chelsea 0.0.18 → 0.0.19

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9caf22546a018a86b5c4c9e697de52e87088b0a2564517a8580957b9127210fa
-  data.tar.gz: ef1f7c1fa82b6fd6e3e39f464f29b90d5f313b479ace42ded33c9206ca7a2479
+  metadata.gz: a44baa47f70b877e0f6b8051962bf0c66eae508bb0fa148d47056b7d5dfdf6bb
+  data.tar.gz: 5565acd13beccaab790612682ae19d50a8b9c4427f83692476ffcbe6ddd5425c
 SHA512:
-  metadata.gz: 4a5fd5e2a8fbd040fb9018412db887d7320edbb60fbc482d9c28e55696124c64caab47ff3b46902ad1bf49c6464b5fafc1482e1243d35ee0616d171d16cc76f1
-  data.tar.gz: ad61c6e0a252fd80edb3db6ca261013119237296497f4a7a42389ffdbfb3503bfac66da4bc6c1deab5fd5e5754f2016d188d98b8831cd9661575f6012aac89ba
+  metadata.gz: 50c1634dae11bd146bbf734706abc60b3c06bb6cab1bb177cbf5e98c528c4d1dd25a0a9fd4d47719b3887dc4aaf9ce7a5f42126d7973b1008eac4c87c99cdd7b
+  data.tar.gz: f8db897e7a16e5f87b8a3f3f0f7a8ae98541d058922c54d4d580fbe36763e128f3b30f9f8cde5f138b410af172208d3948025ee9342858113ab31ea1fe1ac51c

data/.gitignore

@@ -11,3 +11,4 @@
 # rspec failure tracking
 .rspec_status
 .byebug_history
+.ruby-version

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    chelsea (0.0.11)
+    chelsea (0.0.17)
       bundler (>= 1.2.0, < 3)
       ox (~> 2.13.2)
       pastel (~> 0.7.2)
@@ -9,6 +9,7 @@ PATH
       slop (~> 4.8.1)
       tty-font (~> 0.5.0)
       tty-spinner (~> 0.9.3)
+      tty-table (~> 0.11.0)
 
 GEM
   remote: https://rubygems.org/
@@ -27,10 +28,11 @@ GEM
       domain_name (~> 0.5)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2019.1009)
+    mime-types-data (3.2020.0512)
+    necromancer (0.6.0)
     netrc (0.11.0)
     ox (2.13.2)
-    pastel (0.7.3)
+    pastel (0.7.4)
       equatable (~> 0.6)
       tty-color (~> 0.5)
     public_suffix (4.0.3)
@@ -56,14 +58,28 @@ GEM
       rspec-core (>= 2, < 4, != 2.12.0)
     safe_yaml (1.0.5)
     slop (4.8.1)
+    strings (0.1.8)
+      strings-ansi (~> 0.1)
+      unicode-display_width (~> 1.5)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
     tty-color (0.5.1)
     tty-cursor (0.7.1)
     tty-font (0.5.0)
+    tty-screen (0.8.0)
     tty-spinner (0.9.3)
       tty-cursor (~> 0.7)
+    tty-table (0.11.0)
+      equatable (~> 0.6)
+      necromancer (~> 0.5)
+      pastel (~> 0.7.2)
+      strings (~> 0.1.5)
+      tty-screen (~> 0.7)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.7.7)
+    unicode-display_width (1.7.0)
+    unicode_utils (1.4.0)
     webmock (3.8.3)
       addressable (>= 2.3.6)
       crack (>= 0.3.2)

data/Jenkinsfile

@@ -43,5 +43,7 @@ dockerizedBuildPipeline(
   },
   onFailure: {
     githubStatusUpdate('failure')
+    notifyChat(currentBuild: currentBuild, env: env, room: 'community-oss-fun')
+    sendEmailNotification(currentBuild, env, [], 'community-group@sonatype.com')
   }
 )

data/bin/chelsea

@@ -31,7 +31,7 @@ opts =
       o.string '-iu', '--iquser', 'Specify the IQ username', default: 'admin'
       o.string '-it', '--iqpass', 'Specify the IQ auth token', default: 'admin123'
       o.string '-w', '--whitelist', 'Set path to vulnerability whitelist file'
-      o.bool '-q', '--quiet', 'Make chelsea only output vulnerable third party dependencies for text output (default: false)', default: false 
+      o.bool '-v', '--verbose', 'Make chelsea only output vulnerable third party dependencies for text output (default: true)', default: false 
       o.string '-t', '--format', 'Choose what type of format you want your report in (default: text) (options: text, json, xml)', default: 'text'
       o.bool '-b', '--iq', 'Use Nexus IQ Server to audit your project'
       o.on '--version', 'Print the version' do

data/chelsea.gemspec

@@ -31,10 +31,12 @@ Gem::Specification.new do |spec|
   spec.add_dependency "rest-client", "~> 2.0.2"
   spec.add_dependency "bundler", ">= 1.2.0", "< 3"
   spec.add_dependency "ox", "~> 2.13.2"
+  spec.add_dependency "tty-table", "~> 0.11.0"
 
   spec.add_development_dependency "rake", "~> 12.3"
   spec.add_development_dependency "rspec", "~> 3.0"
   spec.add_development_dependency "rspec_junit_formatter", "~> 0.4.1"
   spec.add_development_dependency "webmock", "~> 3.8.3"
   spec.add_development_dependency "byebug", "~> 11.1.2"
+  spec.add_development_dependency 'pry'
 end

data/lib/chelsea/cli.rb

@@ -78,7 +78,7 @@ module Chelsea
     def _process_file
       gems = Chelsea::Gems.new(
         file: @opts[:file],
-        quiet: @opts[:quiet],
+        verbose: @opts[:verbose],
         options: @opts
       )
       gems.execute ? (exit 1) : (exit 0)
@@ -87,7 +87,7 @@ module Chelsea
     def _process_file_iq
       gems = Chelsea::Gems.new(
         file: @opts[:file],
-        quiet: @opts[:quiet],
+        verbose: @opts[:verbose],
         options: @opts
       )
       gems.collect_iq

data/lib/chelsea/deps.rb

@@ -23,8 +23,8 @@ require 'rest-client'
 
 module Chelsea
   class Deps
-    def initialize(path:, quiet: false)
-      @quiet = quiet
+    def initialize(path:, verbose: false)
+      @verbose = verbose
       ENV['BUNDLE_GEMFILE'] = File.expand_path(path).chomp('.lock')
       @lockfile = Bundler::LockfileParser.new(File.read(path))
     end
@@ -57,7 +57,7 @@ module Chelsea
       reverse
         .reverse_dependencies(@lockfile.specs)
         .to_h
-        .transform_values do |reverse_dep|
+        .transform_values! do |reverse_dep|
           reverse_dep.select do |name, _dep, _req, _|
             spec_names.include?(name.split('-')[0])
           end

data/lib/chelsea/formatters/factory.rb

@@ -20,16 +20,16 @@ require_relative 'text'
 
 # Factory for formatting dependencies
 class FormatterFactory
-  def get_formatter(format: 'text', quiet: false)
+  def get_formatter(format: 'text', verbose:)
     case format
     when 'text'
-      Chelsea::TextFormatter.new quiet: quiet
+      Chelsea::TextFormatter.new verbose: verbose
     when 'json'
-      Chelsea::JsonFormatter.new quiet: quiet
+      Chelsea::JsonFormatter.new verbose: verbose
     when 'xml'
-      Chelsea::XMLFormatter.new quiet: quiet
+      Chelsea::XMLFormatter.new verbose: verbose
     else
-      Chelsea::TextFormatter.new quiet: quiet
+      Chelsea::TextFormatter.new verbose: verbose
     end
   end
 end

data/lib/chelsea/formatters/text.rb

@@ -15,49 +15,54 @@
 #
 
 require 'pastel'
+require 'tty-table'
 require_relative 'formatter'
 
 module Chelsea
   class TextFormatter < Formatter
-    def initialize(quiet: false)
-      @quiet = quiet
+    def initialize(options)
+      @options = options
       @pastel = Pastel.new
     end
 
     def get_results(server_response, reverse_dependencies)
-      response = String.new
-      if !@quiet
+      response = ''
+      if @options[:verbose]
         response += "\n"\
         "Audit Results\n"\
         "=============\n"
       end
 
-      i = 0
-      count = server_response.count()
-      server_response.sort! {|x| x['vulnerabilities'].count}
-
-      server_response.each do |r|
-        i += 1
-        package = r['coordinates']
-        vulnerable = r['vulnerabilities'].length.positive?
-        coord = r['coordinates'].sub('pkg:gem/', '')
-        name = coord.split('@')[0]
-        version = coord.split('@')[1]
+      vuln_count = server_response.count do |vuln|
+        vuln['vulnerabilities'].length.positive?
+      end
+      server_response.sort! { |x| x['vulnerabilities'].count }
+      server_response.each.with_index do |r, idx|
+        name, version = r['coordinates'].sub('pkg:gem/', '').split('@')
         reverse_deps = reverse_dependencies["#{name}-#{version}"]
-        if vulnerable
-          response += @pastel.red("[#{i}/#{count}] - #{package} ") + @pastel.red.bold("Vulnerable.\n")
+        if r['vulnerabilities'].length.positive?
+          response += @pastel.red(
+            "[#{idx}/#{server_response.count}] - #{r['coordinates']} "
+          )
+          response += @pastel.red.bold("Vulnerable.\n")
           response += _get_reverse_deps(reverse_deps, name) if reverse_deps
           r['vulnerabilities'].each do |k, _|
             response += _format_vuln(k)
           end
-        else
-          if !@quiet
-            response += @pastel.white("[#{i}/#{count}] - #{package} ") + @pastel.green.bold("No vulnerabilities found!\n")
-            response += _get_reverse_deps(reverse_deps, name) if reverse_deps
-          end
+        elsif @options[:verbose]
+          response += @pastel.white(
+            "[#{idx}/#{server_response.count}] - #{r['coordinates']} "
+          )
+          response += @pastel.green.bold("No vulnerabilities found!\n")
+          response += _get_reverse_deps(reverse_deps, name) if reverse_deps
         end
       end
 
+      table = TTY::Table.new(
+        ['Dependencies Audited', 'Vulnerable Dependencies'],
+        [[server_response.count, vuln_count]]
+      )
+      response += table.render(:unicode)
       response
     end
 
@@ -65,34 +70,44 @@ module Chelsea
       puts results
     end
 
+    private
+
     def _format_vuln(vuln)
-      cvssScore = vuln['cvssScore']
       vuln_response = "\n\tVulnerability Details:\n"
-      vuln_response += _color_based_on_cvss_score(cvssScore, "\n\tID: #{vuln['id']}\n")
-      vuln_response += _color_based_on_cvss_score(cvssScore, "\n\tTitle: #{vuln['title']}\n")
-      vuln_response += _color_based_on_cvss_score(cvssScore, "\n\tDescription: #{vuln['description']}\n")
-      vuln_response += _color_based_on_cvss_score(cvssScore, "\n\tCVSS Score: #{vuln['cvssScore']}\n")
-      vuln_response += _color_based_on_cvss_score(cvssScore, "\n\tCVSS Vector: #{vuln['cvssVector']}\n")
-      vuln_response += _color_based_on_cvss_score(cvssScore, "\n\tCVE: #{vuln['cve']}\n")
-      vuln_response += _color_based_on_cvss_score(cvssScore, "\n\tReference: #{vuln['reference']}\n\n")
+      _color_method = _color_based_on_cvss_score(vuln['cvssScore'])
+      _report_lines(vuln).each do |line|
+        vuln_response += _color_method(line)
+      end
       vuln_response
     end
 
-    def _color_based_on_cvss_score(cvssScore, text)
-      case cvssScore
+    def _report_lines(vuln)
+      [
+        "\n\tID: #{vuln['id']}\n",
+        "\n\tTitle: #{vuln['title']}\n",
+        "\n\tDescription: #{vuln['description']}\n",
+        "\n\tCVSS Score: #{vuln['cvssScore']}\n",
+        "\n\tCVSS Vector: #{vuln['cvssVector']}\n",
+        "\n\tCVE: #{vuln['cve']}\n",
+        "\n\tReference: #{vuln['reference']}\n\n"
+      ]
+    end
+
+    def _color_based_on_cvss_score(cvss_score)
+      case cvss_score
       when 0..3
-        @pastel.cyan.bold(text)    
+        @pastel.cyan.bold
       when 4..5
-        @pastel.yellow.bold(text)
+        @pastel.yellow.bold
       when 6..7
-        @pastel.orange.bold(text)
+        @pastel.orange.bold
       else
-        @pastel.red.bold(text)
+        @pastel.red.bold
       end
     end
 
     def _get_reverse_deps(coords, name)
-      coords.each_with_object(String.new) do |dep, s|
+      coords.each_with_object('') do |dep, s|
         dep.each do |gran|
           if gran.class == String && !gran.include?(name)
             s << "\tRequired by: #{gran}\n"

data/lib/chelsea/formatters/xml.rb

@@ -31,8 +31,8 @@ module Chelsea
       doc << instruct
 
       testsuite = Ox::Element.new('testsuite')
-      testsuite[:name] = "purl"
-      testsuite[:tests] = server_response.count()
+      testsuite[:name] = 'purl'
+      testsuite[:tests] = server_response.count
       doc << testsuite
 
       server_response.each do |coord|
@@ -40,14 +40,15 @@ module Chelsea
         testcase[:classname] = coord["coordinates"]
         testcase[:name] = coord["coordinates"]
 
-        if coord["vulnerabilities"].length() > 0
+        if coord['vulnerabilities'].length.positive?
           failure = Ox::Element.new('failure')
           failure[:type] = "Vulnerable Dependency"
           failure << get_vulnerability_block(coord["vulnerabilities"])
           testcase << failure
+          testsuite << testcase
+        elsif @options[:verbose]
+          testsuite << testcase
         end
-
-        testsuite << testcase
       end
 
       doc

data/lib/chelsea/gems.rb

@@ -31,18 +31,19 @@ module Chelsea
   # Class to collect and audit packages from a Gemfile.lock
   class Gems
     attr_accessor :deps
-    def initialize(file:, quiet: false, options: { 'format': 'text' })
-      @quiet = quiet
+    def initialize(file:, verbose:, options: { 'format': 'text' })
+      @verbose = verbose
       unless File.file?(file) || file.nil?
         raise 'Gemfile.lock not found, check --file path'
       end
 
-      _silence_stderr if @quiet
+      _silence_stderr unless @verbose
 
       @pastel = Pastel.new
       @formatter = FormatterFactory.new.get_formatter(
         format: options[:format],
-        quiet: @quiet)
+        verbose: verbose
+      )
       @client = Chelsea.client(options)
       @deps = Chelsea::Deps.new(path: Pathname.new(file))
       @spinner = Chelsea::Spinner.new
@@ -58,7 +59,7 @@ module Chelsea
         return
       end
       if server_response.nil?
-        _print_err 'No vulnerability data retrieved from server. Exiting.'
+        _print_success 'No vulnerability data retrieved from server. Exiting.'
         return
       end
       results = @formatter.get_results(server_response, reverse_dependencies)
@@ -94,6 +95,7 @@ module Chelsea
       coordinates = @deps.coordinates
       spin.success('...done.')
       spin = @spinner.spin_msg 'Making request to OSS Index server'
+      spin.stop
 
       begin
         server_response = @client.get_vulns(coordinates)
@@ -110,9 +112,6 @@ module Chelsea
       rescue Errno::ECONNREFUSED => e
         spin.stop('...request failed.')
         _print_err 'Error getting data from OSS Index server. Connection refused.'
-      rescue StandardError => e
-        spin.stop('...request failed.')
-        _print_err 'UNKNOWN Error getting data from OSS Index server.'
       end
       [server_response, dependencies, reverse_dependencies]
     end

data/lib/chelsea/oss_index.rb

@@ -42,7 +42,7 @@ module Chelsea
       end
 
       remaining_coordinates['coordinates'].each_slice(128).to_a.each do |coords|
-        res_json = call_oss_index({ 'coordinates' => coords })
+        res_json = JSON.parse(call_oss_index({ 'coordinates' => coords }))
         cached_server_response = cached_server_response.concat(res_json)
         @db.save_values_to_db(res_json)
       end
@@ -52,7 +52,7 @@ module Chelsea
 
     def call_oss_index(coords)
       r = _resource.post coords.to_json, _headers
-      r.code == 200 ? JSON.parse(r.body) : {}
+      r.code == 200 ? r.body : {}
     end
 
     private
@@ -83,7 +83,7 @@ module Chelsea
           password: @oss_index_user_token
         )
       else
-        RestClient::Resource.new _api_url
+        RestClient::Resource.new(_api_url)
       end
     end
 

data/lib/chelsea/version.rb

@@ -15,5 +15,5 @@
 #
 
 module Chelsea
-  VERSION = '0.0.18'.freeze
+  VERSION = '0.0.19'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: chelsea
 version: !ruby/object:Gem::Version
-  version: 0.0.18
+  version: 0.0.19
 platform: ruby
 authors:
 - Allister Beharry
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-01 00:00:00.000000000 Z
+date: 2020-09-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: tty-font
@@ -114,6 +114,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 2.13.2
+- !ruby/object:Gem::Dependency
+  name: tty-table
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.11.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.11.0
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -184,6 +198,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 11.1.2
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: 
 email:
 - allister.beharry@gmail.com