bundler_audit_notifier 0.0.7 → 0.0.12
Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3e6f95356cd63ebb74e5a3d6172b773a9e391da5c8dc3cb765945714fa2cc624
|
|
4
|
+
data.tar.gz: defa67385cf51d5999ca0fa7c16c8e7b02c610cce63746a006c5f0f5f94239f3
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 540b2dea155ddfa8b31bd5db773440500c559d1ecce979dd87411a81dcd634d820e2b51d61da7723e9a802755666c69d09236b4fd31714326199149dc8c44935
|
|
7
|
+
data.tar.gz: 9807fe798b5faf478f25220348ac3ebe7474b2a1ef478c0eaff44bf727e979067f87d742bdd707b3e6886a5520f909c3f289ede98f0f7a09cf0eea4a1c9f00e7
|
|
@@ -15,7 +15,7 @@ class BundlerAuditIssuesController < ActionController::Base
|
|
|
15
15
|
if params[:token].present?
|
|
16
16
|
bundler_audit_issue = BundlerAuditIssue.where(token: params[:token]).first
|
|
17
17
|
if bundler_audit_issue
|
|
18
|
-
|
|
18
|
+
::Rails.logger.info("Authorized accesss to api for bundler audit issue: #{params[:token]}")
|
|
19
19
|
return true
|
|
20
20
|
else
|
|
21
21
|
::Rails.logger.warn("Unauthorized accesss to api for bundler audit issue: #{params[:token]}")
|
|
@@ -8,4 +8,8 @@ class BundlerAuditIssuesMailer < ActionMailer::Base
|
|
|
8
8
|
@vulnerabilities = vulnerabilities
|
|
9
9
|
mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Results')
|
|
10
10
|
end
|
|
11
|
+
def error_in_running errors, opts = {}
|
|
12
|
+
@errors = errors
|
|
13
|
+
mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Errored')
|
|
14
|
+
end
|
|
11
15
|
end
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
<!DOCTYPE html>
|
|
2
|
+
<html>
|
|
3
|
+
<head>
|
|
4
|
+
<meta content='text/html; charset=UTF-8' http-equiv='Content-Type' />
|
|
5
|
+
</head>
|
|
6
|
+
<body>
|
|
7
|
+
<h1>Vulnerabilities: </h1>
|
|
8
|
+
<ul>
|
|
9
|
+
<%= @errors.each do |error| %>
|
|
10
|
+
<li> <%= line[:error].to_s.html_safe %></li>
|
|
11
|
+
<% end %>
|
|
12
|
+
</ul>
|
|
13
|
+
</body>
|
|
14
|
+
</html>
|
|
@@ -1,65 +1,99 @@
|
|
|
1
1
|
# dependencies
|
|
2
2
|
require "active_support"
|
|
3
|
-
require 'rake'
|
|
4
|
-
require "bundler_audit_notifier/engine"
|
|
5
|
-
require "auditer_script"
|
|
6
3
|
|
|
7
4
|
module BundlerAuditNotifier
|
|
8
5
|
def self.audit_parse
|
|
9
6
|
r, w = IO.pipe
|
|
10
7
|
# Spawn executes specified command and return its pid
|
|
11
8
|
# This line will execute code that runs bundler-audit and then write the output into the IO pipe
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
9
|
+
script_location = "lib/auditer_script.rb"
|
|
10
|
+
if File.exists?("lib/auditer_script.rb")
|
|
11
|
+
# use local file lib
|
|
12
|
+
else
|
|
13
|
+
gem_file_path = (`bundle show bundler_audit_notifier`).strip
|
|
14
|
+
gem_location = (File.join(gem_file_path, 'lib', 'auditer_script.rb'))
|
|
15
|
+
if File.exists(gem_location)
|
|
16
|
+
script_location = gem_location
|
|
17
|
+
else
|
|
18
|
+
errors << "Error parsing Script file location: Neither #{script_location} nor #{gem_location}"
|
|
19
|
+
end
|
|
20
|
+
end
|
|
21
|
+
if errors.none?
|
|
22
|
+
pid = spawn(RbConfig.ruby, script_location, :out => w, :err => [:child, :out])
|
|
23
|
+
Process.wait2(pid)
|
|
24
|
+
w.close
|
|
25
|
+
puts "MADE IT HERE"
|
|
26
|
+
# At this point, the results of the bundler-audit check command are written in the IO pipe
|
|
27
|
+
vulnerabilities = []# load quieries from database
|
|
28
|
+
errors = []
|
|
29
|
+
puts r.inspect
|
|
30
|
+
puts r.eof?.inspect
|
|
31
|
+
puts "MADE IT HERE 1"
|
|
32
|
+
while !r.eof?
|
|
33
|
+
puts "MADE IT HERE 2"
|
|
34
|
+
name_line = r.gets
|
|
35
|
+
puts name_line
|
|
36
|
+
puts "MADE IT HERE3"
|
|
37
|
+
|
|
38
|
+
if name = name_line[/Name: (?<name>.+)/, :name]
|
|
39
|
+
version_line = r.gets
|
|
40
|
+
puts version_line
|
|
41
|
+
advisory_line = r.gets
|
|
42
|
+
puts advisory_line
|
|
43
|
+
criticality_line = r.gets
|
|
44
|
+
puts criticality_line
|
|
45
|
+
url_line = r.gets
|
|
46
|
+
puts url_line
|
|
47
|
+
title_line = r.gets
|
|
48
|
+
puts title_line
|
|
49
|
+
solution_line = r.gets
|
|
50
|
+
puts solution_line
|
|
51
|
+
space = r.gets
|
|
52
|
+
puts space
|
|
53
|
+
if version_line && advisory_line && criticality_line && url_line && title_line && solution_line
|
|
54
|
+
version = version_line[/Version: (?<version>.+)/, :version]
|
|
55
|
+
advisory = advisory_line[/Advisory: (?<advisory>.+)/, :advisory]
|
|
56
|
+
criticality = criticality_line[/Criticality: (?<criticality>.+)/, :criticality]
|
|
57
|
+
url = url_line[/URL: (?<url>.+)/, :url]
|
|
58
|
+
title = title_line[/Title: (?<title>.+)/, :title]
|
|
59
|
+
solution = solution_line[/Solution: (?<solution>.+)/, :solution]
|
|
36
60
|
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
61
|
+
# check for valid data
|
|
62
|
+
# check database table for existing event
|
|
63
|
+
if BundlerAuditIssue.exists?(advisory: advisory)
|
|
64
|
+
# if event found, touch event
|
|
65
|
+
BundlerAuditIssue.where(advisory: advisory).first.touch
|
|
66
|
+
# if found event is ignored, remove from vulnerabilites hash
|
|
67
|
+
if !BundlerAuditIssue.where(advisory: advisory).first.ignore
|
|
68
|
+
vulnerabilities << {:name => name, :version => version, :advisory => advisory, :criticality => criticality, :url => url, :title => title, :solution => solution}
|
|
69
|
+
end
|
|
70
|
+
puts "VULNERABILITIES"
|
|
71
|
+
puts vulnerabilities.inspect
|
|
72
|
+
else
|
|
73
|
+
BundlerAuditIssue.create(:name => name, :version => version, :advisory => advisory, :criticality => criticality, :url => url, :title => title, :solution => solution)
|
|
49
74
|
|
|
50
|
-
|
|
75
|
+
vulnerabilities << {:name => name, :version => version, :advisory => advisory, :criticality => criticality, :url => url, :title => title, :solution => solution}
|
|
76
|
+
puts vulnerabilities.inspect
|
|
77
|
+
end
|
|
78
|
+
else
|
|
79
|
+
puts "ERROR: nil line found #{version_line}, #{advisory_line}, #{criticality_line}, #{url_line}, #{title_line}, #{solution_line}"
|
|
51
80
|
end
|
|
81
|
+
elsif name_line.strip == "Vulnerabilities found!"
|
|
82
|
+
puts "End of output reached!"
|
|
52
83
|
else
|
|
53
|
-
puts "ERROR:
|
|
84
|
+
puts "ERROR: FOUND ERROR PARSING"
|
|
85
|
+
puts name_line.inspect
|
|
86
|
+
errors << "Error parsing NAME LINE: #{name_line}"
|
|
54
87
|
end
|
|
55
|
-
elsif name_line.strip == "Vulnerabilities found!"
|
|
56
|
-
puts "End of output reached!"
|
|
57
88
|
end
|
|
58
89
|
end
|
|
59
90
|
# iterate through remaining vulnerabilties and send them in an email if any are remaining
|
|
91
|
+
if errors.present?
|
|
92
|
+
ApplicationMailer.error_in_running(errors).deliver_now
|
|
93
|
+
end
|
|
60
94
|
if vulnerabilities.present?
|
|
61
|
-
|
|
95
|
+
ApplicationMailer.vulnerability_email(vulnerabilities).deliver_now
|
|
62
96
|
end
|
|
97
|
+
return [vulnerabilities, errors]
|
|
63
98
|
end
|
|
64
|
-
end
|
|
65
|
-
|
|
99
|
+
end
|
metadata
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: bundler_audit_notifier
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.0.
|
|
4
|
+
version: 0.0.12
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Marley Stipich
|
|
@@ -38,20 +38,6 @@ dependencies:
|
|
|
38
38
|
- - ">="
|
|
39
39
|
- !ruby/object:Gem::Version
|
|
40
40
|
version: '0'
|
|
41
|
-
- !ruby/object:Gem::Dependency
|
|
42
|
-
name: sqlite3
|
|
43
|
-
requirement: !ruby/object:Gem::Requirement
|
|
44
|
-
requirements:
|
|
45
|
-
- - ">="
|
|
46
|
-
- !ruby/object:Gem::Version
|
|
47
|
-
version: '0'
|
|
48
|
-
type: :runtime
|
|
49
|
-
prerelease: false
|
|
50
|
-
version_requirements: !ruby/object:Gem::Requirement
|
|
51
|
-
requirements:
|
|
52
|
-
- - ">="
|
|
53
|
-
- !ruby/object:Gem::Version
|
|
54
|
-
version: '0'
|
|
55
41
|
- !ruby/object:Gem::Dependency
|
|
56
42
|
name: rails
|
|
57
43
|
requirement: !ruby/object:Gem::Requirement
|
|
@@ -148,6 +134,20 @@ dependencies:
|
|
|
148
134
|
- - ">="
|
|
149
135
|
- !ruby/object:Gem::Version
|
|
150
136
|
version: '0'
|
|
137
|
+
- !ruby/object:Gem::Dependency
|
|
138
|
+
name: sqlite3
|
|
139
|
+
requirement: !ruby/object:Gem::Requirement
|
|
140
|
+
requirements:
|
|
141
|
+
- - ">="
|
|
142
|
+
- !ruby/object:Gem::Version
|
|
143
|
+
version: '0'
|
|
144
|
+
type: :development
|
|
145
|
+
prerelease: false
|
|
146
|
+
version_requirements: !ruby/object:Gem::Requirement
|
|
147
|
+
requirements:
|
|
148
|
+
- - ">="
|
|
149
|
+
- !ruby/object:Gem::Version
|
|
150
|
+
version: '0'
|
|
151
151
|
description:
|
|
152
152
|
email:
|
|
153
153
|
executables: []
|
|
@@ -158,6 +158,7 @@ files:
|
|
|
158
158
|
- app/mailers/bundler_audit_issues_mailer.rb
|
|
159
159
|
- app/models/bundler_audit_issue.rb
|
|
160
160
|
- app/views/bundler_audit_issues/ignore.html.erb
|
|
161
|
+
- app/views/bundler_audit_issues_mailer/error_in_running.html.erb
|
|
161
162
|
- app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb
|
|
162
163
|
- lib/auditer_script.rb
|
|
163
164
|
- lib/bundler_audit_notifier.rb
|