chelsea 0.0.3 → 0.0.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1633315a7f5da46a2c43414058160959b0be5202a3c7a6aa333e99f91f48a755
-  data.tar.gz: ac7a5f1f3c77061ccf54edf458758b621038f74ca9e272261cb0dc417cb94298
+  metadata.gz: e8ddb15d0a891dbfa7ce2c666d01ef1cda63727631496efc44fb71202931c485
+  data.tar.gz: 982bdf90ff3ed1851c6eea78519f7dbab3b40c60c23e5b21949035437bc9680c
 SHA512:
-  metadata.gz: 1b7eea08843bed093b27054b29da075edfc63730836421e8151e0dfd661d06f030bf7be242c8a08e11d5c4aae49434d3976f4b8a628962f44fa8e8b787979eea
-  data.tar.gz: c946fd43b812750e8d3ebe7b4c13914ca54e257c6b86a63d3abb1224bec4d94af027a1e4dcc7cd65940af23091b5e82d10d99e5397c1406e6d4199f2fb2f49b8
+  metadata.gz: 77205e26a996f43726400fa0ab2ac96299829c75546a3b2d8b153df476d9065defbae40007e1095046fa1f917655fe57c0a919e2986ff28d66fb7b0fcbf3b196
+  data.tar.gz: 45499656d17b88a75584c687488af409770dffcdd331bc55292f52cad2aa572e3b9ff757ba880006928b8da386ba8900e65d72d54a3fb03121b745c777b17027

data/Gemfile.lock

@@ -1,30 +1,38 @@
 PATH
   remote: .
   specs:
-    chelsea (0.0.2)
+    chelsea (0.0.3)
       bundler (>= 1.2.0, < 3)
+      ox (~> 2.13.2)
       pastel (~> 0.7.2)
       rest-client (~> 2.0.2)
-      slop (~> 4.8.0)
+      slop (~> 4.8.1)
       tty-font (~> 0.5.0)
       tty-spinner (~> 0.9.3)
 
 GEM
   remote: https://rubygems.org/
   specs:
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    crack (0.4.3)
+      safe_yaml (~> 1.0.0)
     diff-lcs (1.3)
     domain_name (0.5.20190701)
       unf (>= 0.0.5, < 1.0.0)
     equatable (0.6.1)
+    hashdiff (1.0.1)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
     mime-types-data (3.2019.1009)
     netrc (0.11.0)
+    ox (2.13.2)
     pastel (0.7.3)
       equatable (~> 0.6)
       tty-color (~> 0.5)
+    public_suffix (4.0.3)
     rake (10.5.0)
     rest-client (2.0.2)
       http-cookie (>= 1.0.2, < 2.0)
@@ -45,7 +53,8 @@ GEM
     rspec-support (3.9.2)
     rspec_junit_formatter (0.4.1)
       rspec-core (>= 2, < 4, != 2.12.0)
-    slop (4.8.0)
+    safe_yaml (1.0.5)
+    slop (4.8.1)
     tty-color (0.5.1)
     tty-cursor (0.7.1)
     tty-font (0.5.0)
@@ -53,7 +62,11 @@ GEM
       tty-cursor (~> 0.7)
     unf (0.1.4)
       unf_ext
-    unf_ext (0.0.7.6)
+    unf_ext (0.0.7.7)
+    webmock (3.8.3)
+      addressable (>= 2.3.6)
+      crack (>= 0.3.2)
+      hashdiff (>= 0.4.0, < 2.0.0)
 
 PLATFORMS
   ruby
@@ -63,6 +76,7 @@ DEPENDENCIES
   rake (~> 10.0)
   rspec (~> 3.0)
   rspec_junit_formatter (~> 0.4.1)
+  webmock (~> 3.8.3)
 
 BUNDLED WITH
-   2.0.2
+   2.1.2

data/README.md

@@ -30,13 +30,16 @@ $ chelsea
  \____/|_| |_| \___||_||___/ \___| \__,_|
                                          
                                          
-Version: 0.0.1
+Version: 0.0.3
 
 usage: chelsea [options] ...
 
 Options:
-    -f, --file  do the dang thing
-    --version   print the version
+    -h, --help    show usage
+    -q, --quiet   make chelsea only output vulnerable third party dependencies for text output (default: false)
+    -t, --format  choose what type of format you want your report in (default: text) (options: text, json, xml)
+    -f, --file    path to your Gemfile.lock
+    --version     print the version
 ```
 
 Most basic usage is:

data/bin/chelsea

@@ -1,5 +1,29 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 require_relative "../lib/chelsea"
+require 'slop'
+opts =
+  begin
+    Slop.parse do |o|
+      o.string '-f', '--file', 'do the dang thing'
+      o.bool '-q', '--quiet', 'make chelsea only output vulnerable third party dependencies for text output (default: false)', default: false 
+      o.string '-t', '--format', 'choose what type of format you want your report in (default: text) (options: text, json, xml)', default: 'text'
+      o.on '--version', 'print the version' do
+          puts Chelsea::VERSION
+          exit
+      end
+      o.on '-h', '--help', 'show usage' do
+        puts(o)
+        exit
+      end
+    end
+  rescue Slop::Error => e
+    puts(e.message + ' (try --help)')
+    exit 1
+  end
+if opts.arguments.count.positive?
+  puts("extraneous arguments: #{opts.arguments.join(' ')} (try --help)")
+  exit 1
+end
 
-Chelsea::CLI.new.main
+Chelsea::CLI.new(opts).process!

data/chelsea.gemspec

@@ -37,12 +37,14 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "tty-font", "~> 0.5.0"
   spec.add_dependency "tty-spinner", "~> 0.9.3"
-  spec.add_dependency "slop", "~> 4.8.0"
+  spec.add_dependency "slop", "~> 4.8.1"
   spec.add_dependency "pastel", "~> 0.7.2"
   spec.add_dependency "rest-client", "~> 2.0.2"
   spec.add_dependency "bundler", ">= 1.2.0", "< 3"
+  spec.add_dependency "ox", "~> 2.13.2"
 
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "rspec", "~> 3.0"
   spec.add_development_dependency "rspec_junit_formatter", "~> 0.4.1"
+  spec.add_development_dependency "webmock", "~> 3.8.3"
 end

data/lib/chelsea/cli.rb

@@ -1,33 +1,49 @@
 require 'slop'
 require 'pastel'
+require 'tty-font'
+
 require_relative 'version'
+require_relative 'gems'
 
 module Chelsea
+  ##
+  # This class provides an interface to the oss index, gems and deps
   class CLI
-    def main(command_line_options=ARGV)
-      puts show_logo()
-      parser = Slop::Parser.new cli_flags()
-      arguments = parse_arguments(command_line_options, parser)
-      validate_arguments arguments
 
-      if arguments.fetch(:file)
-        gems(arguments[:file])
-      elsif set?(arguments, :help)
-        puts cli_flags
+    def initialize(opts)
+      @opts = opts
+      @pastel = Pastel.new
+      _validate_arguments
+      _show_logo
+    end
+
+    def process!
+      if @opts.file?
+        @gems = Chelsea::Gems.new(file: @opts[:file])
+        @gems.execute
+      elsif @opts.help?
+        puts _cli_flags
+
       end
     end
 
-    def set?(arguments, flag)
-      !arguments.fetch(flag).nil?
+    # this is how you do static methods in ruby, because in a test we want to 
+    # check for version without opts, and heck, we don't even want a dang object!
+    def self.version
+      Chelsea::VERSION
     end
 
-    def cli_flags()
+  protected
+
+    def _cli_flags
       opts = Slop::Options.new
       opts.banner = "usage: chelsea [options] ..."
       opts.separator ""
       opts.separator 'Options:'
-      opts.bool '-h', '--help', 'show usage' 
-      opts.string '-f', '--file', 'do the dang thing'
+      opts.bool '-h', '--help', 'show usage'
+      opts.bool '-q', '--quiet', 'make chelsea only output vulnerable third party dependencies for text output (default: false)', default: false 
+      opts.string '-t', '--format', 'choose what type of format you want your report in (default: text) (options: text, json, xml)', default: 'text'
+      opts.string '-f', '--file', 'path to your Gemfile.lock'
       opts.on '--version', 'print the version' do
         puts version()
         exit
@@ -36,56 +52,36 @@ module Chelsea
       opts
     end
 
-    def validate_arguments(arguments)
-      if number_of_required_flags_set(arguments) < 1 && !arguments.fetch(:file)
-        flags_error
-      end
-    end
-
-    def number_of_required_flags_set(arguments)
-      minimum_flags = flags
-      valid_flags = minimum_flags.collect {|a| arguments.fetch(a) }.compact
-      valid_flags.count
-    end
-
-    def flags
-      [:file, :help]
-    end
-
-    def flags_error
-      switches = flags.collect {|f| "--#{f}"}
-      puts cli_flags
+    def _flags_error
+      # should be custom exception! 
+      switches = _flags.collect {|f| "--#{f}"}
+      puts _cli_flags
       puts
       abort "please set one of #{switches}"
     end
 
-    def gems(file)
-      require_relative 'gems'
-      Chelsea::Gems.new(file, nil).execute
+    def _validate_arguments
+      if !_flags_set? && !@opts.file?
+        ## require at least one argument
+        _flags_error
+      end
     end
 
-    def parse_arguments(command_line_options, parser)
-      begin
-        result = parser.parse command_line_options
-        result.to_hash
-
-      rescue Slop::UnknownOption
-        # print help
-        puts cli_flags()
-        exit
-      end
+    def _flags_set?
+      # I'm still unsure what this is trying to express
+      valid_flags = _flags.collect {|arg| @opts[arg] }.compact
+      valid_flags.count > 1
     end
 
-    def version()
-      Chelsea::VERSION
+    def _flags
+      # Seems wrong, should all be handled by bin
+      [:file, :help]
     end
-  
-    def show_logo()
-      @pastel = Pastel.new
-      require 'tty-font'
+
+    def _show_logo()
       font = TTY::Font.new(:doom)
       puts @pastel.green(font.write("Chelsea"))
-      puts @pastel.green("Version: " + version())
+      puts @pastel.green("Version: " + CLI::version)
     end
   end
 end

data/lib/chelsea/dependency_exception.rb

@@ -0,0 +1,8 @@
+module Chelsea
+  class DependencyException < StandardError
+    def initialize(msg="This is a custom exception", exception_type="custom")
+      @exception_type = exception_type
+      super(msg)
+    end
+  end
+end

data/lib/chelsea/deps.rb

@@ -0,0 +1,171 @@
+require 'bundler'
+require 'bundler/lockfile_parser'
+require 'rubygems'
+require 'rubygems/commands/dependency_command'
+require_relative 'dependency_exception'
+require 'json'
+require 'rest-client'
+require 'pstore'
+
+
+module Chelsea
+  class Deps
+    attr_reader :server_response, :reverse_dependencies, :coordinates
+
+    def initialize(path: , quiet: false)
+      @path, @quiet = path, quiet
+
+      begin
+        @lockfile = Bundler::LockfileParser.new(
+          File.read(@path)
+        )
+      rescue
+        raise "Gemfile.lock not parseable, please check file or that it's path is valid"
+      end
+
+      @dependencies = {}
+      @reverse_dependencies = {}
+      @dependencies_versions = {}
+      @coordinates = { 'coordinates' => [] }
+      @server_response = []
+      @store = PStore.new(_get_db_store_location())
+    end
+  
+    def to_h(reverse: false)
+      if reverse
+        @reverse_dependencies
+      else
+        @dependencies
+      end
+    end
+
+    def nil?
+      @dependencies.empty?
+    end
+
+    def self.to_purl(name, version)
+      return "pkg:gem/#{name}@#{version}"
+    end
+
+    def user_agent
+      "chelsea/#{Chelsea::VERSION}"
+    end
+
+    def get_dependencies
+      @lockfile.specs.each do |gem|\
+        begin
+          @dependencies[gem.name] = [gem.name, gem.version]
+        rescue StandardError => e
+          raise Chelsea::DependencyException e, "Parsing dependency line #{gem} failed."
+        end
+      end
+    end
+
+    def get_reverse_dependencies
+      begin
+        reverse = Gem::Commands::DependencyCommand.new
+        reverse.options[:reverse_dependencies] = true
+        @reverse_dependencies = reverse.reverse_dependencies(@lockfile.specs).to_h
+      rescue => e
+        raise Chelsea::DependencyException e, "ReverseDependencyException"
+      end
+    end
+
+    def get_dependencies_versions_as_coordinates
+      @dependencies.each do |p, r|
+        o =  r[0]
+        v = r[1].to_s
+        if v.split('.').length == 1 then
+          v = v + ".0.0"
+        elsif v.split('.').length == 2 then
+            v = v + ".0"
+        end
+        @dependencies_versions[p] = v
+      end
+
+      @dependencies_versions.each do |p, v|
+        @coordinates["coordinates"] << self.class.to_purl(p,v);
+      end
+    end
+
+    # Makes multiple REST calls
+    def get_vulns()
+      _check_db_for_cached_values()
+
+      if @coordinates["coordinates"].count() > 0
+        chunked = Hash.new()
+        @coordinates["coordinates"].each_slice(128).to_a.each do |coords|
+          # Won't this return the first successful slice?
+          chunked["coordinates"] = coords
+          r = RestClient.post "https://ossindex.sonatype.org/api/v3/component-report", chunked.to_json,
+            { content_type: :json, accept: :json, 'User-Agent': user_agent }
+          if r.code == 200
+            @server_response = @server_response.concat(JSON.parse(r.body))
+            _save_values_to_db(JSON.parse(r.body))
+            @server_response.count()
+          else
+            0
+          end
+        end
+      else
+        #IDGI
+        @server_response.count()
+      end
+    end
+
+    protected
+    # This method will take an array of values, and save them to a pstore database
+    # and as well set a TTL of Time.now to be checked later
+    def _save_values_to_db(values)
+      values.each do |val|
+        if _get_cached_value_from_db(val["coordinates"]).nil?
+          new_val = val.dup
+          new_val["ttl"] = Time.now
+          @store.transaction do
+            @store[new_val["coordinates"]] = new_val
+          end
+        end
+      end
+    end
+
+    def _get_db_store_location()
+      initial_path = File.join("#{Dir.home}", ".ossindex")
+      Dir.mkdir(initial_path) unless File.exists? initial_path
+      path = File.join(initial_path, "chelsea.pstore")
+    end
+
+    # Checks pstore to see if a coordinate exists, and if it does also
+    # checks to see if it's ttl has expired. Returns nil unless a record
+    # is valid in the cache (ttl has not expired) and found
+    def _get_cached_value_from_db(coordinate)
+      record = @store.transaction { @store[coordinate] }
+      if !record.nil?
+        diff = (Time.now - record['ttl']) / 3600
+        if diff > 12
+          return nil
+        else
+          return record
+        end
+      else
+        return nil
+      end
+    end
+
+    # Goes through the list of @coordinates and checks pstore for them, if it finds a valid coord
+    # it will add it to the server response. If it does not, it will append the coord to a new hash
+    # and eventually set @coordinates to the new hash, so we query OSS Index on only coords not in cache
+    def _check_db_for_cached_values()
+      new_coords = Hash.new
+      new_coords["coordinates"] = Array.new
+      @coordinates["coordinates"].each do |coord|
+        record = _get_cached_value_from_db(coord)
+        if !record.nil?
+          @server_response << record
+        else
+          new_coords["coordinates"].push(coord)
+        end
+      end
+      @coordinates = new_coords
+    end
+  end
+end

data/lib/chelsea/formatters/factory.rb

@@ -0,0 +1,16 @@
+require_relative 'json'
+require_relative 'xml'
+require_relative 'text'
+
+class FormatterFactory
+    def get_formatter(format: 'text', options: {})
+        case format
+        when 'text'
+          Chelsea::TextFormatter.new(options)
+        when 'json'
+          Chelsea::JsonFormatter.new(options)
+        when 'xml'
+          Chelsea::XMLFormatter.new(options)
+        end
+  end
+end

data/lib/chelsea/formatters/formatter.rb

@@ -0,0 +1,12 @@
+class Formatter
+    def initialize
+        @pastel = Pastel.new
+    end
+    def get_results
+        raise 'must implement get_results method in subclass'
+    end
+    
+    def do_print
+        raise 'must implement do_print method in subclass'
+    end
+end

data/lib/chelsea/formatters/json.rb

@@ -0,0 +1,18 @@
+require 'json'
+require_relative 'formatter'
+
+module Chelsea
+  class JsonFormatter < Formatter
+    def initialize(options)
+      @options = options
+    end
+
+    def get_results(server_response, reverse_deps)
+      server_response.to_json
+    end
+
+    def do_print(result)
+      puts result
+    end
+  end
+end

data/lib/chelsea/formatters/text.rb

@@ -0,0 +1,63 @@
+require 'pastel'
+require_relative 'formatter'
+
+module Chelsea
+  class TextFormatter < Formatter
+    def initialize(quiet: false)
+      @quiet = quiet
+      @pastel = Pastel.new
+    end
+
+    def get_results(dependencies)
+      response = String.new
+      if !@quiet
+        response += "\n"\
+        "Audit Results\n"\
+        "=============\n"
+      end
+
+      i = 0
+      count = dependencies.server_response.count()
+      dependencies.server_response.each do |r|
+        i += 1
+        package = r["coordinates"]
+        vulnerable = r["vulnerabilities"].length() > 0
+        coord = r["coordinates"].sub("pkg:gem/", "")
+        name = coord.split('@')[0]
+        version = coord.split('@')[1]
+        reverse_deps = dependencies.reverse_dependencies["#{name}-#{version}"]
+        if vulnerable
+          response += @pastel.red("[#{i}/#{count}] - #{package} ") +  @pastel.red.bold("Vulnerable.\n")
+          response += _get_reverse_deps(reverse_deps, name)
+          r["vulnerabilities"].each do |k, v|
+            response += @pastel.red.bold("    #{k}:#{v}\n")
+          end
+        else
+          if !@quiet
+            response += @pastel.white("[#{i}/#{count}] - #{package} ") + @pastel.green.bold("No vulnerabilities found!\n")
+            response += _get_reverse_deps(reverse_deps, name)
+          end
+        end
+      end
+
+      response
+    end
+
+    def do_print(results)
+      puts results
+    end
+
+    # Right now this looks at all Ruby deps, so it might find some in your Library, but that don't belong to your project
+    def _get_reverse_deps(coord, name)
+      response = String.new
+      coord.each do |dep|
+        dep.each do |gran|
+          if gran.class == String && !gran.include?(name)
+            response += "\tRequired by: #{gran}\n"
+          end
+        end
+      end
+      response
+    end
+  end
+end

data/lib/chelsea/formatters/xml.rb

@@ -0,0 +1,60 @@
+require 'ox'
+require_relative 'formatter'
+module Chelsea
+  class XMLFormatter < Formatter
+    def initialize(options)
+      @options = options
+    end
+
+    def get_results(server_response, reverse_deps)
+      doc = Ox::Document.new
+      instruct = Ox::Instruct.new(:xml)
+      instruct[:version] = '1.0'
+      instruct[:encoding] = 'UTF-8'
+      instruct[:standalone] = 'yes'
+      doc << instruct
+
+      testsuite = Ox::Element.new('testsuite')
+      testsuite[:name] = "purl"
+      testsuite[:tests] = server_response.count()
+      doc << testsuite
+
+      server_response.each do |coord|
+        testcase = Ox::Element.new('testcase')
+        testcase[:classname] = coord["coordinates"]
+        testcase[:name] = coord["coordinates"]
+
+        if coord["vulnerabilities"].length() > 0
+          failure = Ox::Element.new('failure')
+          failure[:type] = "Vulnerable Dependency"
+          failure << get_vulnerability_block(coord["vulnerabilities"])
+          testcase << failure
+        end
+
+        testsuite << testcase
+      end
+
+      doc
+    end
+
+    def do_print(results)
+      puts Ox.dump(results)
+    end
+
+    def get_vulnerability_block(vulnerabilities)
+      vulnBlock = String.new
+      vulnerabilities.each do |vuln|
+        vulnBlock += "Vulnerability Title: #{vuln["title"]}\n"\
+                    "ID: #{vuln["id"]}\n"\
+                    "Description: #{vuln["description"]}\n"\
+                    "CVSS Score: #{vuln["cvssScore"]}\n"\
+                    "CVSS Vector: #{vuln["cvssVector"]}\n"\
+                    "CVE: #{vuln["cve"]}\n"\
+                    "Reference: #{vuln["reference"]}"\
+                    "\n"
+      end
+      
+      vulnBlock
+    end
+  end
+end

data/lib/chelsea/gems.rb

@@ -4,273 +4,115 @@ require 'pastel'
 require 'tty-spinner'
 require 'bundler'
 require 'bundler/lockfile_parser'
-require_relative 'version'
 require 'rubygems'
 require 'rubygems/commands/dependency_command'
-require 'pstore'
+require_relative 'version'
+require_relative 'formatters/factory'
+require_relative 'deps'
+
 
 module Chelsea
   class Gems
-    def initialize(file, options)
-      @file = file
-      @options = options
-      @pastel = Pastel.new
-      @dependencies = Hash.new()
-      @dependencies_versions = Hash.new()
-      @coordinates = Hash.new()
-      @coordinates["coordinates"] = Array.new()
-      @server_response = Array.new()
-      @reverse_deps = Hash.new()
-      @store = PStore.new(get_db_store_location())
+    def initialize(file:, quiet: false, options: {})
+      @file, @quiet, @options = file, quiet, options
 
-      if not gemfile_lock_file_exists()
-        return
+      if not _gemfile_lock_file_exists? or file.nil?
+        raise "Gemfile.lock not found, check --file path"
       end
-
-      path = Pathname.new(@file)
-      @lockfile = Bundler::LockfileParser.new(
-        File.read(path)
-      )
-    end
-
-    def get_db_store_location()
-      initial_path = File.join("#{Dir.home}", ".ossindex")
-      Dir.mkdir(initial_path) unless File.exists? initial_path
-      path = File.join(initial_path, "chelsea.pstore")
+      @pastel = Pastel.new
+      @formatter = FormatterFactory.new.get_formatter(@options)
+      @deps = Chelsea::Deps.new({path: Pathname.new(@file)})
     end
 
-    def execute(input: $stdin, output: $stdout)      
-      n = get_dependencies()
-      if n == 0
-        print_err "No dependencies retrieved. Exiting."
+    def execute(input: $stdin, output: $stdout) 
+      audit
+      if @deps.nil?
+        _print_err "No dependencies retrieved. Exiting."
         return
       end
-      get_dependencies_versions()
-      get_coordinates()
-      n = get_vulns()
-      if n == 0
-        print_err "No vulnerability data retrieved from server. Exiting."
+      if !@deps.server_response.count
+        _print_err "No vulnerability data retrieved from server. Exiting."
         return
       end
-      print_results()
+      @formatter.do_print(@formatter.get_results(@deps))
     end
 
-    def gemfile_lock_file_exists()
-      if not ::File.file? @file
-        return false
-      else
-        path = Pathname.new(@file)
-        return true
+    def audit
+      unless @quiet
+        spinner = _spin_msg "Parsing dependencies"
       end
-    end
-
-    def get_dependencies()
-      format = "[#{@pastel.green(':spinner')}] " + @pastel.white("Parsing dependencies")
-      spinner = TTY::Spinner.new(format, success_mark: @pastel.green('+'), hide_cursor: true)
-      spinner.auto_spin()
-
-      reverse = Gem::Commands::DependencyCommand.new
-      reverse.options[:reverse_dependencies] = true
-      @reverse_deps = reverse.reverse_dependencies(@lockfile.specs)
 
-      @lockfile.specs.each do |gem|
-        @dependencies[gem.name] = [gem.name, gem.version]
-        rescue StandardError => e
-          spinner.stop("...failed.")
-          print_err "Parsing dependency line #{gem} failed."
-      end
-
-      c = @dependencies.count()
-      spinner.success("...done. Parsed #{c} dependencies.")
-      c
-    end
-
-    def get_dependencies_versions()
-      format = "[#{@pastel.green(':spinner')}] " + @pastel.white("Parsing versions")
-      spinner = TTY::Spinner.new(format, success_mark: @pastel.green('+'), hide_cursor: true)
-      spinner.auto_spin()
-      @dependencies.each do |p, r|
-        o =  r[0]
-        v = r[1].to_s
-        if v.split('.').length == 1 then
-          v = v + ".0.0"
-        elsif v.split('.').length == 2 then
-            v = v + ".0"
+      begin
+        @deps.get_dependencies
+      rescue StandardError => e
+        unless @quiet
+          spinner.stop
         end
-        @dependencies_versions[p] = v
+        _print_err "Parsing dependency line #{gem} failed."
       end
-      c = @dependencies_versions.count()
-      spinner.success("...done.")
-      c
-    end
-
-    def get_coordinates()
-      @dependencies_versions.each do |p, v|
-        @coordinates["coordinates"] <<  "pkg:gem/#{p}@#{v}";
-      end
-    end
-
-    def get_vulns()
-      require 'json'
-      require 'rest-client'
-      format = "[#{@pastel.green(':spinner')}] " + @pastel.white("Making request to OSS Index server")
-      spinner = TTY::Spinner.new(format, success_mark: @pastel.green('+'), hide_cursor: true)
-      spinner.auto_spin()
 
-      check_db_for_cached_values()
+      @deps.get_reverse_dependencies
 
-      if @coordinates["coordinates"].count() > 0
-        chunked = Hash.new()
-        @coordinates["coordinates"].each_slice(128).to_a.each do |coords|
-          chunked["coordinates"] = coords
-          r = RestClient.post "https://ossindex.sonatype.org/api/v3/component-report", chunked.to_json, 
-          {content_type: :json, accept: :json, 'User-Agent': get_user_agent()}
-        
-          if r.code == 200
-            @server_response = @server_response.concat(JSON.parse(r.body))
-            save_values_to_db(JSON.parse(r.body))
-            spinner.success("...done.")
-            @server_response.count()
-          else
-            spinner.stop("...request failed.")
-            print_err "Error getting data from OSS Index server. Server returned non-success code #{r.code}."
-            0
-          end
-        end
-      else
+      unless @quiet
+        spinner = _spin_msg "Parsing Versions"
+      end
+      @deps.get_dependencies_versions_as_coordinates
+      unless @quiet
         spinner.success("...done.")
-        @server_response.count()
       end
-    rescue SocketError => e
-      spinner.stop("...request failed.")
-      print_err "Socket error getting data from OSS Index server."
-      0      
-    rescue RestClient::RequestFailed => e
-      spinner.stop("Request failed.")
-      print_err "Error getting data from OSS Index server:#{e.response}."
-      0
-    rescue RestClient::ResourceNotfound => e
-      spinner.stop("...request failed.")
-      print_err "Error getting data from OSS Index server. Resource not found."
-      0
-    rescue Errno::ECONNREFUSED => e
-      spinner.stop("...request failed.")
-      print_err "Error getting data from OSS Index server. Connection refused."
-      0
-    rescue StandardError => e
-      spinner.stop("...request failed.")
-      print_err "UNKNOWN Error getting data from OSS Index server."
-      0
-    end
 
-    def print_results()
-      puts ""
-      puts "Audit Results"
-      puts "============="
-      i = 0
-      count = @server_response.count()
-      @server_response.each do |r|
-        i += 1
-        package = r["coordinates"]
-        vulnerable = r["vulnerabilities"].length() > 0
-        coord = r["coordinates"].sub("pkg:gem/", "")
-        name = coord.split('@')[0]
-        version = coord.split('@')[1]
-        reverse_dep_coord = "#{name}-#{version}"
-        if vulnerable
-          puts @pastel.red("[#{i}/#{count}] - #{package} ") +  @pastel.red.bold("Vulnerable.")
-          print_reverse_deps(@reverse_deps[reverse_dep_coord], name, version)
-          r["vulnerabilities"].each do |k, v|
-            puts @pastel.red.bold("    #{k}:#{v}")
-          end
-        else
-          puts(@pastel.white("[#{i}/#{count}] - #{package} ") + @pastel.green.bold("No vulnerabilities found!"))
-          print_reverse_deps(@reverse_deps[reverse_dep_coord], name, version)
-        end
+      unless @quiet
+        spinner = _spin_msg "Making request to OSS Index server"
       end
-    end
 
-    def print_reverse_deps(reverse_deps, name, version)
-      reverse_deps.each do |dep|
-        dep.each do |gran|
-          if gran.class == String && !gran.include?(name)
-            # There is likely a fun and clever way to check @server-results, etc... and see if a dep is in there
-            # Right now this looks at all Ruby deps, so it might find some in your Library, but that don't belong to your project
-            puts "\tRequired by: " + gran
-          else
-          end
+      begin
+        @deps.get_vulns
+      rescue SocketError => e
+        unless @quiet
+          spinner.stop("...request failed.")
+        end
+        _print_err "Socket error getting data from OSS Index server."
+      rescue RestClient::RequestFailed => e
+        unless @quiet
+          spinner.stop("...request failed.")
+        end
+        _print_err "Error getting data from OSS Index server:#{e.response}."
+      rescue RestClient::ResourceNotfound => e
+        unless @quiet
+          spinner.stop("...request failed.")
         end
+        _print_err "Error getting data from OSS Index server. Resource not found."
+      rescue Errno::ECONNREFUSED => e
+        unless @quiet
+          spinner.stop("...request failed.")
+        end
+        _print_err "Error getting data from OSS Index server. Connection refused."
+      rescue StandardError => e
+        unless @quiet
+          spinner.stop("...request failed.")
+        end
+        _print_err "UNKNOWN Error getting data from OSS Index server."
       end
     end
 
-    def to_purl(name, version)
-      purl = "pkg:gem/#{name}@#{version}"
-
-      purl
+    protected
+    def _spin_msg(msg)
+      format = "[#{@pastel.green(':spinner')}] " + @pastel.white(msg)
+      spinner = TTY::Spinner.new(format, success_mark: @pastel.green('+'), hide_cursor: true)
+      spinner.auto_spin()
+      spinner
     end
 
-    def print_err(s)
+    def _print_err(s)
       puts @pastel.red.bold(s)
     end
 
-    def print_success(s)
+    def _print_success(s)
       puts @pastel.green.bold(s)
     end
 
-    private
-
-    def get_user_agent()
-      user_agent = "chelsea/#{Chelsea::VERSION}"
-
-      user_agent
-    end
-
-    # This method will take an array of values, and save them to a pstore database
-    # and as well set a TTL of Time.now to be checked later
-    def save_values_to_db(values)
-      values.each do |val|
-        if get_cached_value_from_db(val["coordinates"]).nil?
-          new_val = val.dup
-          new_val["ttl"] = Time.now
-          @store.transaction do 
-            @store[new_val["coordinates"]] = new_val
-          end 
-        end
-      end
-    end
-
-    # Checks pstore to see if a coordinate exists, and if it does also
-    # checks to see if it's ttl has expired. Returns nil unless a record
-    # is valid in the cache (ttl has not expired) and found
-    def get_cached_value_from_db(coordinate)
-      record = @store.transaction { @store[coordinate] }
-      if !record.nil?
-        diff = (Time.now - record['ttl']) / 3600
-        if diff > 12
-          return nil
-        else
-          return record
-        end
-      else
-        return nil
-      end
-    end
-
-    # Goes through the list of @coordinates and checks pstore for them, if it finds a valid coord
-    # it will add it to the server response. If it does not, it will append the coord to a new hash
-    # and eventually set @coordinates to the new hash, so we query OSS Index on only coords not in cache
-    def check_db_for_cached_values()
-      new_coords = Hash.new
-      new_coords["coordinates"] = Array.new
-      @coordinates["coordinates"].each do |coord|
-        record = get_cached_value_from_db(coord)
-        if !record.nil?
-          @server_response << record
-        else
-          new_coords["coordinates"].push(coord)
-        end
-      end
-      @coordinates = new_coords
+    def _gemfile_lock_file_exists?
+      ::File.file? @file
     end
   end
-end
+end

data/lib/chelsea/version.rb

@@ -1,3 +1,3 @@
 module Chelsea
-  VERSION = "0.0.3"
+  VERSION = "0.0.4"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chelsea
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
 platform: ruby
 authors:
 - Allister Beharry
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-23 00:00:00.000000000 Z
+date: 2020-04-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tty-font
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.8.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.8.1
 - !ruby/object:Gem::Dependency
   name: pastel
   requirement: !ruby/object:Gem::Requirement
@@ -100,6 +100,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '3'
+- !ruby/object:Gem::Dependency
+  name: ox
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.13.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.13.2
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -142,6 +156,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.4.1
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.8.3
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.8.3
 description: 
 email:
 - allister.beharry@gmail.com
@@ -171,6 +199,13 @@ files:
 - chelsea.gemspec
 - lib/chelsea.rb
 - lib/chelsea/cli.rb
+- lib/chelsea/dependency_exception.rb
+- lib/chelsea/deps.rb
+- lib/chelsea/formatters/factory.rb
+- lib/chelsea/formatters/formatter.rb
+- lib/chelsea/formatters/json.rb
+- lib/chelsea/formatters/text.rb
+- lib/chelsea/formatters/xml.rb
 - lib/chelsea/gems.rb
 - lib/chelsea/version.rb
 homepage: https://github.com/sonatype-nexus-community/chelsea