bundler-audit 0.7.0.1 → 0.8.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1c2ead83ab8d3dac034093a5ac034fbf3235fed7077e47c2f491a9f8fa24d6c
-  data.tar.gz: c520084f591d25b66f1524a1bfaa900297a6c4517e000f38ce46bc66fbdb812a
+  metadata.gz: 94290135207c14256ac6d7251be3f0641619ec1273c562bb9c14a1b8ee8e28d5
+  data.tar.gz: 83d1b6b88e88d5c850d7daadde5d3235389c9620ab35414d78f1be13cd54387d
 SHA512:
-  metadata.gz: becd1a0bf6735ab08c3db5bd18199ceea5682e240a18ea2da88b8f9ff7c121ca11e5912613b559dc5916ff5db3e8e1d93627ead52e5a5bfc9f89ea574efb867d
-  data.tar.gz: 8a111e0b5e19eff5777bbe117560cc16f6d70a113fbb3d5059457557647a31ecef80f54956bb4f44d866d970579ed1fe19b0279aceed5355100b95a307a79491
+  metadata.gz: 28a461def90014d7d1dea437c17637d342bb8a46a08d1874091effa135a9303b621428ecf57d497867db2a9bda4d76bea032197e447edf8730432558ee1208cd
+  data.tar.gz: 400fb39383074b315b5d2d7e9339da907f24554c99a00358bd309ca7d6101443229997bb49cb54d8d473e4d6acf3793b294c795349dcc3d0615683e283fbd17a

data/.github/workflows/ruby.yml

@@ -0,0 +1,28 @@
+name: CI
+
+on: [ push, pull_request ]
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby:
+          - 2.4
+          - 2.5
+          - 2.6
+          - 2.7
+          - jruby
+          - truffleruby
+    name: Ruby ${{ matrix.ruby }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+      - name: Install dependencies
+        run: bundle install --jobs 4 --retry 3
+      - name: Run tests
+        run: bundle exec rake test

data/.gitignore

@@ -6,5 +6,6 @@ doc/
 coverage/
 pkg/
 spec/bundle/*/.bundle/
+spec/fixtures/database
 vendor/bundle/
 tmp/

data/.rspec

@@ -1 +1 @@
---colour --format documentation
+--colour --format documentation --exclude-pattern spec/fixtures/**/*_spec.rb

data/ChangeLog.md

@@ -1,3 +1,59 @@
+### 0.8.0 / 2020-12-XX
+
+* No longer vendor [ruby-advisory-db].
+* Added {Bundler::Audit::Configuration}.
+  * Supports loading YAML configuration data from a `.bundler-audit.yml` file.
+* Added {Bundler::Audit::Results}.
+* Added {Bundler::Audit::Report}.
+* Added {Bundler::Audit::CLI::Formats}.
+* Added {Bundler::Audit::CLI::Formats::Text}.
+* Added {Bundler::Audit::CLI::Formats::JSON}.
+* Added {Bundler::Audit::Database::DEFAULT_PATH}.
+* Added {Bundler::Audit::Database.exists?}.
+* Added {Bundler::Audit::Database#git?}.
+* Added {Bundler::Audit::Database#update!}.
+  * Will raise a {Bundler::Audit::Database::UpdateFailed UpdateFailed}
+    exception, if the `git pull` command fails.
+* Added {Bundler::Audit::Database#last_updated_at}.
+* Added {Bundler::Audit::Scanner#report}.
+* {Bundler::Audit::Database::USER_PATH} is now `Gem.user_home` aware.
+  * `Gem.user_home` will try to infer `HOME`, even if it is not set.
+* {Bundler::Audit::Database#download} will now raise a
+  {Bundler::Audit::Database::DownloadFailed DownloadFailed} exception, if the
+  `git clone` command fails.
+* {Bundler::Audit::Scanner#initialize}:
+  * Now accepts an additional `database` and `config_dot_file` arguments.
+  * Will now raise a `Bundler::GemfileLockNotFound` exception,
+    if the given `Gemfile.lock` file cannot be found.
+* {Bundler::Audit::Scanner#scan_sources} will now ignore any source with a
+  `127.0.0.0/8` or `::1/128` IP address.
+* {Bundler::Audit::Scanner#scan_specs} will ignore any advisories listed in
+  {Bundler::Audit::Configuration#ignore}, which is loaded from the
+  `.bundler-audit.yml` file.
+* Deprecated {Bundler::Audit::Database.update!} in favor of
+  {Bundler::Audit::Database#update! #update!}.
+* Removed `Bundler::Audit::Database::VENDORED_PATH`.
+* Removed `Bundler::Audit::Database::VENDORED_TIMESTAMP`.
+
+#### CLI
+
+* Added `bundle-audit stats`.
+* Added `bundle-audit download`.
+* `bundle-audit check`:
+  * Now accepts a optional `DIR` argument for the project directory.
+    * `bundle-audit check` will now print an explicit error message and exit,
+      if the given `DIR` does not exist.
+  * Will now auto-download/auto-update [ruby-advisory-db] to
+    ensure the latest advisory information.
+  * Now supports a `--database` option for specifying a path
+    to an alternative [ruby-advisory-db] copy.
+  * Now supports a `--gemfile-lock` option for specifying a
+    custom `Gemfile.lock` file within the project directory.
+  * Now supports a `--format` option for specifying the
+    desired format. `text` and `json` are supported, but other custom formats
+    can be loaded. See {Bundler::Audit::CLI::Formats}.
+  * Now supports a `--output` option for writing the report output to a file.
+
 ### 0.7.0.1 / 2020-06-12
 
 * Forgot to populate `data/ruby-advisory-db`.
@@ -12,6 +68,7 @@
 * Avoid rebasing the ruby-advisory-db when updating (@nicknovitski).
 * Fixed issue with Bundler 2.x where source URIs are no longer parsed as
   `URI::HTTP` objects, but as `Bundler::URI::HTTP` objects. (@milgner)
+* Make it more explicit that git is required for database updates (@fatkodima)
 
 ### 0.6.1 / 2019-01-17
 

data/Gemfile

@@ -4,7 +4,7 @@ gemspec
 
 group :development do
   gem 'rake'
-  gem 'kramdown',       '~> 0.14'
+  gem 'kramdown',       '~> 2.0'
 
   gem 'rubygems-tasks', '~> 0.2'
   gem 'rspec',          '~> 3.0'

data/README.md

@@ -112,10 +112,26 @@ Update the [ruby-advisory-db] and check `Gemfile.lock` (useful for CI runs):
 
     $ bundle-audit check --update
 
+Checking the `Gemfile.lock` without updating the [ruby-advisory-db]:
+
+    $ bundle-audit check --no-update
+
 Ignore specific advisories:
 
     $ bundle-audit check --ignore OSVDB-108664
 
+Checking a custom `Gemfile.lock` file:
+
+    $ bundle-audit check --gemfile Gemfile.custom.lock
+
+Output the audit's results in JSON:
+
+    $ bundle-audit check --format json
+
+Output the audit's results in JSON, to a file:
+
+    $ bundle-audit check --format json --output bundle-audit.json
+
 Rake task:
 
 ```ruby
@@ -125,22 +141,61 @@ Bundler::Audit::Task.new
 task default: 'bundle:audit'
 ```
 
+## Configuration File
+
+bundler-audit also supports a per-project configuration file:
+
+`.bundler-audit.yml`:
+
+    ---
+    ignore:
+      - CVE-YYYY-XXXX
+      - ...
+
+* `ignore:` \[Array\<String\>\] - A list of advisory IDs to ignore.
+
 ## Requirements
 
+* [git]
 * [ruby] >= 1.9.3
 * [rubygems] >= 1.8
 * [thor] >= 0.18, < 2
-* [bundler] ~> 1.2
+* [bundler] >= 1.2.0, < 3
 
 ## Install
 
     $ [sudo] gem install bundler-audit
 
+### Git
+
+* Debian / Ubuntu:
+
+      $ sudo apt install git
+
+* RedHat / Fedora:
+
+      $ sudo dnf install git
+
+* Alpine Linux:
+
+      $ apk add git
+
+* macOS:
+
+      $ brew install git
+
 ## Contributing
 
-1. Clone the repo
-2. `git submodule update --init` # To populate data/ruby-advisory-db
-3. `bundle exec rake`
+1. https://github.com/rubysec/bundler-audit/fork
+2. `git clone YOUR_FORK_URI`
+3. `cd bundler-audit/`
+4. `budle install`
+5. `bundle exec rake spec`
+6. `git checkout -b YOUR_FEATURE`
+7. Make your changes
+8. `bundle exec rake spec`
+9. `git commit -a`
+10. `git push origin YOUR_FEATURE`
 
 ## License
 
@@ -159,10 +214,12 @@ GNU General Public License for more details.
 You should have received a copy of the GNU General Public License
 along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
 
+[git]: https://git-scm.com
 [ruby]: https://ruby-lang.org
 [rubygems]: https://rubygems.org
 [thor]: http://whatisthor.com/
 [bundler]: https://github.com/carlhuda/bundler#readme
+[git]: https://github.com/git/git
 
 [OSVDB]: http://osvdb.org/
 [ruby-advisory-db]: https://github.com/rubysec/ruby-advisory-db

data/Rakefile

@@ -14,29 +14,6 @@ require 'time'
 require 'rubygems/tasks'
 Gem::Tasks.new
 
-directory 'data/ruby-advisory-db' do
-  sh 'git', 'submodule', 'update', '--init'
-end
-
-namespace :db do
-  desc 'Updates data/ruby-advisory-db'
-  task :update => 'data/ruuby-advsisory-db' do
-    timestamp = nil
-
-    chdir 'data/ruby-advisory-db' do
-      sh 'git', 'pull', 'origin', 'master'
-
-      File.open('../ruby-advisory-db.ts','w') do |file|
-        file.write Time.parse(`git log --date=iso8601 --pretty="%cd" -1`).utc
-      end
-    end
-
-    sh 'git', 'commit', 'data/ruby-advisory-db',
-                        'data/ruby-advisory-db.ts',
-                        '-m', 'Updated ruby-advisory-db'
-  end
-end
-
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new
 

data/bundler-audit.gemspec

@@ -26,13 +26,6 @@ Gem::Specification.new do |gem|
   gem.files = `git ls-files`.split($/)
   gem.files = glob[gemspec['files']] if gemspec['files']
 
-  # add paths from data/ruby-advisory-db/
-  gem.files += Dir.chdir('data/ruby-advisory-db') do
-    `git ls-files`.split($/).map do |sub_path|
-      File.join('data','ruby-advisory-db',sub_path)
-    end
-  end
-
   gem.executables = gemspec.fetch('executables') do
     glob['bin/*'].map { |path| File.basename(path) }
   end

data/lib/bundler/audit/advisory.rb

@@ -121,7 +121,7 @@ module Bundler
       #
       # Determines how critical the vulnerability is.
       #
-      # @return [:none, :low, :medium, :high, :critical]
+      # @return [:none, :low, :medium, :high, :critical, nil]
       #   The criticality of the vulnerability based on the CVSS score.
       #
       def criticality
@@ -189,6 +189,17 @@ module Bundler
         !patched?(version) && !unaffected?(version)
       end
 
+      #
+      # Compares two advisories.
+      #
+      # @param [Advisory] other
+      #
+      # @return [Boolean]
+      #
+      def ==(other)
+        id == other.id
+      end
+
       alias to_s id
 
     end

data/lib/bundler/audit/cli.rb

@@ -17,10 +17,10 @@
 
 require 'bundler/audit/scanner'
 require 'bundler/audit/version'
+require 'bundler/audit/cli/formats'
 
 require 'thor'
 require 'bundler'
-require 'bundler/vendored_thor'
 
 module Bundler
   module Audit
@@ -29,44 +29,102 @@ module Bundler
       default_task :check
       map '--version' => :version
 
-      desc 'check', 'Checks the Gemfile.lock for insecure dependencies'
+      desc 'check [DIR]', 'Checks the Gemfile.lock for insecure dependencies'
       method_option :quiet, :type => :boolean, :aliases => '-q'
       method_option :verbose, :type => :boolean, :aliases => '-v'
       method_option :ignore, :type => :array, :aliases => '-i'
       method_option :update, :type => :boolean, :aliases => '-u'
+      method_option :database, :type => :string, :aliases => '-D', :default => Database::USER_PATH
+      method_option :format, :type => :string, :default => 'text',
+                             :aliases => '-F'
+      method_option :gemfile_lock, :type => :string, :aliases => '-G', :default => 'Gemfile.lock'
+      method_option :output, :type => :string, :aliases => '-o'
+
+      def check(dir=Dir.pwd)
+        unless File.directory?(dir)
+          say "No such file or directory: #{dir}", :red
+          exit 1
+        end
 
-      def check
-        update if options[:update]
+        begin
+          extend Formats.load(options[:format])
+        rescue Formats::FormatNotFound
+          say "Unknown format: #{options[:format]}", :red
+          exit 1
+        end
 
-        scanner    = Scanner.new
-        vulnerable = false
+        if !Database.exists?
+          download(options[:database])
+        elsif options[:update]
+          update(options[:database])
+        end
 
-        scanner.scan(:ignore => options.ignore) do |result|
-          vulnerable = true
+        database = Database.new(options[:database])
+        scanner  = begin
+                     Scanner.new(dir,options[:gemfile_lock],database)
+                   rescue Bundler::GemfileLockNotFound => exception
+                     say exception.message, :red
+                     exit 1
+                   end
+        report   = scanner.report(:ignore => options.ignore)
 
-          case result
-          when Scanner::InsecureSource
-            print_warning "Insecure Source URI found: #{result.source}"
-          when Scanner::UnpatchedGem
-            print_advisory result.gem, result.advisory
-          end
+        output = if options[:output] then File.new(options[:output],'w')
+                 else                     $stdout
+                 end
+
+        print_report(report,output)
+
+        output.close if options[:output]
+
+        exit(1) if report.vulnerable?
+      end
+
+      desc 'stats', 'Prints ruby-advisory-db stats'
+      method_option :quiet, :type => :boolean, :aliases => '-q'
+
+      def stats(path=Database.path)
+        database = Database.new(path)
+
+        puts "ruby-advisory-db:"
+        puts "  advisories:\t#{database.size} advisories"
+        puts "  last updated:\t#{database.last_updated_at}"
+      end
+
+      desc 'download', 'Downloads ruby-advisory-db'
+      method_option :quiet, :type => :boolean, :aliases => '-q'
+
+      def download(path=Database.path)
+        if Database.exists?(path)
+          say "Database already exists", :yellow
+          return
         end
 
-        if vulnerable
-          say "Vulnerabilities found!", :red
+        say("Download ruby-advisory-db ...") unless options.quiet?
+
+        begin
+          Database.download(path: path, quiet: options.quiet?)
+        rescue Database::DownloadFailed => error
+          say error.message, :red
           exit 1
-        else
-          say("No vulnerabilities found", :green) unless options.quiet?
         end
+
+        stats(path) unless options.quiet?
       end
 
       desc 'update', 'Updates the ruby-advisory-db'
       method_option :quiet, :type => :boolean, :aliases => '-q'
 
-      def update
+      def update(path=Database.path)
+        unless Database.exists?(path)
+          download(path)
+          return
+        end
+
         say("Updating ruby-advisory-db ...") unless options.quiet?
 
-        case Database.update!(quiet: options.quiet?)
+        database = Database.new(path)
+
+        case database.update!(quiet: options.quiet?)
         when true
           say("Updated ruby-advisory-db", :green) unless options.quiet?
         when false
@@ -80,9 +138,7 @@ module Bundler
           say "Skipping update", :yellow
         end
 
-        unless options.quiet?
-          puts("ruby-advisory-db: #{Database.new.size} advisories")
-        end
+        stats(path) unless options.quiet?
       end
 
       desc 'version', 'Prints the bundler-audit version'
@@ -94,68 +150,18 @@ module Bundler
 
       protected
 
+      #
+      # @abstract
+      #
+      def print_report(report)
+        raise(NotImplementedError,"#{self.class}##{__method__} not defined")
+      end
+
       def say(message="", color=nil)
         color = nil unless $stdout.tty?
         super(message.to_s, color)
       end
 
-      def print_warning(message)
-        say message, :yellow
-      end
-
-      def print_advisory(gem, advisory)
-        say "Name: ", :red
-        say gem.name
-
-        say "Version: ", :red
-        say gem.version
-
-        say "Advisory: ", :red
-
-        if advisory.cve
-          say advisory.cve_id
-        elsif advisory.osvdb
-          say advisory.osvdb_id
-        elsif advisory.ghsa
-          say advisory.ghsa_id
-        end
-
-        say "Criticality: ", :red
-        case advisory.criticality
-        when :none     then say "None"
-        when :low      then say "Low"
-        when :medium   then say "Medium", :yellow
-        when :high     then say "High", [:red, :bold]
-        when :critical then say "Critical", [:red, :bold]
-        else                say "Unknown"
-        end
-
-        say "URL: ", :red
-        say advisory.url
-
-        if options.verbose?
-          say "Description:", :red
-          say
-
-          print_wrapped advisory.description, :indent => 2
-          say
-        else
-
-          say "Title: ", :red
-          say advisory.title
-        end
-
-        unless advisory.patched_versions.empty?
-          say "Solution: upgrade to ", :red
-          say advisory.patched_versions.join(', ')
-        else
-          say "Solution: ", :red
-          say "remove or disable this gem until a patch is available!", [:red, :bold]
-        end
-
-        say
-      end
-
     end
   end
 end