bundler-audit 0.7.0.1 → 0.9.0

data/lib/bundler/audit/database.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -12,7 +12,7 @@
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU General Public License
-# along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+# along with bundler-audit.  If not, see <https://www.gnu.org/licenses/>.
 #
 
 require 'bundler/audit/advisory'
@@ -28,17 +28,22 @@ module Bundler
     #
     class Database
 
-      # Git URL of the ruby-advisory-db
-      URL = 'https://github.com/rubysec/ruby-advisory-db.git'
+      class DownloadFailed < RuntimeError
+      end
 
-      # Default path to the ruby-advisory-db
-      VENDORED_PATH =  File.expand_path(File.join(File.dirname(__FILE__),'..','..','..','data','ruby-advisory-db'))
+      class UpdateFailed < RuntimeError
+      end
 
-      # Timestamp for when the database was last updated
-      VENDORED_TIMESTAMP = Time.parse(File.read("#{VENDORED_PATH}.ts")).utc
+      # Git URL of the ruby-advisory-db
+      URL = 'https://github.com/rubysec/ruby-advisory-db.git'
 
       # Path to the user's copy of the ruby-advisory-db
-      USER_PATH = File.expand_path(File.join(ENV['HOME'],'.local','share','ruby-advisory-db'))
+      USER_PATH = File.expand_path(File.join(Gem.user_home,'.local','share','ruby-advisory-db'))
+
+      # Default path to the ruby-advisory-db
+      #
+      # @since 0.8.0
+      DEFAULT_PATH = ENV['BUNDLER_AUDIT_DB'] || USER_PATH
 
       # The path to the advisory database
       attr_reader :path
@@ -67,16 +72,62 @@ module Bundler
       #   The path to the database directory.
       #
       def self.path
-        if File.directory?(USER_PATH)
-          t1 = Dir.chdir(USER_PATH) { Time.parse(`git log --date=iso8601 --pretty="%cd" -1`).utc }
-          t2 = VENDORED_TIMESTAMP
+        DEFAULT_PATH
+      end
 
-          if t1 >= t2 then USER_PATH
-          else             VENDORED_PATH
-          end
-        else
-          VENDORED_PATH
+      #
+      # Tests whether the database exists.
+      #
+      # @param [String] path
+      #   The given path of the database to check.
+      #
+      # @return [Boolean]
+      #
+      # @since 0.8.0
+      #
+      def self.exists?(path=DEFAULT_PATH)
+        File.directory?(path) && !(Dir.entries(path) - %w[. ..]).empty?
+      end
+
+      #
+      # Downloads the ruby-advisory-db.
+      #
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @option options [String] :path (DEFAULT_PATH)
+      #   The destination path for the new ruby-advisory-db.
+      #
+      # @option options [Boolean] :quiet
+      #   Specify whether `git` should be `--quiet`.
+      #
+      # @return [Dataase]
+      #   The newly downloaded database.
+      #
+      # @raise [DownloadFailed]
+      #   Indicates that the download failed.
+      #
+      # @note
+      #   Requires network access.
+      #
+      # @since 0.8.0
+      #
+      def self.download(options={})
+        unless (options.keys - [:path, :quiet]).empty?
+          raise(ArgumentError,"Invalid option(s)")
         end
+
+        path = options.fetch(:path,DEFAULT_PATH)
+
+        command = %w[git clone]
+        command << '--quiet' if options[:quiet]
+        command << URL << path
+
+        unless system(*command)
+          raise(DownloadFailed,"failed to download #{URL} to #{path.inspect}")
+        end
+
+        return new(path)
       end
 
       #
@@ -100,25 +151,97 @@ module Bundler
       #
       # @since 0.3.0
       #
+      # @deprecated Use {#update!} instead.
+      #
       def self.update!(options={})
-        unless (options.keys - [:quiet]).empty?
-          raise(ArgumentError,"Invalid option(s)")
+        raise "Invalid option(s)" unless (options.keys - [:quiet]).empty?
+
+        if File.directory?(DEFAULT_PATH)
+          begin
+            new(DEFAULT_PATH).update!(options)
+          rescue UpdateFailed then false
+          end
+        else
+          begin
+            download(options.merge(path: DEFAULT_PATH))
+          rescue DownloadFailed then false
+          end
         end
+      end
+
+      #
+      # Determines if the database is a git repository.
+      #
+      # @return [Boolean]
+      #
+      # @since 0.8.0
+      #
+      def git?
+        File.directory?(File.join(@path,'.git'))
+      end
+
+      #
+      # Updates the ruby-advisory-db.
+      #
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @option options [Boolean] :quiet
+      #   Specify whether `git` should be `--quiet`.
+      #
+      # @return [true, nil]
+      #   `true` indicates that the update was successful.
+      #   `nil` indicates the database is not a git repository, thus not
+      #   capable of being updated.
+      #
+      # @since 0.8.0
+      #
+      def update!(options={})
+        if git?
+          Dir.chdir(@path) do
+            command = %w[git pull]
+            command << '--quiet' if options[:quiet]
+            command << 'origin' << 'master'
 
-        if File.directory?(USER_PATH)
-          if File.directory?(File.join(USER_PATH, ".git"))
-            Dir.chdir(USER_PATH) do
-              command = %w(git pull --no-rebase)
-              command << '--quiet' if options[:quiet]
-              command << 'origin' << 'master'
-              system *command
+            unless system(*command)
+              raise(UpdateFailed,"failed to update #{@path.inspect}")
             end
+
+            return true
+          end
+        end
+      end
+
+      #
+      # The last commit ID of the repository.
+      #
+      # @return [String, nil]
+      #   The commit hash or `nil` if the database is not a git repository.
+      #
+      # @since 0.9.0
+      #
+      def commit_id
+        if git?
+          Dir.chdir(@path) do
+            `git rev-parse HEAD`.chomp
+          end
+        end
+      end
+
+      #
+      # Determines the time when the database was last updated.
+      #
+      # @return [Time]
+      #
+      # @since 0.8.0
+      #
+      def last_updated_at
+        if git?
+          Dir.chdir(@path) do
+            Time.parse(`git log --date=iso8601 --pretty="%cd" -1`)
           end
         else
-          command = %w(git clone)
-          command << '--quiet' if options[:quiet]
-          command << URL << USER_PATH
-          system *command
+          File.mtime(@path)
         end
       end
 

data/lib/bundler/audit/report.rb

@@ -0,0 +1,149 @@
+require 'bundler/audit/results'
+require 'bundler/audit/version'
+
+require 'time'
+
+module Bundler
+  module Audit
+    #
+    # Represents the result of a scan.
+    #
+    class Report
+
+      include Enumerable
+
+      # The version of `bundler-audit` which created the report object.
+      #
+      # @return [String]
+      attr_reader :version
+
+      # The time when the report was generated.
+      #
+      # @return [Time]
+      attr_reader :created_at
+
+      # The list of all results.
+      #
+      # @return [Array<Results::Result>]
+      attr_reader :results
+
+      # The insecure sources results.
+      #
+      # @return [Array<Results::InsecureSources>]
+      attr_reader :insecure_sources
+
+      # The unpatched gems results.
+      #
+      # @return [Array<Results::UnpatchedGems>]
+      attr_reader :unpatched_gems
+
+      #
+      # Initializes the report.
+      #
+      # @param [#each] results
+      #
+      def initialize(results=[])
+        @version    = VERSION
+        @created_at = Time.now
+
+        @results = []
+        @insecure_sources = []
+        @unpatched_gems = []
+
+        results.each { |result| self << result }
+      end
+
+      #
+      # Enumerates over the results.
+      #
+      # @yield [result]
+      #
+      # @yieldparam [Results::InsecureSource, Results::UnpatchedGem] result
+      #
+      # @return [Enumerator]
+      #
+      def each(&block)
+        @results.each(&block)
+      end
+
+      #
+      # Appends a result to the report.
+      #
+      # @param [InsecureSource, UnpatchedGem] result
+      #
+      def <<(result)
+        @results << result
+
+        case result
+        when Results::InsecureSource
+          @insecure_sources << result
+        when Results::UnpatchedGem
+          @unpatched_gems << result
+        end
+
+        return self
+      end
+
+      #
+      # Determines if there were vulnerabilities found.
+      #
+      # @return [Boolean]
+      #
+      def vulnerable?
+        !@results.empty?
+      end
+
+      #
+      # @yield [advisory]
+      #
+      # @yieldparam [Advisory] advisory
+      #
+      # @return [Enumerator]
+      #
+      def each_advisory
+        return enum_for(__method__) unless block_given?
+
+        @unpatched_gems.each { |result| yield result.advisory }
+      end
+
+      #
+      # @return [Array<Advisory>]
+      #
+      def advisories
+        @unpatched_gems.map(&:advisory)
+      end
+
+      #
+      # @yield [gem]
+      #
+      # @yieldparam [Gem::Specification]
+      #
+      # @return [Enumerator]
+      #
+      def each_vulnerable_gem
+        return enum_for(__method__) unless block_given?
+
+        @unpatched_gems.each { |result| yield result.gem }
+      end
+
+      #
+      # @return [Array<Gem::Specification>]
+      #
+      def vulnerable_gems
+        @unpatched_gems.map(&:gem)
+      end
+
+      #
+      # @return [Hash{Symbol => Object}]
+      #
+      def to_h
+        {
+          version:    @version,
+          created_at: @created_at,
+          results:    @results.map(&:to_h)
+        }
+      end
+
+    end
+  end
+end

data/lib/bundler/audit/results/insecure_source.rb

@@ -0,0 +1,78 @@
+#
+# Copyright (c) 2013-2021 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <https://www.gnu.org/licenses/>.
+#
+
+require 'bundler/audit/results/result'
+
+module Bundler
+  module Audit
+    module Results
+      #
+      # Represents an insecure gem source (ex: `git://...` or `http://...`).
+      #
+      class InsecureSource < Result
+
+        # The insecure `git://` or `http://` URI.
+        #
+        # @return [URI::Generic, URI::HTTP]
+        attr_reader :source
+
+        #
+        # Initializes the insecure source result.
+        #
+        # @param [URI::Generic, URI::HTTP] source
+        #   The insecure `git://` or `http://` URI.
+        #
+        def initialize(source)
+          @source = source
+        end
+
+        #
+        # Compares the insecure source with another result.
+        #
+        # @param [Result] other
+        #
+        # @return [Boolean]
+        #
+        def ==(other)
+          self.class == other.class && @source == other.source
+        end
+
+        #
+        # Converts the insecure source result to a String.
+        #
+        # @return [String]
+        #
+        def to_s
+          @source.to_s
+        end
+
+        #
+        # Converts the insecure source into a Hash.
+        #
+        # @return [Hash{Symbol => Object}]
+        #
+        def to_h
+          {
+            type: :insecure_source,
+            source: @source
+          }
+        end
+
+      end
+    end
+  end
+end