bundler-audit 0.7.0.1 → 0.8.0.rc1

data/lib/bundler/audit/task.rb

@@ -17,12 +17,10 @@ module Bundler
       #
       def define
         namespace :bundle do
-          desc 'Updates the ruby-advisory-db then runs bundle-audit'
+          desc 'Checks the Gemfile.lock for insecure dependencies'
           task :audit do
             require 'bundler/audit/cli'
-            %w(update check).each do |command|
-              Bundler::Audit::CLI.start [command]
-            end
+            Bundler::Audit::CLI.start %w[check]
           end
         end
       end

data/lib/bundler/audit/version.rb

@@ -18,6 +18,6 @@
 module Bundler
   module Audit
     # bundler-audit version
-    VERSION = '0.7.0.1'
+    VERSION = '0.8.0.rc1'
   end
 end

data/spec/advisory_spec.rb

@@ -3,12 +3,15 @@ require 'bundler/audit/database'
 require 'bundler/audit/advisory'
 
 describe Bundler::Audit::Advisory do
-  let(:root) { Bundler::Audit::Database::VENDORED_PATH }
-  let(:gem)  { 'actionpack' }
-  let(:id)   { 'CVE-2012-3424' }
-  let(:path) { File.join(root,'gems',gem,"#{id}.yml") }
-  let(:an_unaffected_version) do
-    Bundler::Audit::Advisory.load(path).unaffected_versions.map { |version_rule|
+  let(:root) { Fixtures::DATABASE_PATH }
+  let(:gem)  { 'test' }
+  let(:id)   { 'CVE-2020-1234' }
+  let(:path) { Fixtures.join('advisory',"#{id}.yml") }
+
+  subject { described_class.load(path) }
+
+  let(:a_patched_version) do
+    subject.patched_versions.map { |version_rule|
       # For all the rules, get the individual constraints out and see if we
       # can find a suitable one...
       version_rule.requirements.select { |(constraint, gem_version)|
@@ -24,7 +27,22 @@ describe Bundler::Audit::Advisory do
     }.flatten.first
   end
 
-  subject { described_class.load(path) }
+  let(:an_unaffected_version) do
+    subject.unaffected_versions.map { |version_rule|
+      # For all the rules, get the individual constraints out and see if we
+      # can find a suitable one...
+      version_rule.requirements.select { |(constraint, gem_version)|
+        # We only want constraints where the version number specified is
+        # one of the unaffected version.  I.E. we don't want ">", "<", or if
+        # such a thing exists, "!=" constraints.
+        ['~>', '>=', '=', '<='].include?(constraint)
+      }.map { |(constraint, gem_version)|
+        # Fetch just the version component, which is a Gem::Version,
+        # and extract the string representation of the version.
+        gem_version.version
+      }
+    }.flatten.first
+  end
 
   describe "load" do
     let(:data) { YAML.load_file(path) }
@@ -65,8 +83,11 @@ describe Bundler::Audit::Advisory do
     end
 
     context "YAML data not representing a hash" do
+      let(:path ) do
+        File.expand_path('../fixtures/advisory/not_a_hash.yml', __FILE__)
+      end
+
       it "should raise an exception" do
-        path = File.expand_path('../fixtures/not_a_hash.yml', __FILE__)
         expect {
           Advisory.load(path)
         }.to raise_exception("advisory data in #{path.dump} was not a Hash")
@@ -281,7 +302,7 @@ describe Bundler::Audit::Advisory do
 
   describe "#patched?" do
     context "when passed a version that matches one patched version" do
-      let(:version) { Gem::Version.new('3.1.11') }
+      let(:version) { Gem::Version.new(a_patched_version) }
 
       it "should return true" do
         expect(subject.patched?(version)).to be_truthy
@@ -289,7 +310,7 @@ describe Bundler::Audit::Advisory do
     end
 
     context "when passed a version that matches no patched version" do
-      let(:version) { Gem::Version.new('2.9.0') }
+      let(:version) { Gem::Version.new('0.1.1') }
 
       it "should return false" do
         expect(subject.patched?(version)).to be_falsey
@@ -299,7 +320,7 @@ describe Bundler::Audit::Advisory do
 
   describe "#vulnerable?" do
     context "when passed a version that matches one patched version" do
-      let(:version) { Gem::Version.new('3.1.11') }
+      let(:version) { Gem::Version.new(a_patched_version) }
 
       it "should return false" do
         expect(subject.vulnerable?(version)).to be_falsey
@@ -307,15 +328,13 @@ describe Bundler::Audit::Advisory do
     end
 
     context "when passed a version that matches no patched version" do
-      let(:version) { Gem::Version.new('2.9.0') }
+      let(:version) { Gem::Version.new('0.1.1') }
 
       it "should return true" do
         expect(subject.vulnerable?(version)).to be_truthy
       end
 
       context "when unaffected_versions is not empty" do
-        subject { described_class.load(path) }
-
         context "when passed a version that matches one unaffected version" do
           let(:version) { Gem::Version.new(an_unaffected_version) }
 
@@ -325,7 +344,7 @@ describe Bundler::Audit::Advisory do
         end
 
         context "when passed a version that matches no unaffected version" do
-          let(:version) { Gem::Version.new('1.2.3') }
+          let(:version) { Gem::Version.new('0.1.0') }
 
           it "should return true" do
             expect(subject.vulnerable?(version)).to be_truthy

data/spec/bundle/unpatched_gems_with_dot_configuration/.bundler-audit.yml

@@ -0,0 +1,3 @@
+---
+ignore:
+- OSVDB-89025

data/spec/bundle/unpatched_gems_with_dot_configuration/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gem 'activerecord', '3.2.10'

data/spec/cli/formats/json_spec.rb

@@ -0,0 +1,113 @@
+require 'spec_helper'
+require 'bundler/audit/cli/formats'
+require 'bundler/audit/cli/formats/json'
+require 'bundler/audit/report'
+
+describe Bundler::Audit::CLI::Formats::JSON do
+  it "must register the 'json' format" do
+    expect(Bundler::Audit::CLI::Formats[:json]).to be described_class
+  end
+
+  let(:options) { {} }
+
+  subject do
+    Bundler::Audit::CLI.new([],options).tap do |obj|
+      obj.extend described_class
+    end
+  end
+
+  describe "#print_report" do
+    let(:report) { Bundler::Audit::Report.new }
+    let(:stdout) { StringIO.new }
+
+    before { subject.print_report(report,stdout) }
+
+    let(:output) { stdout.string }
+    let(:output_json) { JSON.parse(output, symbolize_names: true) }
+
+    it "must output a JSON hash" do
+      expect(output_json).to be_kind_of(Hash)
+    end
+
+    it 'must output a "version" key with the Bundler::Audit::VERSION' do
+      expect(output_json[:version]).to be == Bundler::Audit::VERSION
+    end
+
+    it 'must output a "created_at" key with the Report#created_at timestamp' do
+      expect(output_json[:created_at]).to be == report.created_at.to_s
+    end
+
+    context "when vulnerabilities were found" do
+      context "when the report contains InsecureSources" do
+        let(:uri) { URI('git://github.com/foo/bar.git') }
+        let(:insecure_source) do
+          Bundler::Audit::Results::InsecureSource.new(uri)
+        end
+
+        let(:report) do
+          super().tap do |report|
+            report << insecure_source
+          end
+        end
+
+        it 'must output the InsecureSource as JSON in the "results" Array' do
+          expect(output_json[:results]).to be_kind_of(Array)
+          expect(output_json[:results][0]).to be_kind_of(Hash)
+          expect(output_json[:results][0][:type]).to be == 'insecure_source'
+          expect(output_json[:results][0][:source]).to be == uri.to_s
+        end
+      end
+
+      context "when the report contains UnpatchedGems" do
+        let(:gem) do
+          Gem::Specification.new do |spec|
+            spec.name = 'test'
+            spec.version = '0.1.0'
+          end
+        end
+
+        let(:advisory) do
+          Bundler::Audit::Advisory.load(Fixtures.join('advisory','CVE-2020-1234.yml'))
+        end
+        let(:unpatched_gem) do
+          Bundler::Audit::Results::UnpatchedGem.new(gem,advisory)
+        end
+
+        let(:report) do
+          super().tap do |report|
+            report << unpatched_gem
+          end
+        end
+
+        it 'must output the UnpatchedGem as JSON in the "results" Array' do
+          expect(output_json[:results]).to be_kind_of(Array)
+          expect(output_json[:results][0]).to be_kind_of(Hash)
+          expect(output_json[:results][0][:type]).to be == 'unpatched_gem'
+          expect(output_json[:results][0][:gem]).to be_kind_of(Hash)
+          expect(output_json[:results][0][:gem][:name]).to be == gem.name
+          expect(output_json[:results][0][:gem][:version]).to be == gem.version.to_s
+          expect(output_json[:results][0][:advisory]).to be_kind_of(Hash)
+          expect(output_json[:results][0][:advisory][:path]).to be == advisory.path
+          expect(output_json[:results][0][:advisory][:id]).to be == advisory.id
+          expect(output_json[:results][0][:advisory][:url]).to be == advisory.url
+          expect(output_json[:results][0][:advisory][:title]).to be == advisory.title
+          expect(output_json[:results][0][:advisory][:date]).to be == advisory.date.to_s
+          expect(output_json[:results][0][:advisory][:description]).to be == advisory.description
+          expect(output_json[:results][0][:advisory][:cvss_v2]).to be == advisory.cvss_v2
+          expect(output_json[:results][0][:advisory][:cve]).to be == advisory.cve
+          expect(output_json[:results][0][:advisory][:osvdb]).to be == advisory.osvdb
+          expect(output_json[:results][0][:advisory][:ghsa]).to be == advisory.ghsa
+          expect(output_json[:results][0][:advisory][:unaffected_versions]).to be == advisory.unaffected_versions.map(&:to_s)
+          expect(output_json[:results][0][:advisory][:patched_versions]).to be == advisory.patched_versions.map(&:to_s)
+        end
+      end
+    end
+
+    context "when no vulnerabilities were found" do
+      it 'must output an "results" key with an empty Array' do
+        expect(output_json[:results]).to be_kind_of(Array)
+        expect(output_json[:results]).to be_empty
+      end
+    end
+  end
+end

data/spec/cli/formats/text_spec.rb

@@ -0,0 +1,179 @@
+require 'spec_helper'
+require 'bundler/audit/cli/formats'
+require 'bundler/audit/cli/formats/text'
+require 'bundler/audit/report'
+
+describe Bundler::Audit::CLI::Formats::Text do
+  it "must register the 'text' format" do
+    expect(Bundler::Audit::CLI::Formats[:text]).to be described_class
+  end
+
+  let(:options) { {} }
+
+  subject do
+    Bundler::Audit::CLI.new([],options).tap do |obj|
+      obj.extend described_class
+    end
+  end
+
+  describe "#print_report" do
+    let(:report) { Bundler::Audit::Report.new }
+    let(:stdout) { StringIO.new }
+
+    before { subject.print_report(report,stdout) }
+
+    let(:output) { stdout.string }
+    let(:output_lines) { output.lines.map(&:chomp) }
+
+    context "when vulnerabilities were found" do
+      context "when the report contains InsecureSources" do
+        let(:uri) { URI('git://github.com/foo/bar.git') }
+        let(:insecure_source) do
+          Bundler::Audit::Results::InsecureSource.new(uri)
+        end
+
+        let(:report) do
+          super().tap do |report|
+            report << insecure_source
+          end
+        end
+
+        it 'must print "Insecure Source URI found: ..."' do
+          expect(output_lines).to include("Insecure Source URI found: #{uri}")
+        end
+
+        it 'must print "Vulnerabilities found!"' do
+          expect(output_lines).to include("Vulnerabilities found!")
+        end
+      end
+
+      context "when the report contains UnpatchedGems" do
+        let(:gem) do
+          Gem::Specification.new do |spec|
+            spec.name = 'test'
+            spec.version = '0.1.0'
+          end
+        end
+
+        let(:advisory) do
+          Bundler::Audit::Advisory.load(Fixtures.join('advisory','CVE-2020-1234.yml'))
+        end
+        let(:unpatched_gem) do
+          Bundler::Audit::Results::UnpatchedGem.new(gem,advisory)
+        end
+
+        let(:report) do
+          super().tap do |report|
+            report << unpatched_gem
+          end
+        end
+
+        it "must print 'Name: ...'" do
+          expect(output_lines).to include("Name: #{gem.name}")
+        end
+
+        it "must print 'Version: ...'" do
+          expect(output_lines).to include("Version: #{gem.version}")
+        end
+
+        it "must print 'Advisory: CVE-YYYY-NNNN'" do
+          expect(output_lines).to include("Advisory: CVE-#{advisory.cve}")
+        end
+
+        context "when Advisory#criticality is :low" do
+          let(:advisory) do
+            super().tap do |advisory|
+              advisory.cvss_v2 = 0.0
+            end
+          end
+
+          it "must print 'Criticality: Low'" do
+            expect(output_lines).to include("Criticality: Low")
+          end
+        end
+
+        context "when Advisory#criticality is :medium" do
+          let(:advisory) do
+            super().tap do |advisory|
+              advisory.cvss_v2 = 6.9
+            end
+          end
+
+          it "must print 'Criticality: Medium'" do
+            expect(output_lines).to include("Criticality: Medium")
+          end
+        end
+
+        context "when Advisory#criticality is :high" do
+          let(:advisory) do
+            super().tap do |advisory|
+              advisory.cvss_v2 = 10.0
+            end
+          end
+
+          it "must print 'Criticality: High'" do
+            expect(output_lines).to include("Criticality: High")
+          end
+        end
+
+        it "must print 'URL: ...'" do
+          expect(output_lines).to include("URL: #{advisory.url}")
+        end
+
+        context "when :verbose is enabled" do
+          let(:options) { {verbose: true} }
+
+          it 'must print "Description:" and the advisory description' do
+            expect(output_lines).to include("Description:","","  #{advisory.description.chomp}",'')
+          end
+        end
+
+        context "when :verbose is not enabled" do
+          it 'must print "Title:" and the advisory description' do
+            expect(output_lines).to include("Title: #{advisory.title}")
+          end
+        end
+
+        context "when Advisory#patched_versions is not empty" do
+          it 'must print "Solution: upgrade to ..."' do
+            expect(output_lines).to include("Solution: upgrade to #{advisory.patched_versions.join(', ')}")
+          end
+        end
+
+        context "when Advisory#patched_versions is empty" do
+          let(:advisory) do
+            super().tap do |advisory|
+              advisory.patched_versions = []
+            end
+          end
+
+          it 'must print "Solution: remove or disable this gem until a patch is available!"' do
+            expect(output_lines).to include("Solution: remove or disable this gem until a patch is available!")
+          end
+        end
+
+        it 'must print "Vulnerabilities found!"' do
+          expect(output_lines).to include("Vulnerabilities found!")
+        end
+      end
+    end
+
+    context "when no vulnerabilities were found" do
+      it 'must print "No vulnerabilities found"' do
+        expect(output_lines).to include('No vulnerabilities found')
+      end
+
+      context "when :quiet is enabled" do
+        let(:options) { {quiet: true} }
+
+        it "should print nothing" do
+          expect(output_lines).to be_empty
+        end
+      end
+    end
+
+    it "must restore $stdout" do
+      expect($stdout).to_not be(stdout)
+    end
+  end
+end

data/spec/cli/formats_spec.rb

@@ -0,0 +1,86 @@
+require 'spec_helper'
+require 'bundler/audit/cli/formats'
+
+describe Bundler::Audit::CLI::Formats do
+  describe ".[]" do
+    context "when given the name of a registered format" do
+      it "should return the format" do
+        expect(subject[:text]).to be described_class::Text
+      end
+    end
+
+    context "when given an unknown name" do
+      it { expect(subject[:foo]).to be(nil) }
+    end
+  end
+
+  describe ".register" do
+    context "when given a valid format module" do
+      module GoodModule
+        def print_report(report)
+        end
+      end
+
+      let(:name)   { :good_module }
+      let(:format) { GoodModule   }
+
+      it "should register the module" do
+        subject.register name, format
+
+        expect(subject[name]).to be format
+      end
+    end
+
+    context "when given a format module that does not define #print_report" do
+      module BadModule
+        def pront_report(report)
+        end
+      end
+
+      let(:name)   { :bad_module }
+      let(:format) { BadModule   }
+
+      it do
+        expect { subject.register(name,format) }.to raise_error(
+          NotImplementedError, "#{format.inspect} does not define #print_report"
+        )
+      end
+    end
+  end
+
+  describe ".load" do
+    LIB_DIR = File.expand_path('../fixtures/lib',File.dirname(__FILE__))
+
+    before(:all) { $LOAD_PATH.unshift(LIB_DIR) }
+
+    context "when given the name of a valid format" do
+      let(:name) { :good }
+
+      it "should require and return the format" do
+        expect(subject.load(name)).to be described_class::Good
+      end
+    end
+
+    context "when given the name of a non-existant format" do
+      let(:name) { :foo }
+
+      it do
+        expect { subject.load(name) }.to raise_error(
+          described_class::FormatNotFound, "could not load format \"#{name}\""
+        )
+      end
+    end
+
+    context "when given the name of a printer which incorrectly registers itself" do
+      let(:name) { :bad }
+
+      it do
+        expect { subject.load(name) }.to raise_error(
+          described_class::FormatNotFound, "unknown format \"#{name}\""
+        )
+      end
+    end
+
+    after(:all) { $LOAD_PATH.delete(LIB_DIR) }
+  end
+end