bundler-audit 0.9.1 → 0.9.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.github/ISSUE_TEMPLATE/bug-report.md +2 -0
- data/.github/workflows/ruby.yml +18 -5
- data/.rubocop.yml +5 -1
- data/ChangeLog.md +29 -0
- data/Gemfile +1 -1
- data/README.md +99 -85
- data/bundler-audit.gemspec +1 -1
- data/gemspec.yml +5 -5
- data/lib/bundler/audit/advisory.rb +1 -1
- data/lib/bundler/audit/cli/formats/json.rb +1 -1
- data/lib/bundler/audit/cli/formats/junit.rb +2 -2
- data/lib/bundler/audit/cli/formats/text.rb +2 -2
- data/lib/bundler/audit/cli/formats.rb +1 -1
- data/lib/bundler/audit/cli.rb +22 -18
- data/lib/bundler/audit/configuration.rb +1 -1
- data/lib/bundler/audit/database.rb +10 -7
- data/lib/bundler/audit/results/insecure_source.rb +1 -1
- data/lib/bundler/audit/results/unpatched_gem.rb +1 -1
- data/lib/bundler/audit/results.rb +1 -1
- data/lib/bundler/audit/scanner.rb +1 -1
- data/lib/bundler/audit/task.rb +67 -27
- data/lib/bundler/audit/version.rb +2 -2
- data/lib/bundler/audit.rb +1 -1
- data/spec/bundle/insecure_sources/Gemfile.lock +7 -7
- data/spec/bundle/secure/Gemfile +1 -1
- data/spec/bundle/secure/Gemfile.lock +12 -12
- data/spec/bundle/unpatched_gems_with_dot_configuration/Gemfile.lock +1 -1
- data/spec/cli/formats/junit_spec.rb +2 -2
- data/spec/cli/formats/text_spec.rb +2 -2
- data/spec/cli_spec.rb +16 -30
- data/spec/integration_spec.rb +16 -2
- data/spec/scanner_spec.rb +2 -2
- data/spec/task_spec.rb +141 -0
- metadata +10 -29
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 2e40ebbca24535f65142ee863e6a2acb44802481243959ea75dbaa1f7ab5e33c
|
|
4
|
+
data.tar.gz: 41d763068c36318312395dfacfd626b95928939d4358a682984aab3fc26287dd
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 00cee5ad01c98a6933e65b2823ff09ca89b7a2b69a01b0192468c871469121b95df622faa871ac1b62764838f9c263a86eb8180b2f47eab0a94f2823231ba965
|
|
7
|
+
data.tar.gz: 646566832c37e1a4b65502832bae8452b2c061b24f9caefae55f74b326d2f3f13ac88c742fffcb824d65a48f73f9e667634b86c94fc2c063e30b45225f397630
|
data/.github/workflows/ruby.yml
CHANGED
|
@@ -9,13 +9,20 @@ jobs:
|
|
|
9
9
|
fail-fast: false
|
|
10
10
|
matrix:
|
|
11
11
|
ruby:
|
|
12
|
-
- 2.5
|
|
13
|
-
- 2.6
|
|
14
|
-
- 2.7
|
|
15
12
|
- '3.0'
|
|
16
|
-
- 3.1
|
|
13
|
+
- '3.1'
|
|
14
|
+
- '3.2'
|
|
15
|
+
- '3.3'
|
|
16
|
+
- '3.4'
|
|
17
|
+
- '3.5'
|
|
18
|
+
- '4.0'
|
|
17
19
|
- jruby
|
|
18
|
-
- truffleruby
|
|
20
|
+
- truffleruby
|
|
21
|
+
include:
|
|
22
|
+
- ruby: '3.0'
|
|
23
|
+
rubygems_version: '3.5.23'
|
|
24
|
+
- ruby: '3.1'
|
|
25
|
+
rubygems_version: '3.6.9'
|
|
19
26
|
name: Ruby ${{ matrix.ruby }}
|
|
20
27
|
steps:
|
|
21
28
|
- uses: actions/checkout@v2
|
|
@@ -23,6 +30,12 @@ jobs:
|
|
|
23
30
|
uses: ruby/setup-ruby@v1
|
|
24
31
|
with:
|
|
25
32
|
ruby-version: ${{ matrix.ruby }}
|
|
33
|
+
- name: Update RubyGems
|
|
34
|
+
env:
|
|
35
|
+
RUBYGEMS_VERSION: ${{ matrix.rubygems_version }}
|
|
36
|
+
run: |
|
|
37
|
+
gem update --system ${RUBYGEMS_VERSION:-}
|
|
38
|
+
gem -v
|
|
26
39
|
- name: Install dependencies
|
|
27
40
|
run: bundle install --jobs 4 --retry 3
|
|
28
41
|
- name: Run tests
|
data/.rubocop.yml
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
AllCops:
|
|
2
|
-
NewCops:
|
|
2
|
+
NewCops: disable
|
|
3
3
|
SuggestExtensions: false
|
|
4
4
|
TargetRubyVersion: 2.7
|
|
5
5
|
Exclude:
|
|
@@ -65,6 +65,9 @@ Style/WordArray: { Enabled: false } # Offense count: 1
|
|
|
65
65
|
Style/Lambda: { Enabled: false } # Offense count: 2
|
|
66
66
|
Style/SafeNavigation: { Enabled: false } # Offense count: 2
|
|
67
67
|
Lint/IneffectiveAccessModifier: { Enabled: false } # Offense count: 1
|
|
68
|
+
Gemspec/RequireMFA:
|
|
69
|
+
Exclude:
|
|
70
|
+
- 'bundler-audit.gemspec'
|
|
68
71
|
Gemspec/DuplicatedAssignment:
|
|
69
72
|
Exclude:
|
|
70
73
|
- 'bundler-audit.gemspec'
|
|
@@ -84,3 +87,4 @@ Style/ExpandPathArguments: { Enabled: false } # Offense count: 5
|
|
|
84
87
|
Style/FrozenStringLiteralComment: { Enabled: false } # Offense count: 42
|
|
85
88
|
Style/MixinUsage: { Exclude: ['spec/spec_helper.rb'] } # Offense count: 1
|
|
86
89
|
Layout/LineLength: { Enabled: false }
|
|
90
|
+
Style/RedundantParentheses: { Enabled: false }
|
data/ChangeLog.md
CHANGED
|
@@ -1,5 +1,34 @@
|
|
|
1
|
+
### 0.9.3 / 2025-11-28
|
|
2
|
+
|
|
3
|
+
* Officially support Ruby 3.4, 3.5, and 4.0.
|
|
4
|
+
* Added support for Bundler 4.x.
|
|
5
|
+
* Fixed typos in API documentation.
|
|
6
|
+
|
|
7
|
+
#### CLI
|
|
8
|
+
|
|
9
|
+
* Ensure that the `bundler-audit check` command honors the
|
|
10
|
+
`BUNDLER_AUDIT_DB` environment variable.
|
|
11
|
+
|
|
12
|
+
### 0.9.2 / 2024-08-22
|
|
13
|
+
|
|
14
|
+
* Officially support Ruby 3.2 and 3.3.
|
|
15
|
+
* Corrected the gemspec license to indicate GPL-3.0 *or* later.
|
|
16
|
+
|
|
17
|
+
#### CLI
|
|
18
|
+
|
|
19
|
+
* Correctly handle {Bundler::Audit::Database::UpdateFailed} exceptions in
|
|
20
|
+
`bundle-audit update`.
|
|
21
|
+
* Changed wording from "upgrade to" to "update to" in `bundle-audit check`
|
|
22
|
+
output.
|
|
23
|
+
|
|
24
|
+
#### Rake Task
|
|
25
|
+
|
|
26
|
+
* Fixed empty `bundle:audit:update` rake task.
|
|
27
|
+
|
|
1
28
|
### 0.9.1 / 2022-05-19
|
|
2
29
|
|
|
30
|
+
* Opt into rubygems.org MFA requirement.
|
|
31
|
+
|
|
3
32
|
#### CLI
|
|
4
33
|
|
|
5
34
|
* Improve the readability of the suggested gem versions to upgrade to
|
data/Gemfile
CHANGED
data/README.md
CHANGED
|
@@ -24,90 +24,94 @@ Patch-level verification for [bundler].
|
|
|
24
24
|
|
|
25
25
|
Audit a project's `Gemfile.lock`:
|
|
26
26
|
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
27
|
+
```
|
|
28
|
+
$ bundle-audit
|
|
29
|
+
Name: actionpack
|
|
30
|
+
Version: 3.2.10
|
|
31
|
+
Advisory: OSVDB-91452
|
|
32
|
+
Criticality: Medium
|
|
33
|
+
URL: http://www.osvdb.org/show/osvdb/91452
|
|
34
|
+
Title: XSS vulnerability in sanitize_css in Action Pack
|
|
35
|
+
Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
|
|
36
|
+
|
|
37
|
+
Name: actionpack
|
|
38
|
+
Version: 3.2.10
|
|
39
|
+
Advisory: OSVDB-91454
|
|
40
|
+
Criticality: Medium
|
|
41
|
+
URL: http://osvdb.org/show/osvdb/91454
|
|
42
|
+
Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
|
|
43
|
+
Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
|
|
44
|
+
|
|
45
|
+
Name: actionpack
|
|
46
|
+
Version: 3.2.10
|
|
47
|
+
Advisory: OSVDB-89026
|
|
48
|
+
Criticality: High
|
|
49
|
+
URL: http://osvdb.org/show/osvdb/89026
|
|
50
|
+
Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
|
|
51
|
+
Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
|
|
52
|
+
|
|
53
|
+
Name: activerecord
|
|
54
|
+
Version: 3.2.10
|
|
55
|
+
Advisory: OSVDB-91453
|
|
56
|
+
Criticality: High
|
|
57
|
+
URL: http://osvdb.org/show/osvdb/91453
|
|
58
|
+
Title: Symbol DoS vulnerability in Active Record
|
|
59
|
+
Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
|
|
60
|
+
|
|
61
|
+
Name: activerecord
|
|
62
|
+
Version: 3.2.10
|
|
63
|
+
Advisory: OSVDB-90072
|
|
64
|
+
Criticality: Medium
|
|
65
|
+
URL: http://direct.osvdb.org/show/osvdb/90072
|
|
66
|
+
Title: Ruby on Rails Active Record attr_protected Method Bypass
|
|
67
|
+
Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
|
|
68
|
+
|
|
69
|
+
Name: activerecord
|
|
70
|
+
Version: 3.2.10
|
|
71
|
+
Advisory: OSVDB-89025
|
|
72
|
+
Criticality: High
|
|
73
|
+
URL: http://osvdb.org/show/osvdb/89025
|
|
74
|
+
Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
|
|
75
|
+
Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
|
|
76
|
+
|
|
77
|
+
Name: activesupport
|
|
78
|
+
Version: 3.2.10
|
|
79
|
+
Advisory: OSVDB-91451
|
|
80
|
+
Criticality: High
|
|
81
|
+
URL: http://www.osvdb.org/show/osvdb/91451
|
|
82
|
+
Title: XML Parsing Vulnerability affecting JRuby users
|
|
83
|
+
Solution: update to ~> 3.1.12, >= 3.2.13
|
|
84
|
+
|
|
85
|
+
Unpatched versions found!
|
|
86
|
+
```
|
|
85
87
|
|
|
86
88
|
Update the [ruby-advisory-db] that `bundle audit` uses:
|
|
87
89
|
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
90
|
+
```
|
|
91
|
+
$ bundle-audit update
|
|
92
|
+
Updating ruby-advisory-db ...
|
|
93
|
+
remote: Counting objects: 44, done.
|
|
94
|
+
remote: Compressing objects: 100% (24/24), done.
|
|
95
|
+
remote: Total 39 (delta 19), reused 29 (delta 10)
|
|
96
|
+
Unpacking objects: 100% (39/39), done.
|
|
97
|
+
From https://github.com/rubysec/ruby-advisory-db
|
|
98
|
+
* branch master -> FETCH_HEAD
|
|
99
|
+
Updating 5f8225e..328ca86
|
|
100
|
+
Fast-forward
|
|
101
|
+
CONTRIBUTORS.md | 1 +
|
|
102
|
+
gems/actionmailer/OSVDB-98629.yml | 17 +++++++++++++++++
|
|
103
|
+
gems/cocaine/OSVDB-98835.yml | 15 +++++++++++++++
|
|
104
|
+
gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++
|
|
105
|
+
gems/sounder/OSVDB-96278.yml | 13 +++++++++++++
|
|
106
|
+
gems/wicked/OSVDB-98270.yml | 14 ++++++++++++++
|
|
107
|
+
6 files changed, 73 insertions(+)
|
|
108
|
+
create mode 100644 gems/actionmailer/OSVDB-98629.yml
|
|
109
|
+
create mode 100644 gems/cocaine/OSVDB-98835.yml
|
|
110
|
+
create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml
|
|
111
|
+
create mode 100644 gems/sounder/OSVDB-96278.yml
|
|
112
|
+
create mode 100644 gems/wicked/OSVDB-98270.yml
|
|
113
|
+
ruby-advisory-db: 64 advisories
|
|
114
|
+
```
|
|
111
115
|
|
|
112
116
|
Update the [ruby-advisory-db] and check `Gemfile.lock` (useful for CI runs):
|
|
113
117
|
|
|
@@ -147,10 +151,20 @@ $ bundle-audit check --format json --output bundle-audit.json
|
|
|
147
151
|
|
|
148
152
|
## Rake Tasks
|
|
149
153
|
|
|
150
|
-
Bundler-audit provides
|
|
151
|
-
its vulnerability database
|
|
154
|
+
Bundler-audit provides `rake` tasks for checking the code and for updating
|
|
155
|
+
its vulnerability database.
|
|
156
|
+
|
|
157
|
+
Simply add the following code to the `Rakefile`:
|
|
152
158
|
|
|
153
|
-
```
|
|
159
|
+
```ruby
|
|
160
|
+
require 'bundler/audit/task'
|
|
161
|
+
Bundler::Audit::Task.new
|
|
162
|
+
```
|
|
163
|
+
|
|
164
|
+
The following `rake` tasks will then become available:
|
|
165
|
+
|
|
166
|
+
```
|
|
167
|
+
$ rake -T
|
|
154
168
|
rake bundle:audit
|
|
155
169
|
rake bundle:audit:update
|
|
156
170
|
```
|
|
@@ -231,7 +245,7 @@ $ brew install git
|
|
|
231
245
|
|
|
232
246
|
## License
|
|
233
247
|
|
|
234
|
-
Copyright (c) 2013-
|
|
248
|
+
Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
235
249
|
|
|
236
250
|
bundler-audit is free software: you can redistribute it and/or modify
|
|
237
251
|
it under the terms of the GNU General Public License as published by
|
data/bundler-audit.gemspec
CHANGED
|
@@ -18,6 +18,7 @@ Gem::Specification.new do |gem|
|
|
|
18
18
|
gem.authors = Array(gemspec['authors'])
|
|
19
19
|
gem.email = gemspec['email']
|
|
20
20
|
gem.homepage = gemspec['homepage']
|
|
21
|
+
gem.metadata = gemspec['metadata'] if gemspec['metadata']
|
|
21
22
|
|
|
22
23
|
glob = lambda { |patterns| gem.files & Dir[*patterns] }
|
|
23
24
|
|
|
@@ -30,7 +31,6 @@ Gem::Specification.new do |gem|
|
|
|
30
31
|
gem.default_executable = gem.executables.first if Gem::VERSION < '1.7.'
|
|
31
32
|
|
|
32
33
|
gem.extensions = glob[gemspec['extensions'] || 'ext/**/extconf.rb']
|
|
33
|
-
gem.test_files = glob[gemspec['test_files'] || 'spec/{**/}*_spec.rb']
|
|
34
34
|
gem.extra_rdoc_files = glob[gemspec['extra_doc_files'] || '*.{txt,md}']
|
|
35
35
|
|
|
36
36
|
gem.require_paths = Array(gemspec.fetch('require_paths') {
|
data/gemspec.yml
CHANGED
|
@@ -1,16 +1,16 @@
|
|
|
1
1
|
name: bundler-audit
|
|
2
2
|
summary: Patch-level verification for Bundler
|
|
3
3
|
description: bundler-audit provides patch-level verification for Bundled apps.
|
|
4
|
-
license: GPL-3.0
|
|
4
|
+
license: GPL-3.0-or-later
|
|
5
5
|
authors: Postmodern
|
|
6
6
|
email: postmodern.mod3@gmail.com
|
|
7
7
|
homepage: https://github.com/rubysec/bundler-audit#readme
|
|
8
8
|
|
|
9
9
|
metadata:
|
|
10
10
|
documentation_uri: https://rubydoc.info/gems/bundler-audit
|
|
11
|
-
source_code_uri: https://github.com/rubysec/bundler-audit
|
|
12
|
-
bug_tracker_uri: https://github.com/rubysec/bundler-audit
|
|
13
|
-
changelog_uri: https://github.com/rubysec/bundler-audit
|
|
11
|
+
source_code_uri: https://github.com/rubysec/bundler-audit
|
|
12
|
+
bug_tracker_uri: https://github.com/rubysec/bundler-audit/issues
|
|
13
|
+
changelog_uri: https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md
|
|
14
14
|
rubygems_mfa_required: 'true'
|
|
15
15
|
|
|
16
16
|
required_ruby_version: ">= 2.0.0"
|
|
@@ -18,4 +18,4 @@ required_rubygems_version: ">= 1.8.0"
|
|
|
18
18
|
|
|
19
19
|
dependencies:
|
|
20
20
|
thor: "~> 1.0"
|
|
21
|
-
bundler: ">= 1.2.0
|
|
21
|
+
bundler: ">= 1.2.0"
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -101,7 +101,7 @@ module Bundler
|
|
|
101
101
|
|
|
102
102
|
def advisory_solution(advisory)
|
|
103
103
|
unless advisory.patched_versions.empty?
|
|
104
|
-
"
|
|
104
|
+
"update to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}"
|
|
105
105
|
else
|
|
106
106
|
"remove or disable this gem until a patch is available!"
|
|
107
107
|
end
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -104,7 +104,7 @@ module Bundler
|
|
|
104
104
|
end
|
|
105
105
|
|
|
106
106
|
unless advisory.patched_versions.empty?
|
|
107
|
-
say "Solution:
|
|
107
|
+
say "Solution: update to ", :red
|
|
108
108
|
say advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')
|
|
109
109
|
else
|
|
110
110
|
say "Solution: ", :red
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
data/lib/bundler/audit/cli.rb
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -39,7 +39,7 @@ module Bundler
|
|
|
39
39
|
method_option :ignore, type: :array, aliases: '-i'
|
|
40
40
|
method_option :update, type: :boolean, aliases: '-u'
|
|
41
41
|
method_option :database, type: :string, aliases: '-D',
|
|
42
|
-
default: Database::
|
|
42
|
+
default: Database::DEFAULT_PATH
|
|
43
43
|
method_option :format, type: :string, default: 'text', aliases: '-F'
|
|
44
44
|
method_option :config, type: :string, aliases: '-c', default: '.bundler-audit.yml'
|
|
45
45
|
method_option :gemfile_lock, type: :string, aliases: '-G',
|
|
@@ -67,7 +67,7 @@ module Bundler
|
|
|
67
67
|
|
|
68
68
|
database = Database.new(options[:database])
|
|
69
69
|
scanner = begin
|
|
70
|
-
Scanner.new(dir,options[:gemfile_lock],database,
|
|
70
|
+
Scanner.new(dir,options[:gemfile_lock],database,options[:config])
|
|
71
71
|
rescue Bundler::GemfileLockNotFound => exception
|
|
72
72
|
say exception.message, :red
|
|
73
73
|
exit 1
|
|
@@ -91,7 +91,7 @@ module Bundler
|
|
|
91
91
|
desc 'stats', 'Prints ruby-advisory-db stats'
|
|
92
92
|
method_option :quiet, type: :boolean, aliases: '-q'
|
|
93
93
|
|
|
94
|
-
def stats(path=Database
|
|
94
|
+
def stats(path=Database::DEFAULT_PATH)
|
|
95
95
|
database = Database.new(path)
|
|
96
96
|
|
|
97
97
|
puts "ruby-advisory-db:"
|
|
@@ -106,7 +106,7 @@ module Bundler
|
|
|
106
106
|
desc 'download', 'Downloads ruby-advisory-db'
|
|
107
107
|
method_option :quiet, type: :boolean, aliases: '-q'
|
|
108
108
|
|
|
109
|
-
def download(path=Database
|
|
109
|
+
def download(path=Database::DEFAULT_PATH)
|
|
110
110
|
if Database.exists?(path)
|
|
111
111
|
say "Database already exists", :yellow
|
|
112
112
|
return
|
|
@@ -127,7 +127,7 @@ module Bundler
|
|
|
127
127
|
desc 'update', 'Updates the ruby-advisory-db'
|
|
128
128
|
method_option :quiet, type: :boolean, aliases: '-q'
|
|
129
129
|
|
|
130
|
-
def update(path=Database
|
|
130
|
+
def update(path=Database::DEFAULT_PATH)
|
|
131
131
|
unless Database.exists?(path)
|
|
132
132
|
download(path)
|
|
133
133
|
return
|
|
@@ -137,19 +137,23 @@ module Bundler
|
|
|
137
137
|
|
|
138
138
|
database = Database.new(path)
|
|
139
139
|
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
140
|
+
begin
|
|
141
|
+
case database.update!(quiet: options.quiet?)
|
|
142
|
+
when true
|
|
143
|
+
say("Updated ruby-advisory-db", :green) unless options.quiet?
|
|
144
|
+
when nil
|
|
145
|
+
if Bundler.git_present?
|
|
146
|
+
unless options.quiet?
|
|
147
|
+
say "Skipping update, ruby-advisory-db is not a git repository", :yellow
|
|
148
|
+
end
|
|
149
|
+
else
|
|
150
|
+
say_error "Git is not installed!", :red
|
|
151
|
+
exit 1
|
|
152
|
+
end
|
|
150
153
|
end
|
|
151
|
-
|
|
152
|
-
say
|
|
154
|
+
rescue Database::UpdateFailed => error
|
|
155
|
+
say error.message, :red
|
|
156
|
+
exit 1
|
|
153
157
|
end
|
|
154
158
|
|
|
155
159
|
stats(path) unless options.quiet?
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -103,7 +103,7 @@ module Bundler
|
|
|
103
103
|
# @option options [Boolean] :quiet
|
|
104
104
|
# Specify whether `git` should be `--quiet`.
|
|
105
105
|
#
|
|
106
|
-
# @return [
|
|
106
|
+
# @return [Database]
|
|
107
107
|
# The newly downloaded database.
|
|
108
108
|
#
|
|
109
109
|
# @raise [DownloadFailed]
|
|
@@ -141,9 +141,8 @@ module Bundler
|
|
|
141
141
|
# @option options [Boolean] :quiet
|
|
142
142
|
# Specify whether `git` should be `--quiet`.
|
|
143
143
|
#
|
|
144
|
-
# @return [Boolean
|
|
144
|
+
# @return [Boolean]
|
|
145
145
|
# Specifies whether the update was successful.
|
|
146
|
-
# A `nil` indicates no update was performed.
|
|
147
146
|
#
|
|
148
147
|
# @raise [ArgumentError]
|
|
149
148
|
# Invalid options were given.
|
|
@@ -192,9 +191,13 @@ module Bundler
|
|
|
192
191
|
# Specify whether `git` should be `--quiet`.
|
|
193
192
|
#
|
|
194
193
|
# @return [true, nil]
|
|
195
|
-
# `true`
|
|
196
|
-
#
|
|
197
|
-
#
|
|
194
|
+
# * `true` - the ruby-advisory-db git repository was successfully
|
|
195
|
+
# updated.
|
|
196
|
+
# * `nil` - the ruby-advisory-db is not a git repository or the `git`
|
|
197
|
+
# command is not installed.
|
|
198
|
+
#
|
|
199
|
+
# @raise [UpdateFailed]
|
|
200
|
+
# Could not update the ruby-advisory-db git repository.
|
|
198
201
|
#
|
|
199
202
|
# @since 0.8.0
|
|
200
203
|
#
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
data/lib/bundler/audit/task.rb
CHANGED
|
@@ -16,33 +16,6 @@ module Bundler
|
|
|
16
16
|
define
|
|
17
17
|
end
|
|
18
18
|
|
|
19
|
-
protected
|
|
20
|
-
|
|
21
|
-
#
|
|
22
|
-
# Defines the `bundle:audit` and `bundle:audit:update` task.
|
|
23
|
-
#
|
|
24
|
-
def define
|
|
25
|
-
namespace :bundle do
|
|
26
|
-
namespace :audit do
|
|
27
|
-
desc 'Checks the Gemfile.lock for insecure dependencies'
|
|
28
|
-
task :check do
|
|
29
|
-
bundler_audit 'check'
|
|
30
|
-
end
|
|
31
|
-
|
|
32
|
-
desc 'Updates the bundler-audit vulnerability database'
|
|
33
|
-
task :update do
|
|
34
|
-
bundler_audit 'update'
|
|
35
|
-
end
|
|
36
|
-
end
|
|
37
|
-
|
|
38
|
-
task :audit => 'audit:check'
|
|
39
|
-
end
|
|
40
|
-
|
|
41
|
-
task 'bundler:audit' => 'bundle:audit'
|
|
42
|
-
task 'bundler:audit:check' => 'bundle:audit:check'
|
|
43
|
-
task 'bundler:audit:update' => 'bundle:audit:update'
|
|
44
|
-
end
|
|
45
|
-
|
|
46
19
|
#
|
|
47
20
|
# Runs the `bundler-audit` command with the additional arguments.
|
|
48
21
|
#
|
|
@@ -59,6 +32,8 @@ module Bundler
|
|
|
59
32
|
# If the `bundler-audit` command exits with an error, the rake task
|
|
60
33
|
# will also exit with the same error code.
|
|
61
34
|
#
|
|
35
|
+
# @api private
|
|
36
|
+
#
|
|
62
37
|
def bundler_audit(*arguments)
|
|
63
38
|
case system('bundler-audit',*arguments)
|
|
64
39
|
when false
|
|
@@ -69,6 +44,71 @@ module Bundler
|
|
|
69
44
|
return true
|
|
70
45
|
end
|
|
71
46
|
end
|
|
47
|
+
|
|
48
|
+
#
|
|
49
|
+
# Runs the `bundle-audit check` command.
|
|
50
|
+
#
|
|
51
|
+
# @return [true]
|
|
52
|
+
# The `bundler-audit` command successfully exited.
|
|
53
|
+
#
|
|
54
|
+
# @raise [CommandNotFound]
|
|
55
|
+
# The `bundler-audit` command could not be executed or was not found.
|
|
56
|
+
#
|
|
57
|
+
# @note
|
|
58
|
+
# If the `bundler-audit` command exits with an error, the rake task
|
|
59
|
+
# will also exit with the same error code.
|
|
60
|
+
#
|
|
61
|
+
# @api private
|
|
62
|
+
#
|
|
63
|
+
def check
|
|
64
|
+
bundler_audit 'check'
|
|
65
|
+
end
|
|
66
|
+
|
|
67
|
+
#
|
|
68
|
+
# Runs the `bundle-audit update` command.
|
|
69
|
+
#
|
|
70
|
+
# @return [true]
|
|
71
|
+
# The `bundler-audit` command successfully exited.
|
|
72
|
+
#
|
|
73
|
+
# @raise [CommandNotFound]
|
|
74
|
+
# The `bundler-audit` command could not be executed or was not found.
|
|
75
|
+
#
|
|
76
|
+
# @note
|
|
77
|
+
# If the `bundler-audit` command exits with an error, the rake task
|
|
78
|
+
# will also exit with the same error code.
|
|
79
|
+
#
|
|
80
|
+
# @api private
|
|
81
|
+
#
|
|
82
|
+
def update
|
|
83
|
+
bundler_audit 'update'
|
|
84
|
+
end
|
|
85
|
+
|
|
86
|
+
protected
|
|
87
|
+
|
|
88
|
+
#
|
|
89
|
+
# Defines the `bundle:audit` and `bundle:audit:update` task.
|
|
90
|
+
#
|
|
91
|
+
def define
|
|
92
|
+
namespace :bundle do
|
|
93
|
+
namespace :audit do
|
|
94
|
+
desc 'Checks the Gemfile.lock for insecure dependencies'
|
|
95
|
+
task :check do
|
|
96
|
+
check
|
|
97
|
+
end
|
|
98
|
+
|
|
99
|
+
desc 'Updates the bundler-audit vulnerability database'
|
|
100
|
+
task :update do
|
|
101
|
+
update
|
|
102
|
+
end
|
|
103
|
+
end
|
|
104
|
+
|
|
105
|
+
task :audit => 'audit:check'
|
|
106
|
+
end
|
|
107
|
+
|
|
108
|
+
task 'bundler:audit' => 'bundle:audit'
|
|
109
|
+
task 'bundler:audit:check' => 'bundle:audit:check'
|
|
110
|
+
task 'bundler:audit:update' => 'bundle:audit:update'
|
|
111
|
+
end
|
|
72
112
|
end
|
|
73
113
|
end
|
|
74
114
|
end
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -18,6 +18,6 @@
|
|
|
18
18
|
module Bundler
|
|
19
19
|
module Audit
|
|
20
20
|
# bundler-audit version
|
|
21
|
-
VERSION = '0.9.
|
|
21
|
+
VERSION = '0.9.3'
|
|
22
22
|
end
|
|
23
23
|
end
|
data/lib/bundler/audit.rb
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
#
|
|
2
|
-
# Copyright (c) 2013-
|
|
2
|
+
# Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com)
|
|
3
3
|
#
|
|
4
4
|
# bundler-audit is free software: you can redistribute it and/or modify
|
|
5
5
|
# it under the terms of the GNU General Public License as published by
|
|
@@ -77,7 +77,7 @@ GEM
|
|
|
77
77
|
activesupport (>= 4.2.0)
|
|
78
78
|
i18n (1.8.10)
|
|
79
79
|
concurrent-ruby (~> 1.0)
|
|
80
|
-
loofah (2.
|
|
80
|
+
loofah (2.19.1)
|
|
81
81
|
crass (~> 1.0.2)
|
|
82
82
|
nokogiri (>= 1.5.9)
|
|
83
83
|
mail (2.7.1)
|
|
@@ -88,13 +88,13 @@ GEM
|
|
|
88
88
|
mini_portile2 (2.8.0)
|
|
89
89
|
minitest (5.14.4)
|
|
90
90
|
nio4r (2.5.7)
|
|
91
|
-
nokogiri (1.13.
|
|
91
|
+
nokogiri (1.13.10)
|
|
92
92
|
mini_portile2 (~> 2.8.0)
|
|
93
93
|
racc (~> 1.4)
|
|
94
|
-
nokogiri (1.13.
|
|
94
|
+
nokogiri (1.13.10-x86_64-linux)
|
|
95
95
|
racc (~> 1.4)
|
|
96
|
-
racc (1.6.
|
|
97
|
-
rack (2.2.3)
|
|
96
|
+
racc (1.6.1)
|
|
97
|
+
rack (2.2.6.3)
|
|
98
98
|
rack-test (1.1.0)
|
|
99
99
|
rack (>= 1.0, < 3)
|
|
100
100
|
rails (6.1.3.2)
|
|
@@ -115,8 +115,8 @@ GEM
|
|
|
115
115
|
rails-dom-testing (2.0.3)
|
|
116
116
|
activesupport (>= 4.2.0)
|
|
117
117
|
nokogiri (>= 1.6)
|
|
118
|
-
rails-html-sanitizer (1.
|
|
119
|
-
loofah (~> 2.
|
|
118
|
+
rails-html-sanitizer (1.4.4)
|
|
119
|
+
loofah (~> 2.19, >= 2.19.1)
|
|
120
120
|
railties (6.1.3.2)
|
|
121
121
|
actionpack (= 6.1.3.2)
|
|
122
122
|
activesupport (= 6.1.3.2)
|
data/spec/bundle/secure/Gemfile
CHANGED
|
@@ -47,11 +47,11 @@ GEM
|
|
|
47
47
|
concurrent-ruby (1.1.10)
|
|
48
48
|
crass (1.0.6)
|
|
49
49
|
erubi (1.10.0)
|
|
50
|
-
globalid (1.0.
|
|
50
|
+
globalid (1.0.1)
|
|
51
51
|
activesupport (>= 5.0)
|
|
52
|
-
i18n (1.
|
|
52
|
+
i18n (1.12.0)
|
|
53
53
|
concurrent-ruby (~> 1.0)
|
|
54
|
-
loofah (2.
|
|
54
|
+
loofah (2.19.1)
|
|
55
55
|
crass (~> 1.0.2)
|
|
56
56
|
nokogiri (>= 1.5.9)
|
|
57
57
|
mail (2.7.1)
|
|
@@ -60,15 +60,15 @@ GEM
|
|
|
60
60
|
method_source (1.0.0)
|
|
61
61
|
mini_mime (1.1.2)
|
|
62
62
|
mini_portile2 (2.8.0)
|
|
63
|
-
minitest (5.
|
|
63
|
+
minitest (5.17.0)
|
|
64
64
|
nio4r (2.5.8)
|
|
65
|
-
nokogiri (1.13.
|
|
65
|
+
nokogiri (1.13.10)
|
|
66
66
|
mini_portile2 (~> 2.8.0)
|
|
67
67
|
racc (~> 1.4)
|
|
68
|
-
nokogiri (1.13.
|
|
68
|
+
nokogiri (1.13.10-x86_64-linux)
|
|
69
69
|
racc (~> 1.4)
|
|
70
|
-
racc (1.6.
|
|
71
|
-
rack (2.2.3)
|
|
70
|
+
racc (1.6.1)
|
|
71
|
+
rack (2.2.6.3)
|
|
72
72
|
rack-test (1.1.0)
|
|
73
73
|
rack (>= 1.0, < 3)
|
|
74
74
|
rails (5.2.8)
|
|
@@ -87,8 +87,8 @@ GEM
|
|
|
87
87
|
rails-dom-testing (2.0.3)
|
|
88
88
|
activesupport (>= 4.2.0)
|
|
89
89
|
nokogiri (>= 1.6)
|
|
90
|
-
rails-html-sanitizer (1.
|
|
91
|
-
loofah (~> 2.
|
|
90
|
+
rails-html-sanitizer (1.4.4)
|
|
91
|
+
loofah (~> 2.19, >= 2.19.1)
|
|
92
92
|
railties (5.2.8)
|
|
93
93
|
actionpack (= 5.2.8)
|
|
94
94
|
activesupport (= 5.2.8)
|
|
@@ -105,7 +105,7 @@ GEM
|
|
|
105
105
|
sprockets (>= 3.0.0)
|
|
106
106
|
thor (1.2.1)
|
|
107
107
|
thread_safe (0.3.6)
|
|
108
|
-
tzinfo (1.2.
|
|
108
|
+
tzinfo (1.2.10)
|
|
109
109
|
thread_safe (~> 0.1)
|
|
110
110
|
websocket-driver (0.7.5)
|
|
111
111
|
websocket-extensions (>= 0.1.0)
|
|
@@ -117,7 +117,7 @@ PLATFORMS
|
|
|
117
117
|
|
|
118
118
|
DEPENDENCIES
|
|
119
119
|
rails (~> 5.2)
|
|
120
|
-
rails-html-sanitizer (~> 1.
|
|
120
|
+
rails-html-sanitizer (~> 1.4.4)
|
|
121
121
|
|
|
122
122
|
BUNDLED WITH
|
|
123
123
|
2.3.6
|
|
@@ -240,8 +240,8 @@ describe Bundler::Audit::CLI::Formats::Junit do
|
|
|
240
240
|
end
|
|
241
241
|
|
|
242
242
|
context "when Advisory#patched_versions is not empty" do
|
|
243
|
-
it 'must print "Solution:
|
|
244
|
-
expect(output).to include("Solution:
|
|
243
|
+
it 'must print "Solution: update to ..."' do
|
|
244
|
+
expect(output).to include("Solution: update to #{CGI.escapeHTML(advisory.patched_versions.map { |v| "'#{v}'" }.join(', '))}")
|
|
245
245
|
end
|
|
246
246
|
end
|
|
247
247
|
|
|
@@ -229,8 +229,8 @@ describe Bundler::Audit::CLI::Formats::Text do
|
|
|
229
229
|
end
|
|
230
230
|
|
|
231
231
|
context "when Advisory#patched_versions is not empty" do
|
|
232
|
-
it 'must print "Solution:
|
|
233
|
-
expect(output_lines).to include("Solution:
|
|
232
|
+
it 'must print "Solution: update to ..."' do
|
|
233
|
+
expect(output_lines).to include("Solution: update to #{advisory.patched_versions.map { |v| "'#{v}'" }.join(', ')}")
|
|
234
234
|
end
|
|
235
235
|
end
|
|
236
236
|
|
data/spec/cli_spec.rb
CHANGED
|
@@ -2,6 +2,8 @@ require 'spec_helper'
|
|
|
2
2
|
require 'bundler/audit/cli'
|
|
3
3
|
|
|
4
4
|
describe Bundler::Audit::CLI do
|
|
5
|
+
let(:database_path) { "/path/to/ruby-advisory-db" }
|
|
6
|
+
|
|
5
7
|
describe ".start" do
|
|
6
8
|
context "with wrong arguments" do
|
|
7
9
|
it "exits with error status code" do
|
|
@@ -76,23 +78,17 @@ describe Bundler::Audit::CLI do
|
|
|
76
78
|
|
|
77
79
|
context "when update fails" do
|
|
78
80
|
before do
|
|
79
|
-
expect(database).to receive(:update!).
|
|
81
|
+
expect(database).to receive(:update!).with(quiet: false).and_raise(
|
|
82
|
+
Bundler::Audit::Database::UpdateFailed,
|
|
83
|
+
"failed to update #{database_path.inspect}"
|
|
84
|
+
)
|
|
80
85
|
end
|
|
81
86
|
|
|
82
|
-
it "
|
|
87
|
+
it "must print an error message and exit with 1" do
|
|
83
88
|
expect {
|
|
84
|
-
|
|
89
|
+
expect {
|
|
85
90
|
subject.update
|
|
86
|
-
|
|
87
|
-
end
|
|
88
|
-
}.to output(/Failed updating ruby-advisory-db!/).to_stderr
|
|
89
|
-
end
|
|
90
|
-
|
|
91
|
-
it "exits with error status code" do
|
|
92
|
-
expect {
|
|
93
|
-
# Capture output of `update` only to keep spec output clean.
|
|
94
|
-
# The test regarding specific output is above.
|
|
95
|
-
expect { subject.update }.to output.to_stdout
|
|
91
|
+
}.to output("failed to update #{database_path.inspect}").to_stderr
|
|
96
92
|
}.to raise_error(SystemExit) do |error|
|
|
97
93
|
expect(error.success?).to eq(false)
|
|
98
94
|
expect(error.status).to eq(1)
|
|
@@ -136,9 +132,7 @@ describe Bundler::Audit::CLI do
|
|
|
136
132
|
|
|
137
133
|
context "when update succeeds" do
|
|
138
134
|
before do
|
|
139
|
-
expect(database).to(
|
|
140
|
-
receive(:update!).with(quiet: true).and_return(true)
|
|
141
|
-
)
|
|
135
|
+
expect(database).to receive(:update!).with(quiet: true).and_return(true)
|
|
142
136
|
end
|
|
143
137
|
|
|
144
138
|
it "does not print any output" do
|
|
@@ -148,25 +142,17 @@ describe Bundler::Audit::CLI do
|
|
|
148
142
|
|
|
149
143
|
context "when update fails" do
|
|
150
144
|
before do
|
|
151
|
-
expect(database).to(
|
|
152
|
-
|
|
145
|
+
expect(database).to receive(:update!).with(quiet: true).and_raise(
|
|
146
|
+
Bundler::Audit::Database::UpdateFailed,
|
|
147
|
+
"failed to update #{database_path.inspect}"
|
|
153
148
|
)
|
|
154
149
|
end
|
|
155
150
|
|
|
156
|
-
it "
|
|
151
|
+
it "must print the error message and exit with an error code" do
|
|
157
152
|
expect {
|
|
158
|
-
|
|
153
|
+
expect {
|
|
159
154
|
subject.update
|
|
160
|
-
|
|
161
|
-
end
|
|
162
|
-
}.to_not output.to_stderr
|
|
163
|
-
end
|
|
164
|
-
|
|
165
|
-
it "exits with error status code" do
|
|
166
|
-
expect {
|
|
167
|
-
# Capture output of `update` only to keep spec output clean.
|
|
168
|
-
# The test regarding specific output is above.
|
|
169
|
-
expect { subject.update }.to output.to_stdout
|
|
155
|
+
}.to output("failed to update: #{database_path.inspect}").to_stderr
|
|
170
156
|
}.to raise_error(SystemExit) do |error|
|
|
171
157
|
expect(error.success?).to eq(false)
|
|
172
158
|
expect(error.status).to eq(1)
|
data/spec/integration_spec.rb
CHANGED
|
@@ -11,7 +11,14 @@ describe "bin/bundler-audit" do
|
|
|
11
11
|
subject { sh(command) }
|
|
12
12
|
|
|
13
13
|
it "must invoke the CLI class" do
|
|
14
|
-
|
|
14
|
+
expected = "bundler-audit #{Bundler::Audit::VERSION}#{$/}"
|
|
15
|
+
|
|
16
|
+
if RUBY_VERSION.start_with?("3.0") || RUBY_ENGINE == "truffleruby"
|
|
17
|
+
# Allow `WARN: Unresolved or ambiguous specs during Gem::Specification.reset:` for Ruby 3.0.x and TruffleRuby
|
|
18
|
+
expect(subject).to include(expected)
|
|
19
|
+
else
|
|
20
|
+
expect(subject).to eq(expected)
|
|
21
|
+
end
|
|
15
22
|
end
|
|
16
23
|
end
|
|
17
24
|
|
|
@@ -26,6 +33,13 @@ describe "bin/bundle-audit" do
|
|
|
26
33
|
subject { sh(command) }
|
|
27
34
|
|
|
28
35
|
it "must invoke the CLI class" do
|
|
29
|
-
|
|
36
|
+
expected = "bundler-audit #{Bundler::Audit::VERSION}#{$/}"
|
|
37
|
+
|
|
38
|
+
if RUBY_VERSION.start_with?("3.0") || RUBY_ENGINE == "truffleruby"
|
|
39
|
+
# Allow `WARN: Unresolved or ambiguous specs during Gem::Specification.reset:` for Ruby 3.0.x and TruffleRuby
|
|
40
|
+
expect(subject).to include(expected)
|
|
41
|
+
else
|
|
42
|
+
expect(subject).to eq(expected)
|
|
43
|
+
end
|
|
30
44
|
end
|
|
31
45
|
end
|
data/spec/scanner_spec.rb
CHANGED
|
@@ -36,12 +36,12 @@ describe Scanner do
|
|
|
36
36
|
end
|
|
37
37
|
|
|
38
38
|
context "when the :ignore option is given" do
|
|
39
|
-
subject { super().scan(ignore: ['
|
|
39
|
+
subject { super().scan(ignore: ['CVE-2013-0156']) }
|
|
40
40
|
|
|
41
41
|
it "should ignore the specified advisories" do
|
|
42
42
|
ids = subject.map { |result| result.advisory.id }
|
|
43
43
|
|
|
44
|
-
expect(ids).not_to include('
|
|
44
|
+
expect(ids).not_to include('CVE-2013-0156')
|
|
45
45
|
end
|
|
46
46
|
end
|
|
47
47
|
end
|
data/spec/task_spec.rb
ADDED
|
@@ -0,0 +1,141 @@
|
|
|
1
|
+
require 'spec_helper'
|
|
2
|
+
require 'bundler/audit/task'
|
|
3
|
+
|
|
4
|
+
require 'rake'
|
|
5
|
+
|
|
6
|
+
describe Bundler::Audit::Task do
|
|
7
|
+
before { subject }
|
|
8
|
+
|
|
9
|
+
it "must define a 'bundle:audit:check' task" do
|
|
10
|
+
expect(Rake::Task['bundle:audit:check']).to_not be_nil
|
|
11
|
+
end
|
|
12
|
+
|
|
13
|
+
it "must define a 'bundle:audit:update' task" do
|
|
14
|
+
expect(Rake::Task['bundle:audit:update']).to_not be_nil
|
|
15
|
+
end
|
|
16
|
+
|
|
17
|
+
it "must define a 'bundle:audit' task" do
|
|
18
|
+
expect(Rake::Task['bundle:audit']).to_not be_nil
|
|
19
|
+
end
|
|
20
|
+
|
|
21
|
+
it "must define a 'bundler:audit:check' task" do
|
|
22
|
+
expect(Rake::Task['bundler:audit:check']).to_not be_nil
|
|
23
|
+
end
|
|
24
|
+
|
|
25
|
+
it "must define a 'bundler:audit:update' task" do
|
|
26
|
+
expect(Rake::Task['bundler:audit:update']).to_not be_nil
|
|
27
|
+
end
|
|
28
|
+
|
|
29
|
+
it "must define a 'bundler:audit' task" do
|
|
30
|
+
expect(Rake::Task['bundler:audit']).to_not be_nil
|
|
31
|
+
end
|
|
32
|
+
|
|
33
|
+
describe "#bundler_audit" do
|
|
34
|
+
let(:subcommand) { 'subcommand' }
|
|
35
|
+
context "when the command exits successfully" do
|
|
36
|
+
before do
|
|
37
|
+
allow(subject).to receive(:system).with('bundler-audit',subcommand).and_return(true)
|
|
38
|
+
end
|
|
39
|
+
|
|
40
|
+
it "must return true" do
|
|
41
|
+
expect(subject.bundler_audit(subcommand)).to be(true)
|
|
42
|
+
end
|
|
43
|
+
end
|
|
44
|
+
|
|
45
|
+
context "when there vulnerabilities are found" do
|
|
46
|
+
before do
|
|
47
|
+
allow(subject).to receive(:system).with('bundler-audit',subcommand).and_return(false)
|
|
48
|
+
end
|
|
49
|
+
|
|
50
|
+
it "must exit with a non-zero error code" do
|
|
51
|
+
expect(subject).to receive(:exit).with($?.exitstatus)
|
|
52
|
+
|
|
53
|
+
subject.bundler_audit(subcommand)
|
|
54
|
+
end
|
|
55
|
+
end
|
|
56
|
+
|
|
57
|
+
context "when the bundler-audit command cannot be executed" do
|
|
58
|
+
before do
|
|
59
|
+
allow(subject).to receive(:system).with('bundler-audit',subcommand).and_return(nil)
|
|
60
|
+
end
|
|
61
|
+
|
|
62
|
+
it do
|
|
63
|
+
expect {
|
|
64
|
+
subject.bundler_audit(subcommand)
|
|
65
|
+
}.to raise_error(described_class::CommandNotFound,"bundler-audit could not be executed")
|
|
66
|
+
end
|
|
67
|
+
end
|
|
68
|
+
end
|
|
69
|
+
|
|
70
|
+
describe "#check" do
|
|
71
|
+
context "when the command exits successfully" do
|
|
72
|
+
before do
|
|
73
|
+
allow(subject).to receive(:system).with('bundler-audit','check').and_return(true)
|
|
74
|
+
end
|
|
75
|
+
|
|
76
|
+
it "must return true" do
|
|
77
|
+
expect(subject.check).to be(true)
|
|
78
|
+
end
|
|
79
|
+
end
|
|
80
|
+
|
|
81
|
+
context "when there vulnerabilities are found" do
|
|
82
|
+
before do
|
|
83
|
+
allow(subject).to receive(:system).with('bundler-audit','check').and_return(false)
|
|
84
|
+
end
|
|
85
|
+
|
|
86
|
+
it "must exit with a non-zero error code" do
|
|
87
|
+
expect(subject).to receive(:exit).with($?.exitstatus)
|
|
88
|
+
|
|
89
|
+
subject.check
|
|
90
|
+
end
|
|
91
|
+
end
|
|
92
|
+
|
|
93
|
+
context "when the bundler-audit command cannot be executed" do
|
|
94
|
+
before do
|
|
95
|
+
allow(subject).to receive(:system).with('bundler-audit','check').and_return(nil)
|
|
96
|
+
end
|
|
97
|
+
|
|
98
|
+
it do
|
|
99
|
+
expect {
|
|
100
|
+
subject.check
|
|
101
|
+
}.to raise_error(described_class::CommandNotFound,"bundler-audit could not be executed")
|
|
102
|
+
end
|
|
103
|
+
end
|
|
104
|
+
end
|
|
105
|
+
|
|
106
|
+
describe "#update" do
|
|
107
|
+
context "when the command exits successfully" do
|
|
108
|
+
before do
|
|
109
|
+
allow(subject).to receive(:system).with('bundler-audit','update').and_return(true)
|
|
110
|
+
end
|
|
111
|
+
|
|
112
|
+
it "must return true" do
|
|
113
|
+
expect(subject.update).to be(true)
|
|
114
|
+
end
|
|
115
|
+
end
|
|
116
|
+
|
|
117
|
+
context "when there vulnerabilities are found" do
|
|
118
|
+
before do
|
|
119
|
+
allow(subject).to receive(:system).with('bundler-audit','update').and_return(false)
|
|
120
|
+
end
|
|
121
|
+
|
|
122
|
+
it "must exit with a non-zero error code" do
|
|
123
|
+
expect(subject).to receive(:exit).with($?.exitstatus)
|
|
124
|
+
|
|
125
|
+
subject.update
|
|
126
|
+
end
|
|
127
|
+
end
|
|
128
|
+
|
|
129
|
+
context "when the bundler-audit command cannot be executed" do
|
|
130
|
+
before do
|
|
131
|
+
allow(subject).to receive(:system).with('bundler-audit','update').and_return(nil)
|
|
132
|
+
end
|
|
133
|
+
|
|
134
|
+
it do
|
|
135
|
+
expect {
|
|
136
|
+
subject.update
|
|
137
|
+
}.to raise_error(described_class::CommandNotFound,"bundler-audit could not be executed")
|
|
138
|
+
end
|
|
139
|
+
end
|
|
140
|
+
end
|
|
141
|
+
end
|
metadata
CHANGED
|
@@ -1,14 +1,13 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: bundler-audit
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.9.
|
|
4
|
+
version: 0.9.3
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Postmodern
|
|
8
|
-
autorequire:
|
|
9
8
|
bindir: bin
|
|
10
9
|
cert_chain: []
|
|
11
|
-
date:
|
|
10
|
+
date: 1980-01-02 00:00:00.000000000 Z
|
|
12
11
|
dependencies:
|
|
13
12
|
- !ruby/object:Gem::Dependency
|
|
14
13
|
name: thor
|
|
@@ -31,9 +30,6 @@ dependencies:
|
|
|
31
30
|
- - ">="
|
|
32
31
|
- !ruby/object:Gem::Version
|
|
33
32
|
version: 1.2.0
|
|
34
|
-
- - "<"
|
|
35
|
-
- !ruby/object:Gem::Version
|
|
36
|
-
version: '3'
|
|
37
33
|
type: :runtime
|
|
38
34
|
prerelease: false
|
|
39
35
|
version_requirements: !ruby/object:Gem::Requirement
|
|
@@ -41,9 +37,6 @@ dependencies:
|
|
|
41
37
|
- - ">="
|
|
42
38
|
- !ruby/object:Gem::Version
|
|
43
39
|
version: 1.2.0
|
|
44
|
-
- - "<"
|
|
45
|
-
- !ruby/object:Gem::Version
|
|
46
|
-
version: '3'
|
|
47
40
|
description: bundler-audit provides patch-level verification for Bundled apps.
|
|
48
41
|
email: postmodern.mod3@gmail.com
|
|
49
42
|
executables:
|
|
@@ -124,12 +117,16 @@ files:
|
|
|
124
117
|
- spec/results/unpatched_gem_spec.rb
|
|
125
118
|
- spec/scanner_spec.rb
|
|
126
119
|
- spec/spec_helper.rb
|
|
120
|
+
- spec/task_spec.rb
|
|
127
121
|
homepage: https://github.com/rubysec/bundler-audit#readme
|
|
128
122
|
licenses:
|
|
129
|
-
- GPL-3.0
|
|
123
|
+
- GPL-3.0-or-later
|
|
130
124
|
metadata:
|
|
125
|
+
documentation_uri: https://rubydoc.info/gems/bundler-audit
|
|
126
|
+
source_code_uri: https://github.com/rubysec/bundler-audit
|
|
127
|
+
bug_tracker_uri: https://github.com/rubysec/bundler-audit/issues
|
|
128
|
+
changelog_uri: https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md
|
|
131
129
|
rubygems_mfa_required: 'true'
|
|
132
|
-
post_install_message:
|
|
133
130
|
rdoc_options: []
|
|
134
131
|
require_paths:
|
|
135
132
|
- lib
|
|
@@ -144,23 +141,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
144
141
|
- !ruby/object:Gem::Version
|
|
145
142
|
version: 1.8.0
|
|
146
143
|
requirements: []
|
|
147
|
-
rubygems_version: 3.
|
|
148
|
-
signing_key:
|
|
144
|
+
rubygems_version: 3.6.9
|
|
149
145
|
specification_version: 4
|
|
150
146
|
summary: Patch-level verification for Bundler
|
|
151
|
-
test_files:
|
|
152
|
-
- spec/advisory_spec.rb
|
|
153
|
-
- spec/audit_spec.rb
|
|
154
|
-
- spec/cli/formats/json_spec.rb
|
|
155
|
-
- spec/cli/formats/junit_spec.rb
|
|
156
|
-
- spec/cli/formats/text_spec.rb
|
|
157
|
-
- spec/cli/formats_spec.rb
|
|
158
|
-
- spec/cli_spec.rb
|
|
159
|
-
- spec/configuration_spec.rb
|
|
160
|
-
- spec/database_spec.rb
|
|
161
|
-
- spec/integration_spec.rb
|
|
162
|
-
- spec/report_spec.rb
|
|
163
|
-
- spec/results/insecure_source_spec.rb
|
|
164
|
-
- spec/results/result_spec.rb
|
|
165
|
-
- spec/results/unpatched_gem_spec.rb
|
|
166
|
-
- spec/scanner_spec.rb
|
|
147
|
+
test_files: []
|