RubyGems - bundler_audit_notifier - Versions diffs - 0.0.8 → 0.1.12 - Mend

bundler_audit_notifier 0.0.8 → 0.1.12

Files changed (7) hide show

checksums.yaml +4 -4
data/app/controllers/bundler_audit_issues_controller.rb +1 -1
data/app/mailers/bundler_audit_issues_mailer.rb +4 -0
data/app/views/bundler_audit_issues_mailer/error_in_running.html.erb +14 -0
data/app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb +10 -10
data/lib/bundler_audit_notifier.rb +74 -45
metadata +16 -15

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 459ffda5725eef00038a050640aec90b2be3c784e4768b82fa80c8b767839889
-  data.tar.gz: aa07a50baae00da87df16f6996e54ed5d4bf13a6d4e36dbccb59122194cb184f
+  metadata.gz: a83e35d3a799a6b5d82900e74a6c106347a25d51d1ddd947a2f28667558a0aec
+  data.tar.gz: 0c502972dc8b59643992e28313bf0683189d6bd61a43e7ce9b372b337ce1ad83
 SHA512:
-  metadata.gz: 3794240d3224bfc795d797226dce784b051265668e79c86f9c66f54436cf63500068b24dddf9e0c708a1186ad8d517b555b5a7325c92a7e47d91cf730f5155e5
-  data.tar.gz: 698e7fc2cc5ecbbb4b689cca13df44b09e9fe21970825fa9e935886bf0a2e4227368a4cc5c7b5bc54c8ae41614b2b0c69a9d74cbf2d8a758d6b9f0f0df0c2848
+  metadata.gz: c591a94bbf430312f1a2ed561d83066d82f0d9005f72431645255bb57e3f29d8ed42547dd0387f3c1b151152d8a6d97a6f46764e0e6181b1b984b69ade5de9e3
+  data.tar.gz: 76efc070abe43f3e0ad144687df4e5ba80bf8b0f9e0eacd356798e070b06cf3b0e1890dcd51b7bb1eef934d6259e612170a956ef5bf19d27958cd0e008fe55e2

data/app/controllers/bundler_audit_issues_controller.rb CHANGED Viewed

@@ -16,7 +16,7 @@ class BundlerAuditIssuesController < ActionController::Base
     if params[:token].present?
       bundler_audit_issue = BundlerAuditIssue.where(token: params[:token]).first
       if bundler_audit_issue
-      ::Rails.logger.info("Authorized accesss to api for bundler audit issue: #{params[:token]}")
+        ::Rails.logger.info("Authorized accesss to api for bundler audit issue: #{params[:token]}")
         return true
       else
         ::Rails.logger.warn("Unauthorized accesss to api for bundler audit issue: #{params[:token]}")

data/app/mailers/bundler_audit_issues_mailer.rb CHANGED Viewed

@@ -8,4 +8,8 @@ class BundlerAuditIssuesMailer < ActionMailer::Base
     @vulnerabilities = vulnerabilities
     mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Results')
   end
+  def error_in_running errors, opts = {}
+    @errors = errors
+    mail(to: (opts[:custom_recipient] || DEFAULT_TO), subject: 'Vulnerability Scanner Errored')
+  end
 end

data/app/views/bundler_audit_issues_mailer/error_in_running.html.erb ADDED Viewed

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+  <head>
+    <meta content='text/html; charset=UTF-8' http-equiv='Content-Type' />
+  </head>
+  <body>
+    <h1>Vulnerabilities: </h1>
+    <ul>
+      <% @errors.each do |error|  %>
+        <li> <%= error.to_s.html_safe %></li>
+      <% end %>
+    </ul>
+  </body>
+</html>

data/app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb CHANGED Viewed

@@ -6,16 +6,16 @@
   <body>
     <h1>Vulnerabilities: </h1>
     <% @vulnerabilities.each do |line|  %>
-    <ul>
-    <li> Name: <%= line[:name].to_s.html_safe %></li>
-    <li> Version: <%= line[:version].to_s.html_safe %></li>
-    <li> Advisory: <%= line[:advisory].to_s.html_safe %></li>
-    <li> Criticality:<%= line[:criticality].to_s.html_safe %></li>
-    <li> Url: <%= line[:url].to_s.html_safe %></li>
-    <li> Title: <%= line[:title].to_s.html_safe %></li>
-    <li> Solution: <%= line[:solution].to_s.html_safe %></li>
-    </ul>
-    <p> Click here to ignore this vulnerability: <%= link_to "ignore", ignore_url(line.token) %></p>
+      <ul>
+        <li> Name: <%= line[:name].to_s.html_safe %></li>
+        <li> Version: <%= line[:version].to_s.html_safe %></li>
+        <li> Advisory: <%= line[:advisory].to_s.html_safe %></li>
+        <li> Criticality:<%= line[:criticality].to_s.html_safe %></li>
+        <li> Url: <%= line[:url].to_s.html_safe %></li>
+        <li> Title: <%= line[:title].to_s.html_safe %></li>
+        <li> Solution: <%= line[:solution].to_s.html_safe %></li>
+      </ul>
+      <p> Click here to ignore this vulnerability: <%= link_to "ignore", ignore_url(line[:token]) %></p>
     <% end %>
   </body>
 </html>

data/lib/bundler_audit_notifier.rb CHANGED Viewed

@@ -1,65 +1,94 @@
 # dependencies
 require "active_support"
-require 'rake'
-require "bundler_audit_notifier/engine"
-require "auditer_script"
 module BundlerAuditNotifier
   def self.audit_parse
     r, w = IO.pipe
+    errors = []
     # Spawn executes specified command and return its pid
     # This line will execute code that runs bundler-audit and then write the output into the IO pipe
-    # Spawning a process to read the output of bundler-audit update and check because after the commands finish running exit 1 is called and the output can no longer be read.
-    pid = spawn(RbConfig.ruby, "lib/auditer_script.rb", :out => w, :err => [:child, :out])
-    Process.wait2(pid)
-    w.close
-    # At this point, the results of the bundler-audit check command are written in the IO pipe
-    vulnerabilities = []# load quieries from database
-    while !r.eof?
-      name_line = r.gets
-      if name = name_line[/Name: (?<name>.+)/, :name]
-        version_line = r.gets
-        advisory_line = r.gets
-        criticality_line = r.gets
-        url_line = r.gets
-        title_line = r.gets
-        solution_line = r.gets
-        space = r.gets
-        if version_line && advisory_line && criticality_line && url_line && title_line && solution_line
-          version = version_line[/Version: (?<version>.+)/, :version]
-          advisory = advisory_line[/Advisory: (?<advisory>.+)/, :advisory]
-          criticality = criticality_line[/Criticality: (?<criticality>.+)/, :criticality]
-          url = url_line[/URL: (?<url>.+)/, :url]
-          title = title_line[/Title: (?<title>.+)/, :title]
-          solution = solution_line[/Solution: (?<solution>.+)/, :solution]
+    script_location = "lib/auditer_script.rb"
+    if File.exists?("lib/auditer_script.rb")
+      # use local file lib
+    else
+      gem_file_path = (`bundle show bundler_audit_notifier`).strip
+      gem_location = (File.join(gem_file_path, 'lib', 'auditer_script.rb'))
+      if File.exists?(gem_location)
+        script_location = gem_location
+      else
+        errors << "Error parsing Script file location: Neither #{script_location} nor #{gem_location}"
+      end
+    end
+    if errors.none?
+      pid = spawn(RbConfig.ruby, script_location, :out => w, :err => [:child, :out])
+      Process.wait2(pid)
+      w.close
+      # At this point, the results of the bundler-audit check command are written in the IO pipe
+      vulnerabilities = []# load quieries from database
+      update_line = r.gets
+      # Parsing bundler-audit update results
+      if update_line.starts_with?("Updating ruby-advisory-db ...")
+        while !update_line.start_with?('ruby-advisory-db:') && !r.eof?
+          update_line = r.gets
+        end
+      else
+        errors << "Error parsing DURING UPDATE: #{update_line}"
+      end
+      while !r.eof?
+        # Parsing the bundler-audit results
+        name_line = r.gets
+        if name = name_line[/Name: (?<name>.+)/, :name]
+          version_line = r.gets
+          advisory_line = r.gets
+          criticality_line = r.gets
+          url_line = r.gets
+          title_line = r.gets
+          solution_line = r.gets
+          space = r.gets
+          if version_line && advisory_line && criticality_line && url_line && title_line && solution_line
+            version = version_line[/Version: (?<version>.+)/, :version]
+            advisory = advisory_line[/Advisory: (?<advisory>.+)/, :advisory]
+            criticality = criticality_line[/Criticality: (?<criticality>.+)/, :criticality]
+            url = url_line[/URL: (?<url>.+)/, :url]
+            title = title_line[/Title: (?<title>.+)/, :title]
+            solution = solution_line[/Solution: (?<solution>.+)/, :solution]
-          # check for valid data
-          # check database table for existing event
-          if BundlerAuditIssue.exists?(advisory: advisory)
-            bundler_audit_issue = BundlerAuditIssue.where(advisory: advisory).first
-            #   if event found, touch event
-            bundler_audit_issue.touch
-            #  add event to vulnerabilities array if it was not marked ignored
-            if !bundler_audit_issue.ignore
-              vulnerabilities << bundler_audit_issue
+            # check for valid data
+            # check database table for existing event
+            data = {name: name, version: version, advisory: advisory, criticality: criticality, url: url, title: title, solution: solution}
+            bai = BundlerAuditIssue.find_by_advisory(advisory)
+            if bai
+              #   if event found, touch event
+              bai.touch
+              #   if found event is ignored, remove from vulnerabilites hash
+              if !bai.ignore
+                vulnerabilities << data.merge({token: bai.token})
+              end
+            else
+              if bai = BundlerAuditIssue.create(data)
+                vulnerabilities << data.merge({token: bai.token})
+              else
+                errors << "Error parsing creating new BundlerAuditIssue with the following #{data}"
+              end
             end
-          else
-            bundler_audit_issue = BundlerAuditIssue.create(:name => name, :version => version, :advisory => advisory, :criticality => criticality, :url => url, :title => title, :solution => solution)
-            vulnerabilities << bundler_audit_issue
+          else
+            errors << "ERROR: nil line found #{version_line}, #{advisory_line}, #{criticality_line}, #{url_line}, #{title_line}, #{solution_line}"
           end
+        elsif name_line.strip == "Vulnerabilities found!"
+          # puts "End of output reached!"
         else
-          puts "ERROR: nil line found #{version_line}, #{advisory_line}, #{criticality_line}, #{url_line}, #{title_line}, #{solution_line}"
+          errors << "Error parsing NAME LINE: #{name_line}"
         end
-      elsif name_line.strip == "Vulnerabilities found!"
-        puts "End of output reached!"
       end
     end
     # iterate through remaining vulnerabilties and send them in an email if any are remaining
+    if errors.present?
+      BundlerAuditIssuesMailer.error_in_running(errors).deliver_now
+    end
     if vulnerabilities.present?
       BundlerAuditIssuesMailer.vulnerability_email(vulnerabilities).deliver_now
     end
+    return [vulnerabilities, errors]
   end
-end
+end

metadata CHANGED Viewed

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bundler_audit_notifier
 version: !ruby/object:Gem::Version
-  version: 0.0.8
+  version: 0.1.12
 platform: ruby
 authors:
 - Marley Stipich
@@ -38,20 +38,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: sqlite3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -148,6 +134,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: sqlite3
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description:
 email:
 executables: []
@@ -158,6 +158,7 @@ files:
 - app/mailers/bundler_audit_issues_mailer.rb
 - app/models/bundler_audit_issue.rb
 - app/views/bundler_audit_issues/ignore.html.erb
+- app/views/bundler_audit_issues_mailer/error_in_running.html.erb
 - app/views/bundler_audit_issues_mailer/vulnerability_email.html.erb
 - lib/auditer_script.rb
 - lib/bundler_audit_notifier.rb