RubyGems - bundler_audit_notifier - Versions diffs - 0.0.8 → 0.1.12 - Mend

bundler_audit_notifier 0.0.8 → 0.1.12

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (7) hide show

checksums.yaml +4 -4
data/app/controllers/bundler_audit_issues_controller.rb +1 -1
data/app/mailers/bundler_audit_issues_mailer.rb +4 -0
data/app/views/bundler_audit_issues_mailer/error_in_running.html.erb +14 -0
data/app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb +10 -10
data/lib/bundler_audit_notifier.rb +74 -45
metadata +16 -15

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 459ffda5725eef00038a050640aec90b2be3c784e4768b82fa80c8b767839889
-  data.tar.gz: aa07a50baae00da87df16f6996e54ed5d4bf13a6d4e36dbccb59122194cb184f
+  metadata.gz: a83e35d3a799a6b5d82900e74a6c106347a25d51d1ddd947a2f28667558a0aec
+  data.tar.gz: 0c502972dc8b59643992e28313bf0683189d6bd61a43e7ce9b372b337ce1ad83
 SHA512:
-  metadata.gz: 3794240d3224bfc795d797226dce784b051265668e79c86f9c66f54436cf63500068b24dddf9e0c708a1186ad8d517b555b5a7325c92a7e47d91cf730f5155e5
-  data.tar.gz: 698e7fc2cc5ecbbb4b689cca13df44b09e9fe21970825fa9e935886bf0a2e4227368a4cc5c7b5bc54c8ae41614b2b0c69a9d74cbf2d8a758d6b9f0f0df0c2848
+  metadata.gz: c591a94bbf430312f1a2ed561d83066d82f0d9005f72431645255bb57e3f29d8ed42547dd0387f3c1b151152d8a6d97a6f46764e0e6181b1b984b69ade5de9e3
+  data.tar.gz: 76efc070abe43f3e0ad144687df4e5ba80bf8b0f9e0eacd356798e070b06cf3b0e1890dcd51b7bb1eef934d6259e612170a956ef5bf19d27958cd0e008fe55e2

data/app/controllers/bundler_audit_issues_controller.rb CHANGED Viewed

@@ -16,7 +16,7 @@ class BundlerAuditIssuesController < ActionController::Base
     if params[:token].present?
       bundler_audit_issue = BundlerAuditIssue.where(token: params[:token]).first
       if bundler_audit_issue
-      ::Rails.logger.info("Authorized accesss to api for bundler audit issue: #{params[:token]}")
+        ::Rails.logger.info("Authorized accesss to api for bundler audit issue: #{params[:token]}")
         return true
       else
         ::Rails.logger.warn("Unauthorized accesss to api for bundler audit issue: #{params[:token]}")

data/app/mailers/bundler_audit_issues_mailer.rb CHANGED Viewed

@@ -8,4 +8,8 @@ class BundlerAuditIssuesMailer < ActionMailer::Base
     @vulnerabilities = vulnerabilities
     mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Results')
   end
+  def error_in_running errors, opts = {}
+    @errors = errors
+    mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Errored')
+  end
 end

data/app/views/bundler_audit_issues_mailer/error_in_running.html.erb ADDED Viewed

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta content='text/html; charset=UTF-8' http-equiv='Content-Type' />
+  </head>
+  <body>
+    <h1>Vulnerabilities: </h1>
+    <ul>
+      <% @errors.each do |error|  %>
+        <li> <%= error.to_s.html_safe %></li>
+      <% end %>
+    </ul>
+  </body>
+</html>

data/app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb CHANGED Viewed

@@ -6,16 +6,16 @@
   <body>
     <h1>Vulnerabilities: </h1>
     <% @vulnerabilities.each do |line|  %>
-    <ul>
-    <li> Name: <%= line[:name].to_s.html_safe %></li>
-    <li> Version: <%= line[:version].to_s.html_safe %></li>
-    <li> Advisory: <%= line[:advisory].to_s.html_safe %></li>
-    <li> Criticality:<%= line[:criticality].to_s.html_safe %></li>
-    <li> Url: <%= line[:url].to_s.html_safe %></li>
-    <li> Title: <%= line[:title].to_s.html_safe %></li>
-    <li> Solution: <%= line[:solution].to_s.html_safe %></li>
-    </ul>
-    <p> Click here to ignore this vulnerability: <%= link_to "ignore", ignore_url(line.token) %></p>
+      <ul>
+        <li> Name: <%= line[:name].to_s.html_safe %></li>
+        <li> Version: <%= line[:version].to_s.html_safe %></li>
+        <li> Advisory: <%= line[:advisory].to_s.html_safe %></li>
+        <li> Criticality:<%= line[:criticality].to_s.html_safe %></li>
+        <li> Url: <%= line[:url].to_s.html_safe %></li>
+        <li> Title: <%= line[:title].to_s.html_safe %></li>
+        <li> Solution: <%= line[:solution].to_s.html_safe %></li>
+      </ul>
+      <p> Click here to ignore this vulnerability: <%= link_to "ignore", ignore_url(line[:token]) %></p>
     <% end %>
   </body>
 </html>

data/lib/bundler_audit_notifier.rb CHANGED Viewed

@@ -1,65 +1,94 @@
 # dependencies
 require "active_support"
-require 'rake'
-require "bundler_audit_notifier/engine"
-require "auditer_script"
 module BundlerAuditNotifier
   def self.audit_parse
     r, w = IO.pipe
+    errors = []
     # Spawn executes specified command and return its pid
     # This line will execute code that runs bundler-audit and then write the output into the IO pipe
-    # Spawning a process to read the output of bundler-audit update and check because after the commands finish running exit 1 is called and the output can no longer be read.
-    pid = spawn(RbConfig.ruby, "lib/auditer_script.rb", :out => w, :err => [:child, :out])
-    Process.wait2(pid)
-    w.close
-    # At this point, the results of the bundler-audit check command are written in the IO pipe
-    vulnerabilities = []# load quieries from database
-    while !r.eof?
-      name_line = r.gets
-      if name = name_line[/Name: (?<name>.+)/, :name]
-        version_line = r.gets
-        advisory_line = r.gets
-        criticality_line = r.gets
-        url_line = r.gets
-        title_line = r.gets
-        solution_line = r.gets
-        space = r.gets
-        if version_line && advisory_line && criticality_line && url_line && title_line && solution_line
-          version = version_line[/Version: (?<version>.+)/, :version]
-          advisory = advisory_line[/Advisory: (?<advisory>.+)/, :advisory]
-          criticality = criticality_line[/Criticality: (?<criticality>.+)/, :criticality]
-          url = url_line[/URL: (?<url>.+)/, :url]
-          title = title_line[/Title: (?<title>.+)/, :title]
-          solution = solution_line[/Solution: (?<solution>.+)/, :solution]
+    script_location = "lib/auditer_script.rb"
+    if File.exists?("lib/auditer_script.rb")
+      # use local file lib
+    else
+      gem_file_path = (`bundle show bundler_audit_notifier`).strip
+      gem_location = (File.join(gem_file_path, 'lib', 'auditer_script.rb'))
+      if File.exists?(gem_location)
+        script_location = gem_location
+      else
+        errors << "Error parsing Script file location: Neither #{script_location} nor #{gem_location}"
+      end
+    end
+    if errors.none?
+      pid = spawn(RbConfig.ruby, script_location, :out => w, :err => [:child, :out])
+      Process.wait2(pid)
+      w.close
+      # At this point, the results of the bundler-audit check command are written in the IO pipe
+      vulnerabilities = []# load quieries from database
+      update_line = r.gets
+      # Parsing bundler-audit update results
+      if update_line.starts_with?("Updating ruby-advisory-db ...")
+        while !update_line.start_with?('ruby-advisory-db:') && !r.eof?
+          update_line = r.gets
+        end
+      else
+        errors << "Error parsing DURING UPDATE: #{update_line}"
+      end
+      while !r.eof?
+        # Parsing the bundler-audit results
+        name_line = r.gets
+        if name = name_line[/Name: (?<name>.+)/, :name]
+          version_line = r.gets
+          advisory_line = r.gets
+          criticality_line = r.gets
+          url_line = r.gets
+          title_line = r.gets
+          solution_line = r.gets
+          space = r.gets
+          if version_line && advisory_line && criticality_line && url_line && title_line && solution_line
+            version = version_line[/Version: (?<version>.+)/, :version]
+            advisory = advisory_line[/Advisory: (?<advisory>.+)/, :advisory]
+            criticality = criticality_line[/Criticality: (?<criticality>.+)/, :criticality]
+            url = url_line[/URL: (?<url>.+)/, :url]
+            title = title_line[/Title: (?<title>.+)/, :title]
+            solution = solution_line[/Solution: (?<solution>.+)/, :solution]
-          # check for valid data
-          # check database table for existing event
-          if BundlerAuditIssue.exists?(advisory: advisory)
-            bundler_audit_issue = BundlerAuditIssue.where(advisory: advisory).first
-            #   if event found, touch event
-            bundler_audit_issue.touch
-            #  add event to vulnerabilities array if it was not marked ignored
-            if !bundler_audit_issue.ignore
-              vulnerabilities << bundler_audit_issue
+            # check for valid data
+            # check database table for existing event
+            data = {name: name, version: version, advisory: advisory, criticality: criticality, url: url, title: title, solution: solution}
+            bai = BundlerAuditIssue.find_by_advisory(advisory)
+            if bai
+              #   if event found, touch event
+              bai.touch
+              #   if found event is ignored, remove from vulnerabilites hash
+              if !bai.ignore
+                vulnerabilities << data.merge({token: bai.token})
+              end
+            else
+              if bai = BundlerAuditIssue.create(data)
+                vulnerabilities << data.merge({token: bai.token})
+              else
+                errors << "Error parsing creating new BundlerAuditIssue with the following #{data}"
+              end
             end
-          else
-            bundler_audit_issue = BundlerAuditIssue.create(:name => name, :version => version, :advisory => advisory, :criticality => criticality, :url => url, :title => title, :solution => solution)
-            vulnerabilities << bundler_audit_issue
+          else
+            errors << "ERROR: nil line found #{version_line}, #{advisory_line}, #{criticality_line}, #{url_line}, #{title_line}, #{solution_line}"
           end
+        elsif name_line.strip == "Vulnerabilities found!"
+          # puts "End of output reached!"
         else
-          puts "ERROR: nil line found #{version_line}, #{advisory_line}, #{criticality_line}, #{url_line}, #{title_line}, #{solution_line}"
+          errors << "Error parsing NAME LINE: #{name_line}"
         end
-      elsif name_line.strip == "Vulnerabilities found!"
-        puts "End of output reached!"
       end
     end
     # iterate through remaining vulnerabilties and send them in an email if any are remaining
+    if errors.present?
+      BundlerAuditIssuesMailer.error_in_running(errors).deliver_now
+    end
     if vulnerabilities.present?
       BundlerAuditIssuesMailer.vulnerability_email(vulnerabilities).deliver_now
     end
+    return [vulnerabilities, errors]
   end
-end
+end

metadata CHANGED Viewed

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler_audit_notifier
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.1.12
 platform: ruby
 authors:
 - Marley Stipich
@@ -38,20 +38,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: sqlite3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -148,6 +134,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description:
 email:
 executables: []
@@ -158,6 +158,7 @@ files:
 - app/mailers/bundler_audit_issues_mailer.rb
 - app/models/bundler_audit_issue.rb
 - app/views/bundler_audit_issues/ignore.html.erb
+- app/views/bundler_audit_issues_mailer/error_in_running.html.erb
 - app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb
 - lib/auditer_script.rb
 - lib/bundler_audit_notifier.rb