bundler-budit 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb360629c11f8be23e8f9efab74c4ac46c6a38f540df031cb9d71fa75a0a8338
-  data.tar.gz: 2386f5c6bee41b77dc8a19fe576c1d97aeccff1d37564aa34e6d027b7212a12a
+  metadata.gz: aa9aa0247da0f2e96f96371694e74f8e55b2efccd53fb5f823a43acdfa1a281c
+  data.tar.gz: 36fc8dd9edf8d7e154b7e18efffc55a43aaef9709022e35e34f889cf111a2406
 SHA512:
-  metadata.gz: c7afa3fd77349448d522324ddbab01696d6f382f2a551700770eb5644dd5a21922a8db61efac450ff488f2ba01167c376bcf6bb82c67dc025b8013b081f215cb
-  data.tar.gz: 2a1861086c014c2fda0e603ff2b3fa5940cda3e303b56f70006a0c1c69f7cd428accaaa92032070d3e38cbef142bf360de010b1599b0cd83a69e3f915627b1fb
+  metadata.gz: ee853ff6a4864510a5cbda79a77752719fcf548966dfd114b2a0fcf8b349fa6f162a6f02d9307938d365d1bb6f534f2e4781e8e1ea0fcad71e2fad0a8ce39203
+  data.tar.gz: 2ffa8cec6e24e49d1525e2ab83b5eae9d6d80ccffc6729388e88dc547a5b858c1a3b25add0fae7edd6141f5032d216bb30497c859362aae1e6c80798f2673a6e

data/ChangeLog.md

@@ -1,3 +1,8 @@
+### 0.6.2 / 2019-04-09
+
+* Add: `--format=default|plain|junit`
+* Fix: Escape XML output for junit formatter
+
 ### 0.6.1 / 2019-01-17
 
 * Require bundler `>= 1.2.0, < 3` to support [bundler] 2.0.

data/gemspec.yml

@@ -2,7 +2,7 @@ name: bundler-budit
 summary: Patch-level verification for Bundler
 description: bundler-budit is a fork of bundler-audit, which provides patch-level verification for Bundled apps.
 license: GPL-3.0+
-authors: Postmodern, Salzig
+authors: Postmodern, Salzig, Gnomus
 email: salzig@gmail.com
 homepage: https://github.com/salzig/bundler-audit#readme
 

data/lib/bundler/audit/presenter/junit.rb

@@ -12,9 +12,9 @@ module Bundler
 
         def advisory_ref(advisory)
           if advisory.cve
-            "CVE-#{advisory.cve}"
+            xml_escape "CVE-#{advisory.cve}"
           elsif advisory.osvdb
-            advisory.osvdb
+            xml_escape advisory.osvdb
           end
         end
 
@@ -29,14 +29,25 @@ module Bundler
 
         def advisory_solution(advisory)
           unless advisory.patched_versions.empty?
-            "upgrade to #{advisory.patched_versions.join(', ')}"
+            xml_escape "upgrade to #{advisory.patched_versions.join(', ')}"
           else
             "remove or disable this gem until a patch is available!"
           end
         end
 
         def bundle_title(bundle)
-          "#{advisory_criticality(bundle.advisory).upcase} #{bundle.gem.name}(#{bundle.gem.version}) #{bundle.advisory.title}"
+          xml_escape "#{advisory_criticality(bundle.advisory).upcase} #{bundle.gem.name}(#{bundle.gem.version}) #{bundle.advisory.title}"
+        end
+
+        def xml_escape(string)
+          string.gsub(
+            /[<>"'&]/,
+            '<' => '&lt;',
+            '>' => '&gt;',
+            '"' => '&quot;',
+            '\'' => '&apos;',
+            '&' => '&amp;',
+          )
         end
 
         def template_string
@@ -45,14 +56,14 @@ module Bundler
 <testsuites id="<%= Time.now.to_i %>" name="Bundle Audit" tests="225" failures="1262">
   <testsuite id="Gemfile" name="Ruby Gemfile" failures="<%= @advisory_bundles.size %>">
     <%- @advisory_bundles.each do |bundle| -%>
-    <testcase id="<%= bundle.gem.name %>" name="<%= bundle_title(bundle) %>">
-      <failure message="<%= bundle.advisory.title %>" type="<%= bundle.advisory.criticality %>">
-Name: <%= bundle.gem.name %>
-Version: <%= bundle.gem.version %>
+    <testcase id="<%= xml_escape(bundle.gem.name) %>" name="<%= bundle_title(bundle) %>">
+      <failure message="<%= xml_escape(bundle.advisory.title) %>" type="<%= xml_escape(bundle.advisory.criticality) %>">
+Name: <%= xml_escape(bundle.gem.name) %>
+Version: <%= xml_escape(bundle.gem.version) %>
 Advisory: <%= advisory_ref(bundle.advisory) %>
 Criticality: <%= advisory_criticality(bundle.advisory) %>
-URL: <%= bundle.advisory.url %>
-Title: <%= bundle.advisory.title %>
+URL: <%= xml_escape(bundle.advisory.url) %>
+Title: <%= xml_escape(bundle.advisory.title) %>
 Solution: <%= advisory_solution(bundle.advisory) %>
       </failure>
     </testcase>

data/lib/bundler/audit/version.rb

@@ -18,6 +18,6 @@
 module Bundler
   module Audit
     # bundler-audit version
-    VERSION = '0.6.1'
+    VERSION = '0.6.2'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bundler-budit
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
-- Postmodern, Salzig
+- Postmodern, Salzig, Gnomus
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-03 00:00:00.000000000 Z
+date: 2019-04-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor
@@ -553,7 +553,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 1.8.0
 requirements: []
-rubygems_version: 3.0.1
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Patch-level verification for Bundler