
+  "cvss_v3":
+    type: float
+  "unaffected_versions":
+    type: seq
+    sequence:
+      - type: str
+  "patched_versions":
+    type: seq
+    sequence:
+      - type: str

data/data/ruby-advisory-db/spec/spec_helper.rb

@@ -1 +1,2 @@
+require 'kwalify'
 require 'rspec'

data/gemspec.yml

@@ -1,7 +1,7 @@
 name: bundler-audit
 summary: Patch-level verification for Bundler
 description: bundler-audit provides patch-level verification for Bundled apps.
-license: GPLv3
+license: GPL-3.0+
 authors: Postmodern
 email: postmodern.mod3@gmail.com
 homepage: https://github.com/rubysec/bundler-audit#readme
@@ -10,5 +10,5 @@ required_ruby_version: ">= 1.9.3"
 required_rubygems_version: ">= 1.8.0"
 
 dependencies:
-  thor: ~> 0.18
-  bundler: ~> 1.2
+  thor: ">= 0.18, < 2"
+  bundler: ">= 1.2.0, < 3"

data/lib/bundler/audit.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2015 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

data/lib/bundler/audit/advisory.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2015 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -23,10 +23,13 @@ module Bundler
                                 :id,
                                 :url,
                                 :title,
+                                :date,
                                 :description,
                                 :cvss_v2,
+                                :cvss_v3,
                                 :cve,
                                 :osvdb,
+                                :ghsa,
                                 :unaffected_versions,
                                 :patched_versions)
 
@@ -59,26 +62,83 @@ module Bundler
           id,
           data['url'],
           data['title'],
+          data['date'],
           data['description'],
           data['cvss_v2'],
+          data['cvss_v3'],
           data['cve'],
           data['osvdb'],
+          data['ghsa'],
           parse_versions[data['unaffected_versions']],
           parse_versions[data['patched_versions']]
         )
       end
 
+      #
+      # The CVE identifier.
+      #
+      # @return [String, nil]
+      #
+      def cve_id
+        "CVE-#{cve}" if cve
+      end
+
+      #
+      # The OSVDB identifier.
+      #
+      # @return [String, nil]
+      #
+      def osvdb_id
+        "OSVDB-#{osvdb}" if osvdb
+      end
+
+      #
+      # The GHSA (GitHub Security Advisory) identifier
+      #
+      # @return [String, nil]
+      #
+      # @since 0.7.0
+      #
+      def ghsa_id
+        "GHSA-#{ghsa}" if ghsa
+      end
+
+      #
+      # Return a compacted list of all ids
+      #
+      # @return [Array<String>]
+      #
+      # @since 0.7.0
+      #
+      def identifiers
+        [
+          cve_id,
+          osvdb_id,
+          ghsa_id
+        ].compact
+      end
+
       #
       # Determines how critical the vulnerability is.
       #
-      # @return [:low, :medium, :high]
-      #   The criticality of the vulnerability based on the CVSSv2 score.
+      # @return [:none, :low, :medium, :high, :critical]
+      #   The criticality of the vulnerability based on the CVSS score.
       #
       def criticality
-        case cvss_v2
-        when 0.0..3.3  then :low
-        when 3.3..6.6  then :medium
-        when 6.6..10.0 then :high
+        if cvss_v3
+          case cvss_v3
+          when 0.0       then :none
+          when 0.1..3.9  then :low
+          when 4.0..6.9  then :medium
+          when 7.0..8.9  then :high
+          when 9.0..10.0 then :critical
+          end
+        elsif cvss_v2
+          case cvss_v2
+          when 0.0..3.9  then :low
+          when 4.0..6.9  then :medium
+          when 7.0..10.0 then :high
+          end
         end
       end
 

data/lib/bundler/audit/cli.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2015 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -30,10 +30,14 @@ module Bundler
       map '--version' => :version
 
       desc 'check', 'Checks the Gemfile.lock for insecure dependencies'
+      method_option :quiet, :type => :boolean, :aliases => '-q'
       method_option :verbose, :type => :boolean, :aliases => '-v'
       method_option :ignore, :type => :array, :aliases => '-i'
+      method_option :update, :type => :boolean, :aliases => '-u'
 
       def check
+        update if options[:update]
+
         scanner    = Scanner.new
         vulnerable = false
 
@@ -52,16 +56,33 @@ module Bundler
           say "Vulnerabilities found!", :red
           exit 1
         else
-          say "No vulnerabilities found", :green
+          say("No vulnerabilities found", :green) unless options.quiet?
         end
       end
 
       desc 'update', 'Updates the ruby-advisory-db'
+      method_option :quiet, :type => :boolean, :aliases => '-q'
+
       def update
-        say "Updating ruby-advisory-db ..."
+        say("Updating ruby-advisory-db ...") unless options.quiet?
 
-        Database.update!
-        puts "ruby-advisory-db: #{Database.new.size} advisories"
+        case Database.update!(quiet: options.quiet?)
+        when true
+          say("Updated ruby-advisory-db", :green) unless options.quiet?
+        when false
+          say "Failed updating ruby-advisory-db!", :red
+          exit 1
+        when nil
+          unless Bundler.git_present?
+            say "Git is not installed!", :red
+            exit 1
+          end
+          say "Skipping update", :yellow
+        end
+
+        unless options.quiet?
+          puts("ruby-advisory-db: #{Database.new.size} advisories")
+        end
       end
 
       desc 'version', 'Prints the bundler-audit version'
@@ -92,17 +113,21 @@ module Bundler
         say "Advisory: ", :red
 
         if advisory.cve
-          say "CVE-#{advisory.cve}"
+          say advisory.cve_id
         elsif advisory.osvdb
-          say advisory.osvdb
+          say advisory.osvdb_id
+        elsif advisory.ghsa
+          say advisory.ghsa_id
         end
 
         say "Criticality: ", :red
         case advisory.criticality
-        when :low    then say "Low"
-        when :medium then say "Medium", :yellow
-        when :high   then say "High", [:red, :bold]
-        else              say "Unknown"
+        when :none     then say "None"
+        when :low      then say "Low"
+        when :medium   then say "Medium", :yellow
+        when :high     then say "High", [:red, :bold]
+        when :critical then say "Critical", [:red, :bold]
+        else                say "Unknown"
         end
 
         say "URL: ", :red

data/lib/bundler/audit/database.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2015 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -68,7 +68,7 @@ module Bundler
       #
       def self.path
         if File.directory?(USER_PATH)
-          t1 = Dir.chdir(USER_PATH) { Time.parse(`git log --date=iso8601 --pretty="%cd" -1`) }
+          t1 = Dir.chdir(USER_PATH) { Time.parse(`git log --date=iso8601 --pretty="%cd" -1`).utc }
           t2 = VENDORED_TIMESTAMP
 
           if t1 >= t2 then USER_PATH
@@ -82,21 +82,43 @@ module Bundler
       #
       # Updates the ruby-advisory-db.
       #
-      # @return [Boolean]
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @option options [Boolean] :quiet
+      #   Specify whether `git` should be `--quiet`.
+      #
+      # @return [Boolean, nil]
       #   Specifies whether the update was successful.
+      #   A `nil` indicates no update was performed.
+      #
+      # @raise [ArgumentError]
+      #   Invalid options were given.
       #
       # @note
       #   Requires network access.
       #
       # @since 0.3.0
       #
-      def self.update!
+      def self.update!(options={})
+        unless (options.keys - [:quiet]).empty?
+          raise(ArgumentError,"Invalid option(s)")
+        end
+
         if File.directory?(USER_PATH)
-          Dir.chdir(USER_PATH) do
-            system 'git', 'pull', 'origin', 'master'
+          if File.directory?(File.join(USER_PATH, ".git"))
+            Dir.chdir(USER_PATH) do
+              command = %w(git pull --no-rebase)
+              command << '--quiet' if options[:quiet]
+              command << 'origin' << 'master'
+              system *command
+            end
           end
         else
-          system 'git', 'clone', URL, USER_PATH
+          command = %w(git clone)
+          command << '--quiet' if options[:quiet]
+          command << URL << USER_PATH
+          system *command
         end
       end