bundler-budit 0.6.1

data/lib/bundler/audit/presenter/base.rb

@@ -0,0 +1,39 @@
+module Bundler
+  module Audit
+    module Presenter
+      class Base
+        attr_reader :options
+        attr_reader :shell
+
+        def initialize(shell, options)
+          @shell = shell
+          @options = options
+          @warnings = []
+          @advisory_bundles = []
+        end
+
+        def push_warning(message)
+          @warnings.push(message)
+        end
+
+        def push_advisory(advisory)
+          @advisory_bundles.push(advisory)
+        end
+
+        def print_report
+          raise RuntimeError, "Not Implemented"
+        end
+
+        def exit_code
+          problematic? ? 1 : 0
+        end
+
+        protected
+
+        def problematic?
+          @warnings.any? || @advisory_bundles.any?
+        end
+      end
+    end
+  end
+end

data/lib/bundler/audit/presenter/junit.rb

@@ -0,0 +1,67 @@
+require 'erb'
+
+module Bundler
+  module Audit
+    module Presenter
+      class Junit < Base
+        def print_report
+          puts ERB.new(template_string, nil, '-').result(binding)
+        end
+
+        protected
+
+        def advisory_ref(advisory)
+          if advisory.cve
+            "CVE-#{advisory.cve}"
+          elsif advisory.osvdb
+            advisory.osvdb
+          end
+        end
+
+        def advisory_criticality(advisory)
+          case advisory.criticality
+          when :low    then "Low"
+          when :medium then "Medium"
+          when :high   then "High"
+          else              "Unknown"
+          end
+        end
+
+        def advisory_solution(advisory)
+          unless advisory.patched_versions.empty?
+            "upgrade to #{advisory.patched_versions.join(', ')}"
+          else
+            "remove or disable this gem until a patch is available!"
+          end
+        end
+
+        def bundle_title(bundle)
+          "#{advisory_criticality(bundle.advisory).upcase} #{bundle.gem.name}(#{bundle.gem.version}) #{bundle.advisory.title}"
+        end
+
+        def template_string
+          <<-HERE.strip
+<?xml version="1.0" encoding="UTF-8" ?>
+<testsuites id="<%= Time.now.to_i %>" name="Bundle Audit" tests="225" failures="1262">
+  <testsuite id="Gemfile" name="Ruby Gemfile" failures="<%= @advisory_bundles.size %>">
+    <%- @advisory_bundles.each do |bundle| -%>
+    <testcase id="<%= bundle.gem.name %>" name="<%= bundle_title(bundle) %>">
+      <failure message="<%= bundle.advisory.title %>" type="<%= bundle.advisory.criticality %>">
+Name: <%= bundle.gem.name %>
+Version: <%= bundle.gem.version %>
+Advisory: <%= advisory_ref(bundle.advisory) %>
+Criticality: <%= advisory_criticality(bundle.advisory) %>
+URL: <%= bundle.advisory.url %>
+Title: <%= bundle.advisory.title %>
+Solution: <%= advisory_solution(bundle.advisory) %>
+      </failure>
+    </testcase>
+    <%- end -%>
+  </testsuite>
+</testsuites>
+          HERE
+        end
+      end
+    end
+  end
+end

data/lib/bundler/audit/presenter/plain.rb

@@ -0,0 +1,86 @@
+require 'bundler/audit/presenter/base'
+
+module Bundler
+  module Audit
+    module Presenter
+      class Plain < Base
+        def print_report
+          @warnings.each do |warning|
+            print_warning warning
+          end
+
+          @advisory_bundles.each do |bundle|
+            print_advisory bundle.gem, bundle.advisory
+          end
+
+          if problematic?
+            say "Vulnerabilities found!", :red
+          else
+            say("No vulnerabilities found", :green) unless options.quiet?
+          end
+        end
+
+        protected
+
+        def say(message = '', color = nil)
+          color = nil unless $stdout.tty?
+          shell.say(message.to_s, color)
+        end
+
+        def print_warning(message)
+          say message, :yellow
+        end
+
+        def print_advisory(gem, advisory)
+          say "Name: ", :red
+          say gem.name
+
+          say "Version: ", :red
+          say gem.version
+
+          say "Advisory: ", :red
+
+          if advisory.cve
+            say "CVE-#{advisory.cve}"
+          elsif advisory.osvdb
+            say advisory.osvdb
+          end
+
+          say "Criticality: ", :red
+          case advisory.criticality
+          when :low    then say "Low"
+          when :medium then say "Medium", :yellow
+          when :high   then say "High", [:red, :bold]
+          else              say "Unknown"
+          end
+
+          say "URL: ", :red
+          say advisory.url
+
+          if options.verbose?
+            say "Description:", :red
+            say
+
+            print_wrapped advisory.description, :indent => 2
+            say
+          else
+
+            say "Title: ", :red
+            say advisory.title
+          end
+
+          unless advisory.patched_versions.empty?
+            say "Solution: upgrade to ", :red
+            say advisory.patched_versions.join(', ')
+          else
+            say "Solution: ", :red
+            say "remove or disable this gem until a patch is available!", [:red, :bold]
+          end
+
+          say
+        end
+
+      end
+    end
+  end
+end

data/lib/bundler/audit/scanner.rb

@@ -0,0 +1,213 @@
+require 'bundler'
+require 'bundler/audit/database'
+require 'bundler/lockfile_parser'
+
+require 'ipaddr'
+require 'resolv'
+require 'set'
+require 'uri'
+
+module Bundler
+  module Audit
+    class Scanner
+
+      # Represents a plain-text source
+      InsecureSource = Struct.new(:source)
+
+      # Represents a gem that is covered by an Advisory
+      UnpatchedGem = Struct.new(:gem, :advisory)
+
+      # The advisory database
+      #
+      # @return [Database]
+      attr_reader :database
+
+      # Project root directory
+      attr_reader :root
+
+      # The parsed `Gemfile.lock` from the project
+      #
+      # @return [Bundler::LockfileParser]
+      attr_reader :lockfile
+
+      #
+      # Initializes a scanner.
+      #
+      # @param [String] root
+      #   The path to the project root.
+      #
+      # @param [String] gemfile_lock
+      #   Alternative name for the `Gemfile.lock` file.
+      #
+      def initialize(root=Dir.pwd,gemfile_lock='Gemfile.lock')
+        @root     = File.expand_path(root)
+        @database = Database.new
+        @lockfile = LockfileParser.new(
+          File.read(File.join(@root,gemfile_lock))
+        )
+      end
+
+      #
+      # Scans the project for issues.
+      #
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @option options [Array<String>] :ignore
+      #   The advisories to ignore.
+      #
+      # @yield [result]
+      #   The given block will be passed the results of the scan.
+      #
+      # @yieldparam [InsecureSource, UnpatchedGem] result
+      #   A result from the scan.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def scan(options={},&block)
+        return enum_for(__method__,options) unless block
+
+        ignore = Set[]
+        ignore += options[:ignore] if options[:ignore]
+
+        scan_sources(options,&block)
+        scan_specs(options,&block)
+
+        return self
+      end
+
+      #
+      # Scans the gem sources in the lockfile.
+      #
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @yield [result]
+      #   The given block will be passed the results of the scan.
+      #
+      # @yieldparam [InsecureSource] result
+      #   A result from the scan.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      # @api semipublic
+      #
+      # @since 0.4.0
+      #
+      def scan_sources(options={})
+        return enum_for(__method__,options) unless block_given?
+
+        @lockfile.sources.map do |source|
+          case source
+          when Source::Git
+            case source.uri
+            when /^git:/, /^http:/
+              unless internal_source?(source.uri)
+                yield InsecureSource.new(source.uri)
+              end
+            end
+          when Source::Rubygems
+            source.remotes.each do |uri|
+              if (uri.scheme == 'http' && !internal_source?(uri))
+                yield InsecureSource.new(uri.to_s)
+              end
+            end
+          end
+        end
+      end
+
+      #
+      # Scans the gem sources in the lockfile.
+      #
+      # @param [Hash] options
+      #   Additional options.
+      #
+      # @option options [Array<String>] :ignore
+      #   The advisories to ignore.
+      #
+      # @yield [result]
+      #   The given block will be passed the results of the scan.
+      #
+      # @yieldparam [UnpatchedGem] result
+      #   A result from the scan.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      # @api semipublic
+      #
+      # @since 0.4.0
+      #
+      def scan_specs(options={})
+        return enum_for(__method__,options) unless block_given?
+
+        ignore = Set[]
+        ignore += options[:ignore] if options[:ignore]
+
+        @lockfile.specs.each do |gem|
+          @database.check_gem(gem) do |advisory|
+            unless (ignore.include?(advisory.cve_id) ||
+                    ignore.include?(advisory.osvdb_id))
+              yield UnpatchedGem.new(gem,advisory)
+            end
+          end
+        end
+      end
+
+      private
+
+      #
+      # Determines whether a source is internal.
+      #
+      # @param [URI, String] uri
+      #   The URI.
+      #
+      # @return [Boolean]
+      #
+      def internal_source?(uri)
+        uri = URI(uri)
+
+        internal_host?(uri.host) if uri.host
+      end
+
+      #
+      # Determines whether a host is internal.
+      #
+      # @param [String] host
+      #   The hostname.
+      #
+      # @return [Boolean]
+      #
+      def internal_host?(host)
+        Resolv.getaddresses(host).all? { |ip| internal_ip?(ip) }
+      rescue URI::Error
+        false
+      end
+
+      # List of internal IP address ranges.
+      #
+      # @see https://tools.ietf.org/html/rfc1918#section-3
+      # @see https://tools.ietf.org/html/rfc4193#section-8
+      INTERNAL_SUBNETS = %w[
+        10.0.0.0/8
+        172.16.0.0/12
+        192.168.0.0/16
+        fc00::/7
+      ].map(&IPAddr.method(:new))
+
+      #
+      # Determines whether an IP is internal.
+      #
+      # @param [String] ip
+      #   The IPv4/IPv6 address.
+      #
+      # @return [Boolean]
+      #
+      def internal_ip?(ip)
+        INTERNAL_SUBNETS.any? { |subnet| subnet.include?(ip) }
+      end
+    end
+  end
+end

data/lib/bundler/audit/task.rb

@@ -0,0 +1,31 @@
+require 'rake/tasklib'
+
+module Bundler
+  module Audit
+    class Task < Rake::TaskLib
+      #
+      # Initializes the task.
+      #
+      def initialize
+        define
+      end
+
+      protected
+
+      #
+      # Defines the `bundle:audit` task.
+      #
+      def define
+        namespace :bundle do
+          desc 'Updates the ruby-advisory-db then runs bundle-audit'
+          task :audit do
+            require 'bundler/audit/cli'
+            %w(update check).each do |command|
+              Bundler::Audit::CLI.start [command]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/bundler/audit/version.rb

@@ -0,0 +1,23 @@
+#
+# Copyright (c) 2013-2019 Hal Brodigan (postmodern.mod3 at gmail.com)
+#
+# bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+module Bundler
+  module Audit
+    # bundler-audit version
+    VERSION = '0.6.1'
+  end
+end