dawnscanner 1.2.99

data/lib/codesake/dawn/kb/owasp_ror_cheatsheet/session_stored_in_database.rb

@@ -0,0 +1,33 @@
+module Codesake
+  module Dawn
+    module Kb
+      module OwaspRorCheatSheet
+
+        class SessionStoredInDatabase
+          include PatternMatchCheck
+
+          def initialize
+            message = "By default, Ruby on Rails uses a Cookie based session store. What that means is that unless you change something, the session will not expire on the server. That means that some default applications may be vulnerable to replay attacks. It also means that sensitive information should never be put in the session."
+
+            super({
+              :name=>"Owasp Ror CheatSheet: Session management",
+              :kind=>Codesake::Dawn::KnowledgeBase::PATTERN_MATCH_CHECK,
+              :applies=>["rails"],
+              :glob=>"session_store.rb",
+              :aux_links=>["https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet"],
+              :message=>message,
+              :attack_pattern => ["Application.config.session_store :active_record_store"],
+              :negative_search=>true,
+              :avoid_comments=>true,
+              :check_family=>:owasp_ror_cheatsheet,
+              :severity=>:info,
+              :evidences=>["In your session_store.rb file you are not using ActiveRercord to store session data. This will let rails to use a cookie based session and it can expose your web application to a session replay attack."],
+              :mitigation=>"Use ActiveRecord or the ORM you love most to handle your code session_store. Add \"Application.config.session_store :active_record_store\" to your session_store.rb file."
+            })
+            # @debug = true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/codesake/dawn/kb/pattern_match_check.rb

@@ -0,0 +1,129 @@
+require 'ptools'
+
+module Codesake
+  module Dawn
+    module Kb
+      module PatternMatchCheck
+        include BasicCheck
+
+
+        attr_reader   :attack_pattern
+        attr_accessor :root_dir
+
+        # This attribute is false by default. If true, the vuln? method check
+        # if pattern attack is nor present.
+        attr_reader   :negative_search
+
+        # This attribute is false by default. If true, it tells pattern
+        # matching check to ignore strings starting with the ruby single line
+        # comment separator, '#'.
+        attr_reader   :avoid_comments
+        
+        # This attribute is false by default. If true, it tells pattern
+        # matching check that the attack pattern is already a regular
+        # expression.
+        attr_reader   :attack_pattern_is_regex
+
+        EXCLUSION_LIST = [
+          "tags",
+          "vendor/bundle", 
+          "features",
+          "specs",
+          "test"
+        ]
+
+        def initialize(options={})
+          super(options)
+          @negative_search          = false
+          @avoid_comments           = false
+          @attack_pattern_is_regex  = false
+          @glob                     = "**"
+          @attack_pattern           = options[:attack_pattern] unless options[:attack_pattern].nil?
+          @negative_search          = options[:negative_search] unless options[:negative_search].nil? 
+          @avoid_comments           = options[:avoid_comments] unless options[:avoid_comments].nil? 
+          @evidences                = options[:evidences] unless options[:evidences].nil? 
+          @attack_pattern_is_regex  = options[:attack_pattern_is_regex] unless options[:attack_pattern_is_regex].nil? 
+          @glob                     = File.join(@glob, options[:glob]) unless options[:glob].nil?
+          debug_me("EVIDENCES ARE #{@evidences.inspect}")
+        end
+
+        def must_exclude?(filename)
+          EXCLUSION_LIST.each do |ex|
+            debug_me "skipping #{filename}" if filename.start_with?(ex)
+            return true if filename.start_with?(ex)
+          end
+          return false
+        end
+
+        def vuln?
+          found = false
+          matches = nil
+          Dir.glob(File.join("#{root_dir}", @glob)).each do |filename|
+            debug_me("#{File.basename(__FILE__)}@#{__LINE__}: analyzing #{filename}: search is #{@negative_search}")
+            matches = []
+            begin
+              matches = run(load_file(filename)) if File.exists?(filename) && File.file?(filename) && ! File.binary?(filename) && ! must_exclude?(filename)
+              found = ! matches.empty?
+            rescue ArgumentError => e
+              puts "Skipping pattern match check for #{filename}: #{e.message}"
+            end
+            @evidences << {:filename=>filename, :matches=>matches} unless found
+          end
+         
+          debug_me("FOUND IS: #{found}")
+          debug_me("EVIDENCES ARE: #{@evidences.inspect}")
+          debug_me("MATCHES: #{matches}")
+
+          ret_value = found unless @negative_search
+          ret_value = ! found if @negative_search
+
+          debug_me("#{File.basename(__FILE__)}@#{__LINE__}: evidences #=> #{@evidences}")
+          debug_me("#{File.basename(__FILE__)}@#{__LINE__}: ret_value #=> #{ret_value}")
+
+          @status = ret_value
+
+          return ret_value
+        end
+
+        private 
+        def string_to_array(par)
+          return par if par.class == Array
+          %w(par)  
+        end
+
+        def load_file(filename)
+
+          f = File.open(filename)
+          lines = f.readlines
+          f.close 
+
+          lines
+        end
+
+        def run(lines)
+          hits = []
+
+          patterns = string_to_array(@attack_pattern)
+          
+          patterns.each do |pat|
+
+            regex=/#{pat}/
+
+            debug_me "regex is #{regex}"
+            debug_me "@avoid_comments is #{@avoid_comments}"
+
+            lines.each_with_index do |line,i|
+              debug_me("LINE IS: #{line}")
+              line = "" if line.strip.start_with?('#') && @avoid_comments
+              hits << {:match=>line, :line=>i} unless (regex =~ line).nil?
+            end
+          end
+
+          debug_me("HITS IS: #{hits}")
+          hits
+        end
+
+      end
+    end
+  end
+end

data/lib/codesake/dawn/kb/ruby_version_check.rb

@@ -0,0 +1,91 @@
+module Codesake
+  module Dawn
+    module Kb
+      module RubyVersionCheck
+        include BasicCheck
+        # Array of hashes in the {:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p342"} form
+        attr_accessor   :safe_rubies
+        # Hash in the {:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p342"} form
+        attr_accessor   :detected_ruby
+
+        def vuln?
+          vv_a = []
+          vv_p = []
+          vv_e = []
+          vp = false
+          ve = false
+
+
+          @safe_rubies.each do |ss|
+            vv_e << ss[:engine]
+            vv_a << ss[:version]
+            vv_p << ss[:patchlevel].split("p")[1].to_i
+          end
+
+          version_check = Codesake::Dawn::Kb::VersionCheck.new(:safe=>vv_a,:detected=>detected_ruby[:version], :debug=>@debug, :save_major=>true)
+
+          vengine = self.is_vulnerable_engine?(detected_ruby[:engine], vv_e)
+          vv = version_check.vuln?
+
+          ve = self.is_same_version?(detected_ruby[:version], vv_a)
+          vp = is_vulnerable_patchlevel?(detected_ruby[:version], detected_ruby[:patchlevel])
+
+          debug_me("#{__FILE__}@#{__LINE__}: check: #{self.name}, engine is vulnerable?=#{vengine}, version is vulnerable?=#{vv}, is same version?=#{ve}, is_vulnerable_patchlevel?=#{vp}->#{vv && vengine}, #{(ve && vp && vengine )}")
+          debug_me("#{__FILE__}@#{__LINE__}: safe ruby is: #{@safe_rubies}")
+          debug_me("#{__FILE__}@#{__LINE__}: detected ruby is: #{@detected_ruby}")
+
+
+
+          if ( vv && vengine)
+            @status = vp if ve
+            @status = true unless ve
+          else
+            @status = (ve && vp && vengine )
+          end
+
+          debug_me("STATUS:#{@status}")
+          self.evidences << "#{@detected_ruby[:engine]} v#{@detected_ruby[:version]}-#{@detected_ruby[:patchlevel]} detected" if @status
+          return @status
+
+          # return true if ( vv && vengine )
+          # return (ve && vp && vengine )
+        end
+        def is_vulnerable_engine?(target, fixes = [])
+          fixes.each do |f|
+            return true if f == target
+          end
+          false
+        end
+
+        def is_same_version?(target, fixes = [])
+          fixes.each do |f|
+            debug_me("F=#{f}, TARGET=#{target}")
+            return true if f == target
+          end
+          false
+        end
+
+        def is_vulnerable_patchlevel?(version, patchlevel)
+          fixes = []
+          debug_me "is_vulnerable_patchlevel? called with VERSION=#{version} and PLEVEL=#{patchlevel}"
+          @safe_rubies.each do |ss|
+            fixes << ss[:patchlevel].split("p")[1].to_i if ss[:version] == version
+          end
+
+          debug_me "FIXES IS EMPTY" if fixes.empty?
+          debug_me "FIXES LIST IS #{fixes}" unless fixes.empty?
+          return true if fixes.empty?
+
+          t = patchlevel.split("p")[1].to_i if patchlevel.include? 'p'
+          t = patchlevel.to_i unless patchlevel.include? 'p'
+          fixes.each do |f|
+            debug_me "PATCHLEVEL FIXES = #{f}, PATCHLEVEL TARGET = #{t}"
+            return true if f > t
+          end
+          false
+        end
+      end
+    end
+  end
+end
+

data/lib/codesake/dawn/kb/simpleform_xss_20131129.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-12-11
+			class SimpleForm_Xss_20131129
+				include DependencyCheck
+
+				def initialize
+          message = "There is a XSS vulnerability on Simple Form's label, hint and error options. When Simple Form creates a label, hint or error message it marks the text as being HTML safe, even though it may contain HTML tags. In applications where the text of these helpers can be provided by the users, malicious values can be provided and Simple Form will mark it as safe."
+
+          super({
+            :name=>"Simple Form XSS - 20131129",
+            :cvss=>"none",
+            :release_date => Date.new(2013, 11, 29),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "padrino", "sinatra"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade Simple Form the 3.0.1 and 2.1.1 releases are available at the normal locations.",
+            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/flHbLMb07tE"]
+          })
+
+          self.safe_dependencies = [{:name=>"simple_form", :version=>['3.0.1', '2.1.1']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/version_check.rb

@@ -0,0 +1,418 @@
+module Codesake
+  module Dawn
+    module Kb
+      class VersionCheck
+        include BasicCheck
+
+        attr_accessor :safe
+        attr_accessor :deprecated
+        attr_accessor :excluded
+        attr_accessor :detected
+        attr_accessor :save_minor
+        attr_accessor :save_major
+        attr_reader   :status
+        attr_accessor :enable_warning
+
+
+        def initialize(options={})
+          super(options)
+          @safe       ||= options[:safe]
+          @deprecated ||= options[:deprecated]
+          @excluded   ||= options[:excluded]
+          @detected   ||= options[:detected]
+          @save_minor ||= options[:save_minor]
+          @save_major ||= options[:save_major]
+          @debug      ||= options[:debug]
+          @enable_warning ||= options[:enable_warning]
+          debug_me "VersionCheck initialized"
+        end
+
+        def vuln?
+          debug_me "Detected version is #{@detected}"
+          debug_me "Safe versions array is #{@safe}"
+          debug_me "Deprecated versions array is #{@deprecated}. I'll mark them as vulnerable" unless @deprecated.nil?
+          debug_me "Excluded versions array is #{@excluded}. I'll mark them as not vulnerable" unless @excluded.nil?
+
+          @status = :deprecated if is_detected_deprecated?
+          return debug_me_and_return_false("detected version #{detected} is marked to be excluded for vulnerable ones")   if is_detected_excluded?
+
+          # is the detected version in the safe array?
+          return debug_me_and_return_false("detected version #{@detected} found as is in safe array")      if is_detected_in_safe?
+          return debug_me_and_return_false("detected version #{@detected} is higher than all version marked safe")  if is_detected_highest?
+
+          @safe.sort.each do |s|
+
+              @save_minor_fix   = save_minor_fix
+              @save_major_fix   = save_major_fix
+
+
+              vuln  = is_vulnerable_version?(s, @detected)
+
+              debug_me "VULN=#{vuln} SAVE_MINOR=#{@save_minor_fix} SAVE_MAJOR=#{@save_major_fix}"
+              return true if vuln
+          end
+
+          return false
+        end
+
+        def is_detected_in_safe?
+          @safe.each do |s|
+            return true if @detected == s
+          end
+          return false
+        end
+
+        def is_detected_highest?
+          higher= @detected
+          @safe.sort.each do |s|
+            debug_me("higher is #{higher}")
+            higher=s if is_higher?(s, higher)
+          end
+          return (higher == @detected)
+        end
+        def is_detected_deprecated?
+          return is_deprecated?(@detected)
+        end
+        def is_detected_excluded?
+          return is_excluded?(@detected)
+        end
+
+        def is_higher_major?(s,d)
+          sa = version_string_to_array(s)[:version]
+          da = version_string_to_array(d)[:version]
+          return (sa[0] > da[0])
+        end
+
+        # Public: tells if a version is higher than another
+        #
+        # e.g.
+        #   is_higher?('2.3.2', '2.4.2') => true
+        #   is_higher?('2.3.2', '2.3.2') => true
+        def is_higher?(a, b)
+          aa = version_string_to_array(a)
+          ba = version_string_to_array(b)
+
+          ver = false
+          beta = false
+          rc = false
+          same = false
+
+          # Version arrays are just major.minor version. Let's assume
+          # patchlevel is 0 for sake of comparison.
+          aa[:version] << 0 if aa[:version].count == 2
+          ba[:version] << 0 if ba[:version].count == 2
+          ver = true if aa[:version][0] > ba[:version][0]
+          ver = true if aa[:version][0] == ba[:version][0] && aa[:version][1] > ba[:version][1]
+          ver = true if aa[:version].count == 3 && ba[:version].count == 3 && aa[:version][0] == ba[:version][0] && aa[:version][1] == ba[:version][1] && aa[:version][2] > ba[:version][2]
+          ver = true if aa[:version].count == 4 && ba[:version].count == 4 && aa[:version][0] == ba[:version][0] && aa[:version][1] == ba[:version][1] && aa[:version][2] == ba[:version][2] && aa[:version][3] > ba[:version][3]
+          ver = true if aa[:version].count == 4 && ba[:version].count == 4 && aa[:version][0] == ba[:version][0] && aa[:version][1] == ba[:version][1] && aa[:version][2] > ba[:version][2]
+          same = is_same_version?(aa[:version], ba[:version])
+          beta = true if aa[:beta] >= ba[:beta]
+          rc = true if aa[:rc] >= ba[:rc]
+
+          ret = false
+          ret = ver && beta && rc unless same
+          ret = beta && rc if same
+
+          debug_me("is_higher? a=#{a}, b=#{b} VER=#{ver} - BETA=#{beta} - RC=#{rc} - SAME=#{same} - a>b? = (#{ret})")
+          return ret
+        end
+
+        # checks in the array if there is another string with higher major version
+        def is_there_an_higher_major_version?
+          dva = version_string_to_array(@detected)[:version]
+          @safe.sort.each do |s|
+            sva = version_string_to_array(s)[:version]
+            debug_me "is_there_an_higher_major_version? DVA=#{dva} - SVA=#{sva}"
+            return debug_me_and_return_true("is_there_an_higher_major_version? is returning true for #{@detected}") if dva[0] < sva[0]
+          end
+          return debug_me_and_return_false("is_there_an_higher_major_version? is returning false")
+        end
+
+        # checks in the array if there is another string with higher minor version but the same major as the parameter element)
+        def is_there_an_higher_minor_version?
+          dva = version_string_to_array(@detected)[:version]
+          @safe.sort.each do |s|
+            sva = version_string_to_array(s)[:version]
+            return true if dva[0] == sva[0] && dva[1] < sva[1]
+          end
+          return false
+        end
+
+        def save_major_fix
+          return false unless @save_major
+          return is_there_an_higher_major_version?
+        end
+        ##
+        # This functions handles an hack to save a detected version even if a
+        # safe version with an higher minor version number has been found.
+        #
+        # This is mostly used in rails where there are different versions and
+        # if a 3.2.12 is safe it should not marked as vulnerable just because
+        # you can either use 3.3.x that is a different branch.
+        #
+        # It returns true when the detected version must be saved, false otherwise.
+        def save_minor_fix
+          return false unless @save_minor
+          hm = is_there_an_higher_minor_version?
+
+          # This is the save minor version workaround.
+          # fixes is something like ['2.2.2', '3.1.1', '3.2.2']
+          # target is '3.1.1' and save_minor_fixes is true
+          # I don't want that check for 3.2.2 marks this as vulnerable, so I will save it
+          dva = version_string_to_array(@detected)[:version]
+          @safe.sort.each do |s|
+            sva = version_string_to_array(s)[:version]
+            return true if is_same_major?(sva, dva) && is_same_minor?(sva, dva) && dva[2] >= sva[2] && hm
+          end
+          return false
+        end
+
+        def is_good_parameter?(array)
+          return false if array.nil?
+          return false if array.empty?
+          return true
+        end
+        ##
+        # It checks if the first digit of a version array is the same
+        #
+        # e.g.
+        # has_same_major?([2,3,3], [1,2,2]) #=> false
+        # has_same_major?([2,3,3], [2,2,2]) #=> true
+        def is_same_major?(array_a, array_b)
+          return false if ! is_good_parameter?(array_a) || ! is_good_parameter?(array_b)
+          return (array_a[0] == array_b[0])
+        end
+        def is_same_minor?(array_a, array_b)
+          return false if ! is_good_parameter?(array_a) || ! is_good_parameter?(array_b)
+          return (array_a[1] == array_b[1])
+        end
+        def is_same_patch?(array_a, array_b)
+          return false if ! is_good_parameter?(array_a) || ! is_good_parameter?(array_b)
+          return (array_a[2] == array_b[2])
+        end
+
+        def is_vulnerable_major?(safe_version, detected_version)
+          return (safe_version[0] > detected_version[0])
+        end
+
+        def is_vulnerable_patch?(safe_version, detected_version)
+          return false if safe_version[2].nil? || detected_version[2].nil?
+          return (safe_version[2] > detected_version[2])
+        end
+        def is_vulnerable_aux_patch?(safe_version, detected_version)
+          return false if safe_version[3].nil? || detected_version[3].nil?
+          return (safe_version[3] > detected_version[3])
+        end
+
+
+        def is_vulnerable_minor?(safe_version, detected_version)
+          if safe_version.length < detected_version.length
+            # safe version is just the major number e.g. 2
+            # detected version is kinda more complex e.g. 2.3.2 or 1.2.3
+            # we relay on major here
+            return is_vulnerable_major?(safe_version, detected_version)
+          end
+          if safe_version.length > detected_version.length
+            # detected version is just the major number e.g. 2
+            # safe version is kinda more complex e.g. 2.3.2
+            # in this case we return the version is vulnerable if the
+            # detected_version major is less or equal the safe one.
+            return (safe_version[0] <= detected_version[0])
+          end
+
+          # support for x as safe minor version
+          return false if is_same_major?(safe_version, detected_version) && safe_version[1] == 'x'
+          return false if safe_version[0] <= detected_version[0] && safe_version[1] == 'x'
+          return true if safe_version[0] > detected_version[0] && safe_version[1] == 'x'
+          return true if safe_version[1] > detected_version[1]
+          return false if safe_version[1] <= detected_version[1]
+        end
+
+        def is_same_version?(safe_version_array, detected_version_array)
+          ret = false
+
+          ret = true if (safe_version_array[0] == detected_version_array[0]) if (safe_version_array[1] == 'x')
+          ret = true if (safe_version_array[0] == detected_version_array[0]) && (safe_version_array[1] == detected_version_array[1]) && (safe_version_array.count == 2) && (detected_version_array.count == 2)
+          ret = true if (safe_version_array[0] == detected_version_array[0]) && (safe_version_array[1] == detected_version_array[1]) && (safe_version_array[2] == detected_version_array[2]) && (safe_version_array.count == 3) && (detected_version_array.count == 3)
+          ret = true if (safe_version_array[0] == detected_version_array[0]) && (safe_version_array[1] == detected_version_array[1]) && (safe_version_array[2] == detected_version_array[2]) && (safe_version_array[3] == detected_version_array[3]) && (safe_version_array.count == 4) && (detected_version_array.count == 4)
+
+          debug_me "is_same_version? SVA=#{safe_version_array} DVA=#{detected_version_array} RET=#{ret}"
+
+          return ret
+        end
+        #########################
+        # Beta version handling
+        #
+        #########################
+
+        def is_beta_check?(safe_version_beta, detected_version_beta)
+          ( safe_version_beta != 0 || detected_version_beta != 0)
+        end
+
+        def is_vulnerable_beta?(safe_version_beta, detected_version_beta)
+          # if the safe_version_beta is 0 then the detected_version_beta is
+          # vulnerable by design, since the safe version is a stable and we
+          # detected a beta.
+          return true if safe_version_beta == 0 && detected_version_beta != 0
+          return false if safe_version_beta <= detected_version_beta
+          return true if safe_version_beta > detected_version_beta
+
+          # fallback
+          return false
+        end
+
+        #########################
+        # Rc version handling
+        #
+        #########################
+
+        def is_rc_check?(safe_version_rc, detected_version_rc)
+          ( safe_version_rc != 0 || detected_version_rc != 0)
+        end
+
+        def is_vulnerable_rc?(safe_version_rc, detected_version_rc)
+          # if the safe_version_rc is 0 then the detected_version_rc is
+          # vulnerable by design, since the safe version is a stable and we
+          # detected a rc.
+          debug_me "entering is_vulnerable_rc?: s=#{safe_version_rc}, d=#{detected_version_rc}"
+          return true if safe_version_rc == 0 && detected_version_rc != 0
+          return false if safe_version_rc != 0 && detected_version_rc == 0
+          return false if safe_version_rc <= detected_version_rc
+          return true if safe_version_rc > detected_version_rc
+
+          # fallback
+          return false
+        end
+
+        #########################
+        # pre version handling
+        #
+        #########################
+
+        def is_pre_check?(safe_version_pre, detected_version_pre)
+          ( safe_version_pre != 0 || detected_version_pre != 0)
+        end
+
+        def is_vulnerable_pre?(safe_version_pre, detected_version_pre)
+          # if the safe_version_pre is 0 then the detected_version_pre is
+          # vulnerable by design, since the safe version is a stable and we
+          # detected a pre.
+          return true if safe_version_pre == 0 && detected_version_pre != 0
+          return false if safe_version_pre <= detected_version_pre
+          return true if safe_version_pre > detected_version_pre
+
+          # fallback
+          return false
+        end
+
+        def is_vulnerable_version?(safe_version, detected_version)
+          sva = version_string_to_array(safe_version)
+          dva = version_string_to_array(detected_version)
+          safe_version_array = sva[:version]
+          detected_version_array = dva[:version]
+
+          safe_version_array << 0 if safe_version_array.count == 2
+          detected_version_array << 0 if detected_version_array.count == 2
+
+          major = is_vulnerable_major?(safe_version_array, detected_version_array)
+          minor = is_vulnerable_minor?(safe_version_array, detected_version_array)
+          patch = is_vulnerable_patch?(safe_version_array, detected_version_array)
+          aux_patch = is_vulnerable_aux_patch?(safe_version_array, detected_version_array)
+
+          debug_me "is_vulnerable_version? S=#{safe_version},D=#{detected_version} -> MAJOR=#{major} MINOR=#{minor} PATCH=#{patch} AUX_PATCH=#{aux_patch} SAVE_MINOR=#{@save_minor_fix} SAVE_MAJOR=#{@save_major_fix}"
+
+          return is_vulnerable_beta?(sva[:beta], dva[:beta]) if is_same_version?(safe_version_array, detected_version_array) && is_beta_check?(sva[:beta], dva[:beta])
+          return is_vulnerable_rc?(sva[:rc], dva[:rc]) if is_same_version?(safe_version_array, detected_version_array) && is_rc_check?(sva[:rc], dva[:rc])
+          return is_vulnerable_pre?(sva[:pre], dva[:pre]) if is_same_version?(safe_version_array, detected_version_array) && is_pre_check?(sva[:pre], dva[:pre])
+
+          # we have a non vulnerable major, but the minor is and there is an higher version in array
+          # eg. we detected v1.3.2, safe version is 1.3.3 and there is also a safe 2.x.x
+          return debug_me_and_return_false("#{detected_version} has a major version vulnerable but honoring save_major_fix") if major && @save_major_fix
+          return debug_me_and_return_false("#{detected_version} has a minor version vulnerable but honoring save_minor_fix") if minor && @save_minor_fix
+          return true if major && minor
+          return true if ! major && minor && patch && ! @save_major_fix && ! @save_minor_fix
+          return true if major && !@save_major_fix
+          return true if !major && minor && @save_major_fix
+          return patch if is_same_major?(safe_version_array, detected_version_array) && is_same_minor?(safe_version_array, detected_version_array) && !aux_patch
+          return aux_patch if is_same_major?(safe_version_array, detected_version_array) && is_same_minor?(safe_version_array, detected_version_array) && is_same_patch?(safe_version_array, detected_version_array)
+          return true if is_same_major?(safe_version_array, detected_version_array) && is_same_minor?(safe_version_array, detected_version_array) && patch && aux_patch
+          return true if is_same_major?(safe_version_array, detected_version_array) && minor
+
+          return false
+        end
+
+        def is_excluded?(detected_version)
+          return false if detected_version.nil?
+          return false if @excluded.nil?
+          @excluded.each do |exc|
+            exc_v = version_string_to_array(exc)[:version]
+            det_v = version_string_to_array(detected_version)[:version]
+            return true if is_same_version?(exc_v, det_v)
+          end
+          return false
+        end
+        def is_deprecated?(detected_version)
+          return false if detected_version.nil?
+          return false if @deprecated.nil?
+          @deprecated.each do |dep|
+            dep_v = version_string_to_array(dep)[:version]
+            det_v = version_string_to_array(detected_version)[:version]
+            return true if is_same_version?(dep_v, det_v)
+            if dep_v[0] == 'x'
+              # deprecation version is something like 'x.0.0'. This is a
+              # nonsense since it means all versions are deprecated. However
+              # I'll support also nonsense checks.
+
+              $logger.warn "Setting the predicate #{dep} will mark all versions as deprecated" unless self.enable_warning.nil?
+              debug_me "You kindly mark #{detected_version} as deprecated with this predicate #{dep}"
+              return true
+            end
+
+            if dep_v[1] == 'x'
+              # deprecation version is something like 1.x
+              # detected version is deprecated if major == 1. If 0 not
+              return true if det_v[0] == dep_v[0]
+            end
+
+            if dep_v[2] == 'x'
+              # deprecation version is something like 1.2.x
+              # detected version is deprecated if major == 1 and minor == 2.
+              return true if det_v[0] == dep_v[0] && det_v[1] == dep_v[1]
+
+            end
+          end
+          false
+        end
+
+
+        ##
+        # It takes a string representing a version and it splits it in an Hash.
+        #
+        # e.g.
+        # version_string_to_array("3.2.3") #=> {:version=>[3,2,3], :beta=>0, :rc=>0}
+        # version_string_to_array("3.2.2.beta1") #=> {:version=>[3,2,2], :beta=>1, :rc=>0}
+        def version_string_to_array(string)
+          # I can't use this nice onliner... stays here until I finish writing new code.
+          # return string.split(".").map! { |n| (n=='x')? n : n.to_i }
+          ver   = []
+          beta  = 0
+          rc    = 0
+          pre   = 0
+
+          string.split(".").each do |x|
+            ver << x.to_i unless x == 'x' || x.start_with?('beta') || x.start_with?('rc') || x.start_with?('pre')
+            ver << x if x == 'x'
+
+            beta = x.split("beta")[1].to_i if x.class == String && x.start_with?('beta') && beta == 0
+            rc = x.split("rc")[1].to_i if x.class == String && x.start_with?('rc') && rc == 0
+            pre = x.split("pre")[1].to_i if x.class == String && x.start_with?('pre') && pre == 0
+
+          end
+          {:version=>ver, :beta=>beta, :rc=>rc, :pre=>pre}
+        end
+
+      end
+    end
+  end
+end