bundler-audit 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a3d576304278048394827d4322e8e4be389a2a899b3e22bff638a0aaffcf91a
-  data.tar.gz: 025cf42cf42c6e868b1de3b07066aafe6e55878fe13f53f34c3e40396b44ba27
+  metadata.gz: 966ad54c7aa972a1def015d74d836cfa2268970ef74ab064766c775ed5e9d2f8
+  data.tar.gz: c5d32686e71351ba9a3907a8a0b9d4b3ee0d3e695f3b69dd25c95dc92eb9c7df
 SHA512:
-  metadata.gz: 4485f6c903fcda454232c9305aaefb7d170edc6d6ea4bb8d766880a4135460dde1b3249cb28a87434ae3f01138d60c8bc0792e36b31e2b2893d314ae8cfb5acd
-  data.tar.gz: c273401ad1f90286ff8a0981e858320cd2b14aa65718338ab7c54bb43b77cbf423848d982852217ab763e44b32ea9f6d977ce26e8dbc1f793cb405c52da3be82
+  metadata.gz: 53e93bd363d19723be6b12ef095b0912e1781f0ae513bbad8bff5a0cc199ee57b1ac4abe5e003740c0d6d1a283738b0228b54472a3a1e2bd52d2af972b0cb9fd
+  data.tar.gz: 2636a1378516f65b291cf7132397d82e0270f511fa5a1cdb2419b2bf63b828807598f968642f5e2c41e0efb0e1011894223460123c7d76461703f2df26b2f87d

data/.gitignore

@@ -5,7 +5,6 @@ doc/
 .yardoc/
 coverage/
 pkg/
-spec/bundle/*/Gemfile.lock
 spec/bundle/*/.bundle/
 vendor/bundle/
 tmp/

data/.travis.yml

@@ -4,10 +4,11 @@ rvm:
   - 2.4
   - 2.5
   - 2.6
+  - 2.7
   - jruby
-  - rbx-3
+  - truffleruby
 
 matrix:
   allow_failures:
     - rvm: jruby
-    - rvm: rbx-3
+    - rvm: truffleruby

data/ChangeLog.md

@@ -1,3 +1,14 @@
+### 0.7.0 / 2020-06-12
+
+* Require [thor] >= 0.18, < 2.
+* Added {Bundler::Audit::Advisory#ghsa} (@rschultheis).
+* Added {Bundler::Audit::Advisory#cvss_v3} (@ahamlin-nr).
+* Added {Bundler::Audit::Advisory#identifiers} (@rschultheis).
+* Updated {Bundler::Audit::Advisory#criticality} ranges (@reedlonden).
+* Avoid rebasing the ruby-advisory-db when updating (@nicknovitski).
+* Fixed issue with Bundler 2.x where source URIs are no longer parsed as
+  `URI::HTTP` objects, but as `Bundler::URI::HTTP` objects. (@milgner)
+
 ### 0.6.1 / 2019-01-17
 
 * Require bundler `>= 1.2.0, < 3` to support [bundler] 2.0.
@@ -126,4 +137,5 @@
 * [CVE-2013-0333](http://osvdb.org/show/osvdb/89594)
 
 [bundler]: http://gembundler.com/
+[thor]: http://whatisthor.com/
 [ruby-advisory-db]: https://github.com/rubysec/ruby-advisory-db#readme

data/README.md

@@ -1,11 +1,11 @@
 # bundler-audit
+[![Build Status](https://travis-ci.org/rubysec/bundler-audit.svg?branch=master)](https://travis-ci.org/rubysec/bundler-audit)
+[![Code Climate](https://codeclimate.com/github/rubysec/bundler-audit.svg)](https://codeclimate.com/github/rubysec/bundler-audit)
 
 * [Homepage](https://github.com/rubysec/bundler-audit#readme)
 * [Issues](https://github.com/rubysec/bundler-audit/issues)
 * [Documentation](http://rubydoc.info/gems/bundler-audit/frames)
 * [Email](mailto:postmodern.mod3 at gmail.com)
-* [![Build Status](https://travis-ci.org/rubysec/bundler-audit.svg)](https://travis-ci.org/rubysec/bundler-audit)
-* [![Code Climate](https://codeclimate.com/github/rubysec/bundler-audit.svg)](https://codeclimate.com/github/rubysec/bundler-audit)
 
 ## Description
 
@@ -23,7 +23,7 @@ Patch-level verification for [bundler].
 
 Audit a project's `Gemfile.lock`:
 
-    $ bundle audit
+    $ bundle-audit
     Name: actionpack
     Version: 3.2.10
     Advisory: OSVDB-91452
@@ -84,7 +84,7 @@ Audit a project's `Gemfile.lock`:
 
 Update the [ruby-advisory-db] that `bundle audit` uses:
 
-    $ bundle audit update
+    $ bundle-audit update
     Updating ruby-advisory-db ...
     remote: Counting objects: 44, done.
     remote: Compressing objects: 100% (24/24), done.
@@ -110,11 +110,11 @@ Update the [ruby-advisory-db] that `bundle audit` uses:
 
 Update the [ruby-advisory-db] and check `Gemfile.lock` (useful for CI runs):
 
-    $ bundle audit check --update
+    $ bundle-audit check --update
 
 Ignore specific advisories:
 
-    $ bundle audit check --ignore OSVDB-108664
+    $ bundle-audit check --ignore OSVDB-108664
 
 Rake task:
 
@@ -129,22 +129,22 @@ task default: 'bundle:audit'
 
 * [ruby] >= 1.9.3
 * [rubygems] >= 1.8
-* [thor] ~> 0.18
+* [thor] >= 0.18, < 2
 * [bundler] ~> 1.2
 
 ## Install
 
-    $ gem install bundler-audit
+    $ [sudo] gem install bundler-audit
 
 ## Contributing
 
 1. Clone the repo
-1. `git submodule update --init` # To populate data/ruby-advisory-db
-1. `bundle exec rake`
+2. `git submodule update --init` # To populate data/ruby-advisory-db
+3. `bundle exec rake`
 
 ## License
 
-Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 
 bundler-audit is free software: you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

data/Rakefile

@@ -23,7 +23,7 @@ namespace :db do
       sh 'git', 'pull', 'origin', 'master'
 
       File.open('../ruby-advisory-db.ts','w') do |file|
-        file.write Time.parse(`git log --pretty="%cd" -1`).utc
+        file.write Time.parse(`git log --date=iso8601 --pretty="%cd" -1`).utc
       end
     end
 
@@ -36,18 +36,20 @@ end
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new
 
-namespace :spec do
-  task :bundle do
-    root = 'spec/bundle'
+%w[secure unpatched_gems insecure_sources].each do |bundle|
+  bundle_dir   = File.join('spec/bundle',bundle)
+  gemfile      = File.join(bundle_dir,'Gemfile')
+  gemfile_lock = File.join(bundle_dir,'Gemfile.lock')
 
-    %w[secure unpatched_gems insecure_sources].each do |bundle|
-      chdir(File.join(root,bundle)) do
-        sh 'unset BUNDLE_BIN_PATH BUNDLE_GEMFILE RUBYOPT && bundle install --path ../../../vendor/bundle'
-      end
+  file gemfile_lock => gemfile do
+    chdir(bundle_dir) do
+      sh 'unset BUNDLE_BIN_PATH BUNDLE_GEMFILE RUBYOPT && bundle install --path ../../../vendor/bundle'
     end
   end
+
+  desc "Generates the spec/bundler/*/Gemfile.lock files"
+  task 'spec:bundle' => gemfile_lock
 end
-task :spec => 'spec:bundle'
 
 task :test    => :spec
 task :default => :spec

data/data/ruby-advisory-db.ts

@@ -1 +1 @@
-2017-06-13 16:51:56 UTC
+2020-06-05 17:45:49 UTC

data/gemspec.yml

@@ -10,5 +10,5 @@ required_ruby_version: ">= 1.9.3"
 required_rubygems_version: ">= 1.8.0"
 
 dependencies:
-  thor: ~> 0.18
+  thor: ">= 0.18, < 2"
   bundler: ">= 1.2.0, < 3"

data/lib/bundler/audit.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by

data/lib/bundler/audit/advisory.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -26,8 +26,10 @@ module Bundler
                                 :date,
                                 :description,
                                 :cvss_v2,
+                                :cvss_v3,
                                 :cve,
                                 :osvdb,
+                                :ghsa,
                                 :unaffected_versions,
                                 :patched_versions)
 
@@ -63,8 +65,10 @@ module Bundler
           data['date'],
           data['description'],
           data['cvss_v2'],
+          data['cvss_v3'],
           data['cve'],
           data['osvdb'],
+          data['ghsa'],
           parse_versions[data['unaffected_versions']],
           parse_versions[data['patched_versions']]
         )
@@ -88,17 +92,53 @@ module Bundler
         "OSVDB-#{osvdb}" if osvdb
       end
 
+      #
+      # The GHSA (GitHub Security Advisory) identifier
+      #
+      # @return [String, nil]
+      #
+      # @since 0.7.0
+      #
+      def ghsa_id
+        "GHSA-#{ghsa}" if ghsa
+      end
+
+      #
+      # Return a compacted list of all ids
+      #
+      # @return [Array<String>]
+      #
+      # @since 0.7.0
+      #
+      def identifiers
+        [
+          cve_id,
+          osvdb_id,
+          ghsa_id
+        ].compact
+      end
+
       #
       # Determines how critical the vulnerability is.
       #
-      # @return [:low, :medium, :high]
-      #   The criticality of the vulnerability based on the CVSSv2 score.
+      # @return [:none, :low, :medium, :high, :critical]
+      #   The criticality of the vulnerability based on the CVSS score.
       #
       def criticality
-        case cvss_v2
-        when 0.0..3.3  then :low
-        when 3.3..6.6  then :medium
-        when 6.6..10.0 then :high
+        if cvss_v3
+          case cvss_v3
+          when 0.0       then :none
+          when 0.1..3.9  then :low
+          when 4.0..6.9  then :medium
+          when 7.0..8.9  then :high
+          when 9.0..10.0 then :critical
+          end
+        elsif cvss_v2
+          case cvss_v2
+          when 0.0..3.9  then :low
+          when 4.0..6.9  then :medium
+          when 7.0..10.0 then :high
+          end
         end
       end
 

data/lib/bundler/audit/cli.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -73,6 +73,10 @@ module Bundler
           say "Failed updating ruby-advisory-db!", :red
           exit 1
         when nil
+          unless Bundler.git_present?
+            say "Git is not installed!", :red
+            exit 1
+          end
           say "Skipping update", :yellow
         end
 
@@ -109,17 +113,21 @@ module Bundler
         say "Advisory: ", :red
 
         if advisory.cve
-          say "CVE-#{advisory.cve}"
+          say advisory.cve_id
         elsif advisory.osvdb
-          say advisory.osvdb
+          say advisory.osvdb_id
+        elsif advisory.ghsa
+          say advisory.ghsa_id
         end
 
         say "Criticality: ", :red
         case advisory.criticality
-        when :low    then say "Low"
-        when :medium then say "Medium", :yellow
-        when :high   then say "High", [:red, :bold]
-        else              say "Unknown"
+        when :none     then say "None"
+        when :low      then say "Low"
+        when :medium   then say "Medium", :yellow
+        when :high     then say "High", [:red, :bold]
+        when :critical then say "Critical", [:red, :bold]
+        else                say "Unknown"
         end
 
         say "URL: ", :red

data/lib/bundler/audit/database.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -68,7 +68,7 @@ module Bundler
       #
       def self.path
         if File.directory?(USER_PATH)
-          t1 = Dir.chdir(USER_PATH) { Time.parse(`git log --date=iso8601 --pretty="%cd" -1`) }
+          t1 = Dir.chdir(USER_PATH) { Time.parse(`git log --date=iso8601 --pretty="%cd" -1`).utc }
           t2 = VENDORED_TIMESTAMP
 
           if t1 >= t2 then USER_PATH
@@ -82,24 +82,33 @@ module Bundler
       #
       # Updates the ruby-advisory-db.
       #
-      # @param [Boolean, quiet]
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @option options [Boolean] :quiet
       #   Specify whether `git` should be `--quiet`.
       #
       # @return [Boolean, nil]
       #   Specifies whether the update was successful.
       #   A `nil` indicates no update was performed.
       #
+      # @raise [ArgumentError]
+      #   Invalid options were given.
+      #
       # @note
       #   Requires network access.
       #
       # @since 0.3.0
       #
       def self.update!(options={})
-        raise "Invalid option(s)" unless (options.keys - [:quiet]).empty?
+        unless (options.keys - [:quiet]).empty?
+          raise(ArgumentError,"Invalid option(s)")
+        end
+
         if File.directory?(USER_PATH)
           if File.directory?(File.join(USER_PATH, ".git"))
             Dir.chdir(USER_PATH) do
-              command = %w(git pull)
+              command = %w(git pull --no-rebase)
               command << '--quiet' if options[:quiet]
               command << 'origin' << 'master'
               system *command

data/lib/bundler/audit/scanner.rb

@@ -148,10 +148,10 @@ module Bundler
 
         @lockfile.specs.each do |gem|
           @database.check_gem(gem) do |advisory|
-            unless (ignore.include?(advisory.cve_id) ||
-                    ignore.include?(advisory.osvdb_id))
-              yield UnpatchedGem.new(gem,advisory)
-            end
+            is_ignored = ignore.intersect?(advisory.identifiers.to_set)
+            next if is_ignored
+
+            yield UnpatchedGem.new(gem,advisory)
           end
         end
       end
@@ -167,7 +167,7 @@ module Bundler
       # @return [Boolean]
       #
       def internal_source?(uri)
-        uri = URI(uri)
+        uri = URI.parse(uri.to_s)
 
         internal_host?(uri.host) if uri.host
       end

data/lib/bundler/audit/version.rb

@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Copyright (c) 2013-2020 Hal Brodigan (postmodern.mod3 at gmail.com)
 #
 # bundler-audit is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -18,6 +18,6 @@
 module Bundler
   module Audit
     # bundler-audit version
-    VERSION = '0.6.1'
+    VERSION = '0.7.0'
   end
 end

data/spec/advisory_spec.rb

@@ -5,7 +5,7 @@ require 'bundler/audit/advisory'
 describe Bundler::Audit::Advisory do
   let(:root) { Bundler::Audit::Database::VENDORED_PATH }
   let(:gem)  { 'actionpack' }
-  let(:id)   { 'OSVDB-84243' }
+  let(:id)   { 'CVE-2012-3424' }
   let(:path) { File.join(root,'gems',gem,"#{id}.yml") }
   let(:an_unaffected_version) do
     Bundler::Audit::Advisory.load(path).unaffected_versions.map { |version_rule|
@@ -54,6 +54,11 @@ describe Bundler::Audit::Advisory do
       it { is_expected.to eq(data['cvss_v2'])     }
     end
 
+    describe '#cvss_v3' do
+      subject { super().cvss_v3 }
+      it { is_expected.to eq(data['cvss_v3'])     }
+    end
+
     describe '#description' do
       subject { super().description }
       it { is_expected.to eq(data['description']) }
@@ -123,28 +128,79 @@ describe Bundler::Audit::Advisory do
     end
   end
 
+  describe "#ghsa_id" do
+    let(:ghsa) { "xfhh-rx56-rxcr" }
+
+    subject do
+      described_class.new.tap do |advisory|
+        advisory.ghsa = ghsa
+      end
+    end
+
+    it "should prepend GHSA- to the GHSA id" do
+      expect(subject.ghsa_id).to be == "GHSA-#{ghsa}"
+    end
+
+    context "when ghsa is nil" do
+      subject { described_class.new }
+
+      it { expect(subject.ghsa_id).to be_nil }
+    end
+  end
+
+  describe "#identifiers" do
+    it "should include all identifiers if defined" do
+      advisory = described_class.new.tap do |advisory|
+        advisory.cve = "2018-1234"
+        advisory.osvdb = "2019-2345"
+        advisory.ghsa = "2020-3456"
+      end
+
+      expect(advisory.identifiers).to eq([
+        "CVE-2018-1234",
+        "OSVDB-2019-2345",
+        "GHSA-2020-3456"
+      ])
+    end
+
+    it "should exclude nil identifiers" do
+      advisory = described_class.new
+      expect(advisory.identifiers).to eq([])
+
+      advisory = described_class.new.tap do |advisory|
+        advisory.cve = "2018-1234"
+      end
+      expect(advisory.identifiers).to eq(["CVE-2018-1234"])
+
+      advisory = described_class.new.tap do |advisory|
+        advisory.ghsa = "2020-3456"
+      end
+      expect(advisory.identifiers).to eq(["GHSA-2020-3456"])
+    end
+  end
+
   describe "#criticality" do
-    context "when cvss_v2 is between 0.0 and 3.3" do
+    context "when cvss_v2 is between 0.0 and 3.9" do
       subject do
         described_class.new.tap do |advisory|
-          advisory.cvss_v2 = 3.3
+          advisory.cvss_v2 = 3.9
         end
       end
 
       it { expect(subject.criticality).to eq(:low) }
     end
 
-    context "when cvss_v2 is between 3.3 and 6.6" do
+    context "when cvss_v2 is between 4.0 and 6.9" do
       subject do
         described_class.new.tap do |advisory|
-          advisory.cvss_v2 = 6.6
+          advisory.cvss_v2 = 6.9
         end
       end
 
       it { expect(subject.criticality).to eq(:medium) }
     end
 
-    context "when cvss_v2 is between 6.6 and 10.0" do
+    context "when cvss_v2 is between 7.0 and 10.0" do
       subject do
         described_class.new.tap do |advisory|
           advisory.cvss_v2 = 10.0
@@ -153,6 +209,56 @@ describe Bundler::Audit::Advisory do
 
       it { expect(subject.criticality).to eq(:high) }
     end
+
+    context "when cvss_v3 is 0.0" do
+      subject do
+        described_class.new.tap do |advisory|
+          advisory.cvss_v3 = 0.0
+        end
+      end
+
+      it { expect(subject.criticality).to eq(:none) }
+    end
+
+    context "when cvss_v3 is between 0.1 and 3.9" do
+      subject do
+        described_class.new.tap do |advisory|
+          advisory.cvss_v3 = 3.9
+        end
+      end
+
+      it { expect(subject.criticality).to eq(:low) }
+    end
+
+    context "when cvss_v3 is between 4.0 and 6.9" do
+      subject do
+        described_class.new.tap do |advisory|
+          advisory.cvss_v3 = 6.9
+        end
+      end
+
+      it { expect(subject.criticality).to eq(:medium) }
+    end
+
+    context "when cvss_v3 is between 7.0 and 8.9" do
+      subject do
+        described_class.new.tap do |advisory|
+          advisory.cvss_v3 = 8.9
+        end
+      end
+
+      it { expect(subject.criticality).to eq(:high) }
+    end
+
+    context "when cvss_v3 is between 9.0 and 10.0" do
+      subject do
+        described_class.new.tap do |advisory|
+          advisory.cvss_v3 = 10.0
+        end
+      end
+
+      it { expect(subject.criticality).to eq(:critical) }
+    end
   end
 
   describe "#unaffected?" do