RubyGems - bundler_audit_notifier - Versions diffs - 0.0.10 → 0.3.12 - Mend

bundler_audit_notifier 0.0.10 → 0.3.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

checksums.yaml +4 -4
data/app/controllers/bundler_audit_issues_controller.rb +1 -0
data/app/mailers/bundler_audit_issues_mailer.rb +4 -0
data/app/views/bundler_audit_issues_mailer/error_in_running.html.erb +14 -0
data/app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb +10 -10
data/lib/bundler_audit_notifier.rb +74 -45
metadata +16 -15

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c11cf7a1bf0dc41b9f3e971910236a64827ed596c1f17ea97f1751332cf7f083
-  data.tar.gz: 7ca9600278e512fbbe1339109e7d55b35df4cb60939cc7d196ccd0ba10a5529d
+  metadata.gz: a75aaacf80f008270955ed0253b0680fce4634c70659313d1318943fe1d55c31
+  data.tar.gz: af882555b7ea25cb50c598b13d9c51378dc381c62deacac902fabf1aee2a42b3
 SHA512:
-  metadata.gz: a6b296635417383f6909b330faa1b110898deeff596df6a54ff14fe643c51f7a1d2e6e85f0d4a13fb01ba3453b426d13dbf18af95eb3b448beed4ef0f5dddda8
-  data.tar.gz: a62eefcc8c3ace178916dfc72d6756a992ee44ca59aaae083aa956542495a2d366492265172c990a1d4a887548e4949bda1939cb8a0eef574b0725bec260f31c
+  metadata.gz: 16ec90b875d4147cb4deffe00e88d95732aa4e552832aca16b0f7c85884ac0a5c6836f6e92ece5b5b28b624f99aeaa4838877f540fe1db888cfd4612de383962
+  data.tar.gz: a3b743f89fe2721b37608c7a105ccd6209b8882196227d83880290793e8e8b9d56e9c5ac8c396f1cc3973581603d8ad70a3b9e8eedc281c9dcad50e21d43f847

data/app/controllers/bundler_audit_issues_controller.rb CHANGED Viewed

@@ -4,6 +4,7 @@ class BundlerAuditIssuesController < ActionController::Base
   def ignore
     @bundler_audit_issue = BundlerAuditIssue.where(token: params[:token]).first
     @bundler_audit_issue.ignore = true
+    @bundler_audit_issue.token = nil
     if @bundler_audit_issue.save!
       render :ignore
     end

data/app/mailers/bundler_audit_issues_mailer.rb CHANGED Viewed

@@ -8,4 +8,8 @@ class BundlerAuditIssuesMailer < ActionMailer::Base
     @vulnerabilities = vulnerabilities
     mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Results')
   end
+  def error_in_running errors, opts = {}
+    @errors = errors
+    mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Errored')
+  end
 end

data/app/views/bundler_audit_issues_mailer/error_in_running.html.erb ADDED Viewed

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta content='text/html; charset=UTF-8' http-equiv='Content-Type' />
+  </head>
+  <body>
+    <h1>Vulnerabilities: </h1>
+    <ul>
+      <% @errors.each do |error|  %>
+        <li> <%= error.to_s.html_safe %></li>
+      <% end %>
+    </ul>
+  </body>
+</html>

data/app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb CHANGED Viewed

@@ -6,16 +6,16 @@
   <body>
     <h1>Vulnerabilities: </h1>
     <% @vulnerabilities.each do |line|  %>
-    <ul>
-    <li> Name: <%= line[:name].to_s.html_safe %></li>
-    <li> Version: <%= line[:version].to_s.html_safe %></li>
-    <li> Advisory: <%= line[:advisory].to_s.html_safe %></li>
-    <li> Criticality:<%= line[:criticality].to_s.html_safe %></li>
-    <li> Url: <%= line[:url].to_s.html_safe %></li>
-    <li> Title: <%= line[:title].to_s.html_safe %></li>
-    <li> Solution: <%= line[:solution].to_s.html_safe %></li>
-    </ul>
-    <p> Click here to ignore this vulnerability: <%= link_to "ignore", ignore_url(line.token) %></p>
+      <ul>
+        <li> Name: <%= line[:name].to_s.html_safe %></li>
+        <li> Version: <%= line[:version].to_s.html_safe %></li>
+        <li> Advisory: <%= line[:advisory].to_s.html_safe %></li>
+        <li> Criticality:<%= line[:criticality].to_s.html_safe %></li>
+        <li> Url: <%= line[:url].to_s.html_safe %></li>
+        <li> Title: <%= line[:title].to_s.html_safe %></li>
+        <li> Solution: <%= line[:solution].to_s.html_safe %></li>
+      </ul>
+      <p> Click here to ignore this vulnerability: <%= link_to "ignore", ignore_url(line[:token]) %></p>
     <% end %>
   </body>
 </html>

data/lib/bundler_audit_notifier.rb CHANGED Viewed

@@ -1,66 +1,95 @@
 # dependencies
 require "active_support"
-require 'rake'
 require "bundler_audit_notifier/engine"
 module BundlerAuditNotifier
   def self.audit_parse
     r, w = IO.pipe
-    audit_script_file = File.join(File.dirname(__FILE__), 'auditer_script.rb')
+    errors = []
     # Spawn executes specified command and return its pid
     # This line will execute code that runs bundler-audit and then write the output into the IO pipe
-    # Spawning a process to read the output of bundler-audit update and check because after the commands finish running exit 1 is called and the output can no longer be read.
-    pid = spawn(RbConfig.ruby, audit_script_file, :out => w, :err => [:child, :out])
-    Process.wait2(pid)
-    w.close
-    # At this point, the results of the bundler-audit check command are written in the IO pipe
-    vulnerabilities = []# load quieries from database
-    while !r.eof?
-      name_line = r.gets
-      if name = name_line[/Name: (?<name>.+)/, :name]
-        version_line = r.gets
-        advisory_line = r.gets
-        criticality_line = r.gets
-        url_line = r.gets
-        title_line = r.gets
-        solution_line = r.gets
-        space = r.gets
-        if version_line && advisory_line && criticality_line && url_line && title_line && solution_line
-          version = version_line[/Version: (?<version>.+)/, :version]
-          advisory = advisory_line[/Advisory: (?<advisory>.+)/, :advisory]
-          criticality = criticality_line[/Criticality: (?<criticality>.+)/, :criticality]
-          url = url_line[/URL: (?<url>.+)/, :url]
-          title = title_line[/Title: (?<title>.+)/, :title]
-          solution = solution_line[/Solution: (?<solution>.+)/, :solution]
+    script_location = "lib/auditer_script.rb"
+    if File.exists?("lib/auditer_script.rb")
+      # use local file lib
+    else
+      gem_file_path = (`bundle show bundler_audit_notifier`).strip
+      gem_location = (File.join(gem_file_path, 'lib', 'auditer_script.rb'))
+      if File.exists?(gem_location)
+        script_location = gem_location
+      else
+        errors << "Error parsing Script file location: Neither #{script_location} nor #{gem_location}"
+      end
+    end
+    if errors.none?
+      pid = spawn(RbConfig.ruby, script_location, :out => w, :err => [:child, :out])
+      Process.wait2(pid)
+      w.close
+      # At this point, the results of the bundler-audit check command are written in the IO pipe
+      vulnerabilities = []# load quieries from database
+      update_line = r.gets
+      # Parsing bundler-audit update results
+      if update_line.starts_with?("Updating ruby-advisory-db ...")
+        while !update_line.start_with?('ruby-advisory-db:') && !r.eof?
+          update_line = r.gets
+        end
+      else
+        errors << "Error parsing DURING UPDATE: #{update_line}"
+      end
+      while !r.eof?
+        # Parsing the bundler-audit results
+        name_line = r.gets
+        if name = name_line[/Name: (?<name>.+)/, :name]
+          version_line = r.gets
+          advisory_line = r.gets
+          criticality_line = r.gets
+          url_line = r.gets
+          title_line = r.gets
+          solution_line = r.gets
+          space = r.gets
+          if version_line && advisory_line && criticality_line && url_line && title_line && solution_line
+            version = version_line[/Version: (?<version>.+)/, :version]
+            advisory = advisory_line[/Advisory: (?<advisory>.+)/, :advisory]
+            criticality = criticality_line[/Criticality: (?<criticality>.+)/, :criticality]
+            url = url_line[/URL: (?<url>.+)/, :url]
+            title = title_line[/Title: (?<title>.+)/, :title]
+            solution = solution_line[/Solution: (?<solution>.+)/, :solution]
-          # check for valid data
-          # check database table for existing event
-          if BundlerAuditIssue.exists?(advisory: advisory)
-            bundler_audit_issue = BundlerAuditIssue.where(advisory: advisory).first
-            #   if event found, touch event
-            bundler_audit_issue.touch
-            #  add event to vulnerabilities array if it was not marked ignored
-            if !bundler_audit_issue.ignore
-              vulnerabilities << bundler_audit_issue
+            # check for valid data
+            # check database table for existing event
+            data = {name: name, version: version, advisory: advisory, criticality: criticality, url: url, title: title, solution: solution}
+            bai = ::BundlerAuditIssue.find_by_advisory(advisory)
+            if bai
+              #   if event found, touch event
+              bai.touch
+              #   if found event is ignored, remove from vulnerabilites hash
+              if !bai.ignore
+                vulnerabilities << data.merge({token: bai.token})
+              end
+            else
+              if bai = ::BundlerAuditIssue.create(data)
+                vulnerabilities << data.merge({token: bai.token})
+              else
+                errors << "Error parsing creating new BundlerAuditIssue with the following #{data}"
+              end
             end
-          else
-            bundler_audit_issue = BundlerAuditIssue.create(:name => name, :version => version, :advisory => advisory, :criticality => criticality, :url => url, :title => title, :solution => solution)
-            vulnerabilities << bundler_audit_issue
+          else
+            errors << "ERROR: nil line found #{version_line}, #{advisory_line}, #{criticality_line}, #{url_line}, #{title_line}, #{solution_line}"
           end
+        elsif name_line.strip == "Vulnerabilities found!"
+          # puts "End of output reached!"
         else
-          puts "ERROR: nil line found #{version_line}, #{advisory_line}, #{criticality_line}, #{url_line}, #{title_line}, #{solution_line}"
+          errors << "Error parsing NAME LINE: #{name_line}"
         end
-      elsif name_line.strip == "Vulnerabilities found!"
-        puts "End of output reached!"
       end
     end
     # iterate through remaining vulnerabilties and send them in an email if any are remaining
+    if errors.present?
+      BundlerAuditIssuesMailer.error_in_running(errors).deliver_now
+    end
     if vulnerabilities.present?
       BundlerAuditIssuesMailer.vulnerability_email(vulnerabilities).deliver_now
     end
+    return [vulnerabilities, errors]
   end
-end
+end

metadata CHANGED Viewed

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler_audit_notifier
 version: !ruby/object:Gem::Version
-  version: 0.0.10
+  version: 0.3.12
 platform: ruby
 authors:
 - Marley Stipich
@@ -38,20 +38,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: sqlite3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -148,6 +134,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description:
 email:
 executables: []
@@ -158,6 +158,7 @@ files:
 - app/mailers/bundler_audit_issues_mailer.rb
 - app/models/bundler_audit_issue.rb
 - app/views/bundler_audit_issues/ignore.html.erb
+- app/views/bundler_audit_issues_mailer/error_in_running.html.erb
 - app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb
 - lib/auditer_script.rb
 - lib/bundler_audit_notifier.rb