bundler-audit 0.7.0.1 → 0.9.0

data/data/ruby-advisory-db/rubies/ruby/CVE-2018-8780.yml

@@ -1,22 +0,0 @@
----
-engine: ruby
-cve: 2018-8780
-url: https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-dir-cve-2018-8780/
-title: Unintentional directory traversal by poisoned NUL byte in Dir
-date: 2018-03-28
-description: |
-  There is an unintentional directory traversal in some methods in `Dir`
-
-  `Dir.open`, `Dir.new`, `Dir.entries` and `Dir.empty?` accept the path of the
-  target directory as their parameter. If the parameter contains NUL (`\0`)
-  bytes, these methods recognize that the path is completed before the NUL bytes.
-  So, if a script accepts an external input as the argument of these methods, the
-  attacker can make the unintentional directory traversal.
-
-  All users running an affected release should upgrade immediately.
-patched_versions:
-  - "~> 2.2.10"
-  - "~> 2.3.7"
-  - "~> 2.4.4"
-  - "~> 2.5.1"
-  - "> 2.6.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-15845.yml

@@ -1,18 +0,0 @@
----
-engine: ruby
-cve: 2019-15845
-url: https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/
-title: A NUL injection vulnerability of File.fnmatch and File.fnmatch?
-date: 2019-10-01
-description: |
-  Built-in methods File.fnmatch and its alias File.fnmatch? accept the path
-  pattern as their first parameter. When the pattern contains NUL character
-  (\0), the methods recognize that the path pattern ends immediately before the
-  NUL byte. Therefore, a script that uses an external input as the pattern
-  argument, an attacker can make it wrongly match a pathname that is the second
-  parameter.
-patched_versions:
-  - "~> 2.4.8"
-  - "~> 2.5.7"
-  - "~> 2.6.5"
-  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16201.yml

@@ -1,15 +0,0 @@
----
-engine: ruby
-cve: 2019-16201
-url: https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/
-title: Regular Expression Denial of Service vulnerability of WEBrick's Digest access authentication
-date: 2019-10-01
-description: |
-  Regular expression denial of service vulnerability of WEBrick’s Digest
-  authentication module was found. An attacker can exploit this vulnerability
-  to cause an effective denial of service against a WEBrick service.
-patched_versions:
-  - "~> 2.4.8"
-  - "~> 2.5.7"
-  - "~> 2.6.5"
-  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16254.yml

@@ -1,19 +0,0 @@
----
-engine: ruby
-cve: 2019-16254
-url: https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/
-title: HTTP response splitting in WEBrick (Additional fix)
-date: 2019-10-01
-description: |
-  If a program using WEBrick inserts untrusted input into the response header,
-  an attacker can exploit it to insert a newline character to split a header,
-  and inject malicious content to deceive clients.
-
-  This is the same issue as CVE-2017-17742. The previous fix was incomplete,
-  which addressed the CRLF vector, but did not address an isolated CR or an
-  isolated LF.
-patched_versions:
-  - "~> 2.4.8"
-  - "~> 2.5.7"
-  - "~> 2.6.5"
-  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2019-16255.yml

@@ -1,20 +0,0 @@
----
-engine: ruby
-cve: 2019-16255
-url: https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/
-title: A code injection vulnerability of Shell#[] and Shell#test
-date: 2019-10-01
-description: |
-  Shell#[] and its alias Shell#test defined in lib/shell.rb allow code
-  injection if the first argument (aka the “command” argument) is untrusted
-  data. An attacker can exploit this to call an arbitrary Ruby method.
-
-  Note that passing untrusted data to methods of Shell is dangerous in general.
-  Users must never do it. However, we treat this particular case as a
-  vulnerability because the purpose of Shell#[] and Shell#[] is considered file
-  testing.
-patched_versions:
-  - "~> 2.4.8"
-  - "~> 2.5.7"
-  - "~> 2.6.5"
-  - "> 2.7.0-preview1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10663.yml

@@ -1,29 +0,0 @@
----
-engine: ruby
-cve: 2020-10663
-url: https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
-title: Unsafe Object Creation Vulnerability in JSON (Additional fix)
-date: 2020-03-19
-description: |
-  When parsing certain JSON documents, the json gem (including the one bundled
-  with Ruby) can be coerced into creating arbitrary objects in the target
-  system.
-
-  This is the same issue as CVE-2013-0269. The previous fix was incomplete, which
-  addressed `JSON.parse(user_input)`, but didn’t address some other styles of JSON
-  parsing including `JSON(user_input)` and `JSON.parse(user_input, nil)`.
-
-  See CVE-2013-0269 in detail. Note that the issue was exploitable to cause a
-  Denial of Service by creating many garbage-uncollectable Symbol objects, but
-  this kind of attack is no longer valid because Symbol objects are now
-  garbage-collectable. However, creating arbitrary objects may cause severe
-  security consequences depending upon the application code.
-
-  Please update the json gem to version 2.3.0 or later. You can use `gem update
-  json` to update it. If you are using bundler, please add `gem "json", ">= 2.3.0"`
-  to your Gemfile
-patched_versions:
-  - "~> 2.4.10"
-  - "~> 2.5.8"
-  - "~> 2.6.6"
-  - ">= 2.7.1"

data/data/ruby-advisory-db/rubies/ruby/CVE-2020-10933.yml

@@ -1,25 +0,0 @@
----
-engine: ruby
-cve: 2020-10933
-url: https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/
-title: Heap exposure vulnerability in the socket library
-date: 2020-03-31
-description: |
-  A heap exposure vulnerability was discovered in the socket library. This
-  vulnerability has been assigned the CVE identifier CVE-2020-10933. We
-  strongly recommend upgrading Ruby.
-
-  When `BasicSocket#recv_nonblock` and `BasicSocket#read_nonblock` are invoked with
-  size and buffer arguments, they initially resize the buffer to the specified
-  size. In cases where the operation would block, they return without copying
-  any data. Thus, the buffer string will now include arbitrary data from the
-  heap. This may expose possibly sensitive data from the interpreter.
-
-  This issue is exploitable only on Linux. This issue had been since Ruby
-  2.5.0; 2.4 series is not vulnerable.
-patched_versions:
-  - "~> 2.5.8"
-  - "~> 2.6.6"
-  - ">= 2.7.1"
-unaffected_versions:
-  - "~> 2.4.0"

data/data/ruby-advisory-db/scripts/post-advisories.sh

@@ -1,18 +0,0 @@
-#!/bin/bash
-
-set -o errexit -o nounset
-
-REPO="https://${GH_TOKEN}@github.com/rubysec/rubysec.github.io.git"
-DIR="_site"
-
-git clone $REPO $DIR
-
-cd $DIR
-
-git config user.name "RubySec CI"
-git config user.email "ci@rubysec.com"
-
-bundle install --jobs=3 --retry=3
-bundle exec rake advisories
-
-git push -q

data/data/ruby-advisory-db/spec/advisories_spec.rb

@@ -1,23 +0,0 @@
-load File.join(File.dirname(__FILE__), 'spec_helper.rb')
-require 'gem_example'
-require 'library_example'
-require 'ruby_example'
-
-describe "gems" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../gems/*/*')) do |path|
-    include_examples 'Gem Advisory', path
-  end
-end
-
-describe "libraries" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../libraries/*/*')) do |path|
-    include_examples 'Libraries Advisory', path
-  end
-end
-
-describe "rubies" do
-  Dir.glob(File.join(File.dirname(__FILE__), '../rubies/*/*')) do |path|
-    include_examples 'Rubies Advisory', path
-  end
-end
-

data/data/ruby-advisory-db/spec/advisory_example.rb

@@ -1,228 +0,0 @@
-load File.join(File.dirname(__FILE__), 'spec_helper.rb')
-require 'yaml'
-
-shared_examples_for 'Advisory' do |path|
-  advisory = YAML.load_file(path)
-
-  describe path do
-    let(:filename) { File.basename(path) }
-
-    let(:filename_cve) do
-      if filename.start_with?('CVE-')
-        filename.gsub('CVE-','')
-      end
-    end
-
-    let(:filename_osvdb) do
-      if filename.start_with?('OSVDB-')
-        filename.gsub('OSVDB-','')
-      end
-    end
-    
-    let(:filename_ghsa) do
-      if filename.start_with?('GHSA-')
-        filename.gsub('GHSA-','')
-      end
-    end
-
-    it "should be correctly named CVE-XXX or OSVDB-XXX or GHSA-XXX" do
-      expect(filename).
-        to match(/^(CVE-\d{4}-(0\d{3}|[1-9]\d{3,})|OSVDB-\d+|GHSA(-[a-z0-9]{4}){3})\.yml$/)
-    end
-
-    it "should have CVE or OSVDB or GHSA" do
-      expect(advisory['cve'] || advisory['osvdb'] || advisory['ghsa']).not_to be_nil
-    end
-
-    describe "framework" do
-      subject { advisory['framework'] }
-
-      it "may be nil or a String" do
-        expect(subject).to be_kind_of(String).or(be_nil)
-      end
-    end
-
-    describe "platform" do
-      subject { advisory['platform'] }
-
-      it "may be nil or a String" do
-        expect(subject).to be_kind_of(String).or(be_nil)
-      end
-    end
-
-    describe "cve" do
-      subject { advisory['cve'] }
-
-      it "may be nil or a String" do
-        expect(subject).to be_kind_of(String).or(be_nil)
-      end
-      it "should be id in filename if filename is CVE-XXX" do
-        if filename_cve
-          is_expected.to eq(filename_cve.chomp('.yml'))
-        end
-      end
-    end
-
-    describe "osvdb" do
-      subject { advisory['osvdb'] }
-
-      it "may be nil or a Integer" do
-        expect(subject).to be_kind_of(Integer).or(be_nil)
-      end
-
-       it "should be id in filename if filename is OSVDB-XXX" do
-        if filename_osvdb
-          is_expected.to eq(filename_osvdb.to_i)
-        end
-      end
-    end
-    
-    describe "ghsa" do
-      subject { advisory['ghsa'] }
-
-      it "may be nil or a String" do
-        expect(subject).to be_kind_of(String).or(be_nil)
-      end
-      it "should be id in filename if filename is GHSA-XXX" do
-        if filename_ghsa
-          is_expected.to eq(filename_ghsa.chomp('.yml'))
-        end
-      end
-    end
-
-    describe "url" do
-      subject { advisory['url'] }
-
-      it { is_expected.to be_kind_of(String) }
-      it { is_expected.not_to be_empty }
-    end
-
-    describe "title" do
-      subject { advisory['title'] }
-
-      it { is_expected.to be_kind_of(String) }
-      it { is_expected.not_to be_empty }
-    end
-
-    describe "date" do
-      subject { advisory['date'] }
-
-      it { is_expected.to be_kind_of(Date) }
-    end
-
-    describe "description" do
-      subject { advisory['description'] }
-
-      it { is_expected.to be_kind_of(String) }
-      it { is_expected.not_to be_empty }
-    end
-
-    describe "cvss_v2" do
-      subject { advisory['cvss_v2'] }
-
-      it "may be nil or a Float" do
-        expect(subject).to be_kind_of(Float).or(be_nil)
-      end
-
-      case advisory['cvss_v2']
-      when Float
-        context "when a Float" do
-          it { expect((0.0)..(10.0)).to include(subject) }
-        end
-      end
-    end
-
-    describe "cvss_v3" do
-      subject { advisory['cvss_v3'] }
-
-      it "may be nil or a Float" do
-        expect(subject).to be_kind_of(Float).or(be_nil)
-      end
-
-      case advisory['cvss_v3']
-      when Float
-        context "when a Float" do
-          it { expect((0.0)..(10.0)).to include(subject) }
-        end
-      end
-
-      if advisory['cvss_v2']
-        it "should also provide a cvss_v2 score" do
-          expect(advisory['cvss_v2']).to_not be_nil
-        end
-      end
-    end
-
-    describe "patched_versions" do
-      subject { advisory['patched_versions'] }
-
-      it "may be nil or an Array" do
-        expect(subject).to be_kind_of(Array).or(be_nil)
-      end
-
-      describe "each patched version" do
-        if advisory['patched_versions']
-          advisory['patched_versions'].each do |version|
-            describe version do
-              subject { version.split(', ') }
-
-              it "should contain valid RubyGem version requirements" do
-                expect {
-                Gem::Requirement.new(*subject)
-                }.not_to raise_error
-              end
-            end
-          end
-        end
-      end
-    end
-
-    describe "unaffected_versions" do
-      subject { advisory['unaffected_versions'] }
-
-      it "may be nil or an Array" do
-        expect(subject).to be_kind_of(Array).or(be_nil)
-      end
-
-      case advisory['unaffected_versions']
-      when Array
-        advisory['unaffected_versions'].each do |version|
-          describe version do
-            subject { version.split(', ') }
-
-            it "should contain valid RubyGem version requirements" do
-              expect {
-                Gem::Requirement.new(*subject)
-              }.not_to raise_error
-            end
-          end
-        end
-      end
-    end
-
-    describe "related" do
-      subject { advisory['related'] }
-
-      it "may be nil or a Hash" do
-        expect(subject).to be_kind_of(Hash).or(be_nil)
-      end
-
-      case advisory["related"]
-      when Hash
-        advisory["related"].each_pair do |name, values|
-          describe name do
-            it "should be either a cve, an osvdb, a ghsa, or a url" do
-              expect(["cve", "osvdb", "ghsa", "url"]).to include(name)
-            end
-
-            it "should always contain an array" do
-              expect(values).to be_kind_of(Array)
-            end
-          end
-        end
-      end
-    end
-
-
-  end
-end

data/data/ruby-advisory-db/spec/gem_example.rb

@@ -1,44 +0,0 @@
-load File.join(File.dirname(__FILE__), 'spec_helper.rb')
-require 'advisory_example'
-
-shared_examples_for "Gem Advisory" do |path|
-  include_examples 'Advisory', path
-
-  advisory = YAML.load_file(path)
-
-  describe path do
-    let(:gem) { File.basename(File.dirname(path)) }
-
-    describe "gem" do
-      subject { advisory['gem'] }
-
-      it { is_expected.to be_kind_of(String) }
-      it "should be equal to filename (case-insensitive)" do
-        expect(subject.downcase).to eq(gem.downcase)
-      end
-    end
-
-    describe "versions" do
-      it "assumes that future versions will be patched" do
-        unaffected_versions = advisory['unaffected_versions'] || []
-        patched_versions    = advisory['patched_versions'] || []
-
-        versions = (unaffected_versions + patched_versions).sort_by do |v|
-          Gem::Version.new(v.match(/[0-9.]+\.\d+/)[0])
-        end
-
-        # If a gem is unpatched this test makes no sense
-        unless patched_versions.none?
-          expect(versions.last.match(/^>=|^>/)).to be_truthy
-        end
-      end
-    end
-
-    it "should have valid schema" do
-      schema = YAML.load_file(File.join(File.dirname(__FILE__), 'schemas/gem.yml'))
-      validator = Kwalify::Validator.new(schema)
-      errors = validator.validate(advisory)
-      expect(errors).to be_empty
-    end
-  end
-end