bundler-audit 0.7.0.1 → 0.9.0

data/Rakefile

@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 require 'rubygems'
 
 begin
@@ -14,29 +12,6 @@ require 'time'
 require 'rubygems/tasks'
 Gem::Tasks.new
 
-directory 'data/ruby-advisory-db' do
-  sh 'git', 'submodule', 'update', '--init'
-end
-
-namespace :db do
-  desc 'Updates data/ruby-advisory-db'
-  task :update => 'data/ruuby-advsisory-db' do
-    timestamp = nil
-
-    chdir 'data/ruby-advisory-db' do
-      sh 'git', 'pull', 'origin', 'master'
-
-      File.open('../ruby-advisory-db.ts','w') do |file|
-        file.write Time.parse(`git log --date=iso8601 --pretty="%cd" -1`).utc
-      end
-    end
-
-    sh 'git', 'commit', 'data/ruby-advisory-db',
-                        'data/ruby-advisory-db.ts',
-                        '-m', 'Updated ruby-advisory-db'
-  end
-end
-
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new
 
@@ -59,5 +34,11 @@ task :test    => :spec
 task :default => :spec
 
 require 'yard'
-YARD::Rake::YardocTask.new  
+YARD::Rake::YardocTask.new
 task :doc => :yard
+
+require 'bundler/audit/task'
+Bundler::Audit::Task.new
+
+require 'rubocop/rake_task'
+RuboCop::RakeTask.new

data/bundler-audit.gemspec

@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 require 'yaml'
 
 Gem::Specification.new do |gem|
@@ -23,15 +21,9 @@ Gem::Specification.new do |gem|
 
   glob = lambda { |patterns| gem.files & Dir[*patterns] }
 
-  gem.files = `git ls-files`.split($/)
-  gem.files = glob[gemspec['files']] if gemspec['files']
-
-  # add paths from data/ruby-advisory-db/
-  gem.files += Dir.chdir('data/ruby-advisory-db') do
-    `git ls-files`.split($/).map do |sub_path|
-      File.join('data','ruby-advisory-db',sub_path)
-    end
-  end
+  gem.files = if gemspec['files'] then glob[gemspec['files']]
+              else                     `git ls-files`.split($/)
+              end
 
   gem.executables = gemspec.fetch('executables') do
     glob['bin/*'].map { |path| File.basename(path) }

data/gemspec.yml

@@ -6,9 +6,9 @@ authors: Postmodern
 email: postmodern.mod3@gmail.com
 homepage: https://github.com/rubysec/bundler-audit#readme
 
-required_ruby_version: ">= 1.9.3"
+required_ruby_version: ">= 2.0.0"
 required_rubygems_version: ">= 1.8.0"
 
 dependencies:
-  thor: ">= 0.18, < 2"
+  thor: "~> 1.0"
   bundler: ">= 1.2.0, < 3"

data/lib/bundler/audit/advisory.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -12,13 +12,16 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+# along with bundler-audit.  If not, see <https://www.gnu.org/licenses/>.
 #
 
 require 'yaml'
 
 module Bundler
   module Audit
+    #
+    # Represents an advisory loaded from the {Database}.
+    #
     class Advisory < Struct.new(:path,
                                 :id,
                                 :url,
@@ -45,7 +48,9 @@ module Bundler
       #
       def self.load(path)
         id   = File.basename(path).chomp('.yml')
-        data = YAML.load_file(path)
+        data = File.open(path) do |yaml|
+                 YAML.safe_load(yaml, permitted_classes: [Date])
+               end
 
         unless data.kind_of?(Hash)
           raise("advisory data in #{path.dump} was not a Hash")
@@ -121,7 +126,7 @@ module Bundler
       #
       # Determines how critical the vulnerability is.
       #
-      # @return [:none, :low, :medium, :high, :critical]
+      # @return [:none, :low, :medium, :high, :critical, nil]
       #   The criticality of the vulnerability based on the CVSS score.
       #
       def criticality
@@ -189,6 +194,28 @@ module Bundler
         !patched?(version) && !unaffected?(version)
       end
 
+      #
+      # Compares two advisories.
+      #
+      # @param [Advisory] other
+      #
+      # @return [Boolean]
+      #
+      def ==(other)
+        id == other.id
+      end
+
+      #
+      # Converts the advisory to a Hash.
+      #
+      # @return [Hash{Symbol => Object}]
+      #
+      def to_h
+        super.merge({
+          criticality: criticality
+        })
+      end
+
       alias to_s id
 
     end

data/lib/bundler/audit/cli/formats/json.rb

@@ -0,0 +1,65 @@
+#
+# Copyright (c) 2013-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'thor'
+require 'json'
+
+module Bundler
+  module Audit
+    class CLI < ::Thor
+      module Formats
+        #
+        # The JSON output format.
+        #
+        module JSON
+          #
+          # Outputs the report as JSON. Will pretty-print JSON if `output`
+          # is a TTY, otherwise normal JSON will be outputted.
+          #
+          # @param [Report] report
+          #   The results from the {Scanner}.
+          #
+          # @param [IO, File] output
+          #   The output stream.
+          #
+          def print_report(report,output=$stdout)
+            hash = report.to_h
+
+            if output.tty?
+              output.puts(::JSON.pretty_generate(hash))
+            else
+              output.write(::JSON.generate(hash))
+            end
+          end
+
+          def criticality_label(advisory)
+            case advisory.criticality
+            when :none     then "none"
+            when :low      then "low"
+            when :medium   then "medium"
+            when :high     then "high"
+            when :critical then "critical"
+            else "unknown"
+            end
+          end
+        end
+
+        Formats.register :json, JSON
+      end
+    end
+  end
+end

data/lib/bundler/audit/cli/formats/junit.rb

@@ -0,0 +1,127 @@
+#
+# Copyright (c) 2013-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'thor'
+require 'cgi'
+
+module Bundler
+  module Audit
+    class CLI < ::Thor
+      module Formats
+        module Junit
+          #
+          # Prints any findings as an XML junit report.
+          #
+          # @param [Report] report
+          #   The results from the {Scanner}.
+          #
+          # @param [IO, File] output
+          #   Optional output stream.
+          #
+          def print_report(report, output=$stdout)
+            original_stdout = $stdout
+            $stdout = output
+
+            print_xml_testsuite(report) do
+              report.each do |result|
+                print_xml_testcase(result)
+              end
+            end
+
+            $stdout = original_stdout
+          end
+
+          private
+
+          def say_xml(*lines)
+            say(lines.join($/))
+          end
+
+          def print_xml_testsuite(report)
+            say_xml(
+              %{<?xml version="1.0" encoding="UTF-8" ?>},
+              %{<testsuites id="#{Time.now.to_i}" name="Bundle Audit">},
+              %{  <testsuite id="Gemfile" name="Ruby Gemfile" failures="#{report.count}">}
+            )
+
+            yield
+
+            say_xml(
+              %{  </testsuite>},
+              %{</testsuites>}
+            )
+          end
+
+          def xml(string)
+            CGI.escapeHTML(string.to_s)
+          end
+
+          def print_xml_testcase(result)
+            case result
+            when Results::InsecureSource
+              say_xml(
+                %{    <testcase id="#{xml(result.source)}" name="Insecure Source URI found: #{xml(result.source)}">},
+                %{      <failure message="Insecure Source URI found: #{xml(result.source)}" type="Unknown"></failure>},
+                %{    </testcase>}
+              )
+            when Results::UnpatchedGem
+              say_xml(
+                %{    <testcase id="#{xml(result.gem.name)}" name="#{xml(bundle_title(result))}">},
+                %{      <failure message="#{xml(result.advisory.title)}" type="#{xml(result.advisory.criticality)}">},
+                %{        Name: #{xml(result.gem.name)}},
+                %{        Version: #{xml(result.gem.version)}},
+                %{        Advisory: #{xml(advisory_ref(result.advisory))}},
+                %{        Criticality: #{xml(advisory_criticality(result.advisory))}},
+                %{        URL: #{xml(result.advisory.url)}},
+                %{        Title: #{xml(result.advisory.title)}},
+                %{        Solution: #{xml(advisory_solution(result.advisory))}},
+                %{      </failure>},
+                %{    </testcase>}
+              )
+            end
+          end
+
+          def bundle_title(result)
+            "#{advisory_criticality(result.advisory).upcase} #{result.gem.name}(#{result.gem.version}) #{result.advisory.title}"
+          end
+
+          def advisory_solution(advisory)
+            unless advisory.patched_versions.empty?
+              "upgrade to #{advisory.patched_versions.join(', ')}"
+            else
+              "remove or disable this gem until a patch is available!"
+            end
+          end
+
+          def advisory_criticality(advisory)
+            if advisory.criticality
+              advisory.criticality.to_s.capitalize
+            else
+              "Unknown"
+            end
+          end
+
+          def advisory_ref(advisory)
+            advisory.identifiers.join(" ")
+          end
+
+          Formats.register :junit, Junit
+        end
+      end
+    end
+  end
+end

data/lib/bundler/audit/cli/formats/text.rb

@@ -0,0 +1,122 @@
+#
+# Copyright (c) 2013-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'thor'
+
+module Bundler
+  module Audit
+    class CLI < ::Thor
+      module Formats
+        #
+        # The plain-text output format.
+        #
+        module Text
+          #
+          # Prints any findings as plain-text.
+          #
+          # @param [Report] report
+          #   The results from the {Scanner}.
+          #
+          # @param [IO, File] output
+          #   Optional output stream.
+          #
+          def print_report(report,output=$stdout)
+            original_stdout = $stdout
+            $stdout = output
+
+            report.each do |result|
+              case result
+              when Results::InsecureSource
+                print_warning "Insecure Source URI found: #{result.source}"
+              when Results::UnpatchedGem
+                print_advisory result.gem, result.advisory
+              end
+            end
+
+            if report.vulnerable?
+              say "Vulnerabilities found!", :red
+            else
+              say("No vulnerabilities found", :green) unless options.quiet?
+            end
+
+            $stdout = original_stdout
+          end
+
+          private
+
+          def print_warning(message)
+            say message, :yellow
+          end
+
+          def print_advisory(gem, advisory)
+            say "Name: ", :red
+            say gem.name
+
+            say "Version: ", :red
+            say gem.version
+
+            if advisory.cve
+              say "CVE: ", :red
+              say advisory.cve_id
+            end
+
+            if advisory.ghsa
+              say "GHSA: ", :red
+              say advisory.ghsa_id
+            end
+
+            say "Criticality: ", :red
+            case advisory.criticality
+            when :none     then say "None"
+            when :low      then say "Low"
+            when :medium   then say "Medium", :yellow
+            when :high     then say "High", [:red, :bold]
+            when :critical then say "Critical", [:red, :bold]
+            else                say "Unknown"
+            end
+
+            say "URL: ", :red
+            say advisory.url
+
+            if options.verbose?
+              say "Description:", :red
+              say
+
+              print_wrapped advisory.description, indent: 2
+              say
+            else
+              say "Title: ", :red
+              say advisory.title
+            end
+
+            unless advisory.patched_versions.empty?
+              say "Solution: upgrade to ", :red
+              say advisory.patched_versions.join(', ')
+            else
+              say "Solution: ", :red
+              say "remove or disable this gem until a patch is available!", [:red, :bold]
+            end
+
+            say
+          end
+        end
+
+        Formats.register :text, Text
+      end
+    end
+  end
+end