dawnscanner 1.6.1 → 1.6.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- checksums.yaml.gz.sig +0 -0
- data.tar.gz.sig +0 -0
- data/.ruby-version +1 -1
- data/.travis.yml +2 -0
- data/Changelog.md +10 -1
- data/KnowledgeBase.md +10 -4
- data/README.md +1 -1
- data/Rakefile +12 -8
- data/VERSION +1 -1
- data/checksum/dawnscanner-1.6.1.gem.sha1 +1 -0
- data/lib/dawn/kb/cve_2016_2097.rb +35 -0
- data/lib/dawn/kb/cve_2016_2098.rb +34 -0
- data/lib/dawn/knowledge_base.rb +4 -0
- data/lib/dawn/version.rb +4 -4
- data/spec/lib/dawn/codesake_core_spec.rb +1 -1
- data/spec/lib/dawn/codesake_knowledgebase_spec.rb +451 -441
- data/spec/lib/dawn/codesake_padrino_engine_disabled.rb +11 -11
- data/spec/lib/dawn/codesake_rails_engine_disabled.rb +2 -2
- data/spec/lib/dawn/codesake_sinatra_engine_disabled.rb +36 -36
- data/spec/lib/kb/codesake_cve_2013_0175_spec.rb +6 -6
- data/spec/lib/kb/codesake_cve_2013_4457_spec.rb +7 -7
- data/spec/lib/kb/codesake_dependency_version_check_spec.rb +10 -10
- data/spec/lib/kb/codesake_deprecation_check_spec.rb +11 -11
- data/spec/lib/kb/codesake_ruby_version_check_spec.rb +4 -4
- data/spec/lib/kb/codesake_version_check_spec.rb +42 -42
- data/spec/lib/kb/cve_2011_2705_spec.rb +7 -7
- data/spec/lib/kb/cve_2011_2930_spec.rb +6 -6
- data/spec/lib/kb/cve_2011_3009_spec.rb +4 -4
- data/spec/lib/kb/cve_2011_3187_spec.rb +4 -4
- data/spec/lib/kb/cve_2011_4319_spec.rb +9 -9
- data/spec/lib/kb/cve_2011_5036_spec.rb +21 -21
- data/spec/lib/kb/cve_2012_1098_spec.rb +7 -7
- data/spec/lib/kb/cve_2012_2139_spec.rb +3 -3
- data/spec/lib/kb/cve_2012_2671_spec.rb +4 -4
- data/spec/lib/kb/cve_2012_6109_spec.rb +25 -25
- data/spec/lib/kb/cve_2012_6684_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_0162_spec.rb +4 -4
- data/spec/lib/kb/cve_2013_0183_spec.rb +11 -11
- data/spec/lib/kb/cve_2013_0184_spec.rb +26 -26
- data/spec/lib/kb/cve_2013_0256_spec.rb +6 -6
- data/spec/lib/kb/cve_2013_0262_spec.rb +9 -9
- data/spec/lib/kb/cve_2013_0263_spec.rb +1 -1
- data/spec/lib/kb/cve_2013_1607_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_1655_spec.rb +4 -4
- data/spec/lib/kb/cve_2013_1756_spec.rb +4 -4
- data/spec/lib/kb/cve_2013_2090_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_2105_spec.rb +1 -1
- data/spec/lib/kb/cve_2013_2119_spec.rb +5 -5
- data/spec/lib/kb/cve_2013_2512_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_2513_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_2516_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_4203_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_4413_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_4489_spec.rb +11 -11
- data/spec/lib/kb/cve_2013_4491_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_4593_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_5647_spec.rb +3 -3
- data/spec/lib/kb/cve_2013_5671_spec.rb +4 -4
- data/spec/lib/kb/cve_2013_6416_spec.rb +5 -5
- data/spec/lib/kb/cve_2013_6459_spec.rb +2 -2
- data/spec/lib/kb/cve_2013_7086_spec.rb +3 -3
- data/spec/lib/kb/cve_2014_0036_spec.rb +2 -2
- data/spec/lib/kb/cve_2014_0080_spec.rb +5 -5
- data/spec/lib/kb/cve_2014_0081_spec.rb +10 -10
- data/spec/lib/kb/cve_2014_0082_spec.rb +8 -8
- data/spec/lib/kb/cve_2014_0130_spec.rb +3 -3
- data/spec/lib/kb/cve_2014_1233_spec.rb +2 -2
- data/spec/lib/kb/cve_2014_1234_spec.rb +2 -2
- data/spec/lib/kb/cve_2014_2322_spec.rb +2 -2
- data/spec/lib/kb/cve_2014_2538_spec.rb +2 -2
- data/spec/lib/kb/cve_2014_3482_spec.rb +2 -2
- data/spec/lib/kb/cve_2014_3483_spec.rb +5 -5
- data/spec/lib/kb/cve_2014_7818_spec.rb +8 -8
- data/spec/lib/kb/cve_2014_7819_spec.rb +32 -32
- data/spec/lib/kb/cve_2014_7829_spec.rb +10 -10
- data/spec/lib/kb/cve_2014_9490_spec.rb +2 -2
- data/spec/lib/kb/cve_2015_1819_spec.rb +2 -2
- data/spec/lib/kb/cve_2015_1840_spec.rb +7 -7
- data/spec/lib/kb/cve_2015_2963_spec.rb +2 -2
- data/spec/lib/kb/cve_2015_3224_spec.rb +2 -2
- data/spec/lib/kb/cve_2015_3225_spec.rb +5 -5
- data/spec/lib/kb/cve_2015_3226_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_3227_spec.rb +5 -5
- data/spec/lib/kb/cve_2015_3448_spec.rb +2 -2
- data/spec/lib/kb/cve_2015_4020_spec.rb +4 -4
- data/spec/lib/kb/cve_2015_5312_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_7497_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_7498_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_7499_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_7500_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_7519_spec.rb +4 -4
- data/spec/lib/kb/cve_2015_7541_spec.rb +2 -2
- data/spec/lib/kb/cve_2015_7576_spec.rb +11 -11
- data/spec/lib/kb/cve_2015_7577_spec.rb +11 -11
- data/spec/lib/kb/cve_2015_7578_spec.rb +2 -2
- data/spec/lib/kb/cve_2015_7579_spec.rb +4 -4
- data/spec/lib/kb/cve_2015_7581_spec.rb +11 -11
- data/spec/lib/kb/cve_2015_8241_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_8242_spec.rb +6 -6
- data/spec/lib/kb/cve_2015_8317_spec.rb +6 -6
- data/spec/lib/kb/cve_2016_0751_spec.rb +11 -11
- data/spec/lib/kb/cve_2016_0752_spec.rb +11 -11
- data/spec/lib/kb/cve_2016_0753_spec.rb +11 -11
- data/spec/lib/kb/cve_2016_2097_spec.rb +35 -0
- data/spec/lib/kb/cve_2016_2098_spec.rb +39 -0
- data/spec/lib/kb/osvdb_105971_spec.rb +2 -2
- data/spec/lib/kb/osvdb_108530_spec.rb +3 -3
- data/spec/lib/kb/osvdb_108563_spec.rb +2 -2
- data/spec/lib/kb/osvdb_108569_spec.rb +2 -2
- data/spec/lib/kb/osvdb_108570_spec.rb +2 -2
- data/spec/lib/kb/osvdb_115654_spec.rb +2 -2
- data/spec/lib/kb/osvdb_116010_spec.rb +2 -2
- data/spec/lib/kb/osvdb_117903_spec.rb +4 -4
- data/spec/lib/kb/osvdb_118830_spec.rb +2 -2
- data/spec/lib/kb/osvdb_118954_spec.rb +3 -3
- data/spec/lib/kb/osvdb_119878_spec.rb +21 -21
- data/spec/lib/kb/osvdb_119927_spec.rb +2 -2
- data/spec/lib/kb/osvdb_120415_spec.rb +2 -2
- data/spec/lib/kb/osvdb_120857_spec.rb +6 -6
- data/spec/lib/kb/osvdb_121701_spec.rb +2 -2
- data/spec/lib/kb/owasp_ror_cheatsheet_disabled.rb +10 -10
- metadata +9 -2
- metadata.gz.sig +0 -0
@@ -6,11 +6,11 @@ describe "The CVE-2012-6684 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "is reported when vulnerable raven-ruby gem is used (4.2.9)" do
|
8
8
|
@check.dependencies = [{:name=>"RedCloth", :version=>'4.2.9'}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "is not reported when safe raven-ruby gem is used (4.2.10)" do
|
12
12
|
@check.dependencies = [{:name=>"RedCloth", :version=>'4.2.10'}]
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(false)
|
14
14
|
end
|
15
15
|
|
16
16
|
end
|
@@ -6,18 +6,18 @@ describe "The CVE-2013-0162 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "is reported when ruby_parser version 1.x is used" do
|
8
8
|
@check.dependencies = [{:name=>"ruby_parser", :version=>'1.4.5'}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "is reported when ruby_parser version 2.x is used" do
|
12
12
|
@check.dependencies = [{:name=>"ruby_parser", :version=>'2.4.5'}]
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(true)
|
14
14
|
end
|
15
15
|
it "is reported when ruby_parser version 3.0.x is used" do
|
16
16
|
@check.dependencies = [{:name=>"ruby_parser", :version=>'3.0.5'}]
|
17
|
-
@check.vuln
|
17
|
+
expect(@check.vuln?).to eq(true)
|
18
18
|
end
|
19
19
|
it "is not reported when ruby_parser version 3.1.1 is used" do
|
20
20
|
@check.dependencies = [{:name=>"ruby_parser", :version=>'3.1.1'}]
|
21
|
-
@check.vuln
|
21
|
+
expect(@check.vuln?).to eq(false)
|
22
22
|
end
|
23
23
|
end
|
@@ -7,48 +7,48 @@ describe "The CVE-2013-0183 vulnerability" do
|
|
7
7
|
|
8
8
|
it "is reported when the vulnerable gem is detected - 1.3.0" do
|
9
9
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.0"}]
|
10
|
-
@check.vuln
|
10
|
+
expect(@check.vuln?).to eq(true)
|
11
11
|
end
|
12
12
|
|
13
13
|
it "is reported when the vulnerable gem is detected - 1.3.1" do
|
14
14
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.1"}]
|
15
|
-
@check.vuln
|
15
|
+
expect(@check.vuln?).to eq(true)
|
16
16
|
end
|
17
17
|
it "is reported when the vulnerable gem is detected - 1.3.2" do
|
18
18
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.2"}]
|
19
|
-
@check.vuln
|
19
|
+
expect(@check.vuln?).to eq(true)
|
20
20
|
end
|
21
21
|
it "is reported when the vulnerable gem is detected - 1.3.3" do
|
22
22
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.3"}]
|
23
|
-
@check.vuln
|
23
|
+
expect(@check.vuln?).to eq(true)
|
24
24
|
end
|
25
25
|
it "is reported when the vulnerable gem is detected - 1.3.4" do
|
26
26
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.4"}]
|
27
|
-
@check.vuln
|
27
|
+
expect(@check.vuln?).to eq(true)
|
28
28
|
end
|
29
29
|
it "is reported when the vulnerable gem is detected - 1.3.5" do
|
30
30
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.5"}]
|
31
|
-
@check.vuln
|
31
|
+
expect(@check.vuln?).to eq(true)
|
32
32
|
end
|
33
33
|
it "is reported when the vulnerable gem is detected - 1.3.6" do
|
34
34
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.6"}]
|
35
|
-
@check.vuln
|
35
|
+
expect(@check.vuln?).to eq(true)
|
36
36
|
end
|
37
37
|
it "is reported when the vulnerable gem is detected - 1.3.7" do
|
38
38
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.7"}]
|
39
|
-
@check.vuln
|
39
|
+
expect(@check.vuln?).to eq(true)
|
40
40
|
end
|
41
41
|
|
42
42
|
it "is reported when the vulnerable gem is detected - 1.4.0" do
|
43
43
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.0"}]
|
44
|
-
@check.vuln
|
44
|
+
expect(@check.vuln?).to eq(true)
|
45
45
|
end
|
46
46
|
it "is reported when the vulnerable gem is detected - 1.4.1" do
|
47
47
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.1"}]
|
48
|
-
@check.vuln
|
48
|
+
expect(@check.vuln?).to eq(true)
|
49
49
|
end
|
50
50
|
it "is reported when the vulnerable gem is detected - 1.4.2" do
|
51
51
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.2"}]
|
52
|
-
@check.vuln
|
52
|
+
expect(@check.vuln?).to eq(true)
|
53
53
|
end
|
54
54
|
end
|
@@ -7,109 +7,109 @@ describe "The CVE-2013-0184 vulnerability" do
|
|
7
7
|
|
8
8
|
it "is reported when the vulnerable gem is detected - 1.1.0" do
|
9
9
|
@check.dependencies = [{:name=>"rack", :version=>"1.1.0"}]
|
10
|
-
@check.vuln
|
10
|
+
expect(@check.vuln?).to eq(true)
|
11
11
|
end
|
12
12
|
it "is reported when the vulnerable gem is detected - 1.1.3" do
|
13
13
|
@check.dependencies = [{:name=>"rack", :version=>"1.1.3"}]
|
14
|
-
@check.vuln
|
14
|
+
expect(@check.vuln?).to eq(true)
|
15
15
|
end
|
16
16
|
it "is reported when the vulnerable gem is detected - 1.1.2" do
|
17
17
|
@check.dependencies = [{:name=>"rack", :version=>"1.1.2"}]
|
18
|
-
@check.vuln
|
18
|
+
expect(@check.vuln?).to eq(true)
|
19
19
|
end
|
20
20
|
it "is reported when the vulnerable gem is detected - 1.1.4" do
|
21
21
|
@check.dependencies = [{:name=>"rack", :version=>"1.1.4"}]
|
22
|
-
@check.vuln
|
22
|
+
expect(@check.vuln?).to eq(true)
|
23
23
|
end
|
24
24
|
it "is reported when the vulnerable gem is detected - 1.2.0" do
|
25
25
|
@check.dependencies = [{:name=>"rack", :version=>"1.2.0"}]
|
26
|
-
@check.vuln
|
26
|
+
expect(@check.vuln?).to eq(true)
|
27
27
|
end
|
28
28
|
|
29
29
|
it "is reported when the vulnerable gem is detected - 1.2.1" do
|
30
30
|
@check.dependencies = [{:name=>"rack", :version=>"1.2.1"}]
|
31
|
-
@check.vuln
|
31
|
+
expect(@check.vuln?).to eq(true)
|
32
32
|
end
|
33
33
|
it "is reported when the vulnerable gem is detected - 1.2.2" do
|
34
34
|
@check.dependencies = [{:name=>"rack", :version=>"1.2.2"}]
|
35
|
-
@check.vuln
|
35
|
+
expect(@check.vuln?).to eq(true)
|
36
36
|
end
|
37
37
|
it "is reported when the vulnerable gem is detected - 1.2.3" do
|
38
38
|
@check.dependencies = [{:name=>"rack", :version=>"1.2.3"}]
|
39
|
-
@check.vuln
|
39
|
+
expect(@check.vuln?).to eq(true)
|
40
40
|
end
|
41
41
|
it "is reported when the vulnerable gem is detected - 1.2.4" do
|
42
42
|
@check.dependencies = [{:name=>"rack", :version=>"1.2.4"}]
|
43
|
-
@check.vuln
|
43
|
+
expect(@check.vuln?).to eq(true)
|
44
44
|
end
|
45
45
|
it "is reported when the vulnerable gem is detected - 1.2.5" do
|
46
46
|
@check.dependencies = [{:name=>"rack", :version=>"1.2.5"}]
|
47
|
-
@check.vuln
|
47
|
+
expect(@check.vuln?).to eq(true)
|
48
48
|
end
|
49
49
|
it "is reported when the vulnerable gem is detected - 1.2.6" do
|
50
50
|
@check.dependencies = [{:name=>"rack", :version=>"1.2.6"}]
|
51
|
-
@check.vuln
|
51
|
+
expect(@check.vuln?).to eq(true)
|
52
52
|
end
|
53
53
|
it "is reported when the vulnerable gem is detected - 1.3.0" do
|
54
54
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.0"}]
|
55
|
-
@check.vuln
|
55
|
+
expect(@check.vuln?).to eq(true)
|
56
56
|
end
|
57
57
|
|
58
58
|
it "is reported when the vulnerable gem is detected - 1.3.1" do
|
59
59
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.1"}]
|
60
|
-
@check.vuln
|
60
|
+
expect(@check.vuln?).to eq(true)
|
61
61
|
end
|
62
62
|
it "is reported when the vulnerable gem is detected - 1.3.2" do
|
63
63
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.2"}]
|
64
|
-
@check.vuln
|
64
|
+
expect(@check.vuln?).to eq(true)
|
65
65
|
end
|
66
66
|
it "is reported when the vulnerable gem is detected - 1.3.3" do
|
67
67
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.3"}]
|
68
|
-
@check.vuln
|
68
|
+
expect(@check.vuln?).to eq(true)
|
69
69
|
end
|
70
70
|
it "is reported when the vulnerable gem is detected - 1.3.4" do
|
71
71
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.4"}]
|
72
|
-
@check.vuln
|
72
|
+
expect(@check.vuln?).to eq(true)
|
73
73
|
end
|
74
74
|
it "is reported when the vulnerable gem is detected - 1.3.5" do
|
75
75
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.5"}]
|
76
|
-
@check.vuln
|
76
|
+
expect(@check.vuln?).to eq(true)
|
77
77
|
end
|
78
78
|
it "is reported when the vulnerable gem is detected - 1.3.6" do
|
79
79
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.6"}]
|
80
|
-
@check.vuln
|
80
|
+
expect(@check.vuln?).to eq(true)
|
81
81
|
end
|
82
82
|
it "is reported when the vulnerable gem is detected - 1.3.7" do
|
83
83
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.7"}]
|
84
|
-
@check.vuln
|
84
|
+
expect(@check.vuln?).to eq(true)
|
85
85
|
end
|
86
86
|
it "is reported when the vulnerable gem is detected - 1.3.8" do
|
87
87
|
@check.dependencies = [{:name=>"rack", :version=>"1.3.8"}]
|
88
|
-
@check.vuln
|
88
|
+
expect(@check.vuln?).to eq(true)
|
89
89
|
end
|
90
90
|
it "is reported when the vulnerable gem is detected" do
|
91
91
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.0"}]
|
92
|
-
@check.vuln
|
92
|
+
expect(@check.vuln?).to eq(true)
|
93
93
|
end
|
94
94
|
it "is reported when the vulnerable gem is detected" do
|
95
95
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.1"}]
|
96
|
-
@check.vuln
|
96
|
+
expect(@check.vuln?).to eq(true)
|
97
97
|
end
|
98
98
|
it "is reported when the vulnerable gem is detected" do
|
99
99
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.2"}]
|
100
|
-
@check.vuln
|
100
|
+
expect(@check.vuln?).to eq(true)
|
101
101
|
end
|
102
102
|
it "is reported when the vulnerable gem is detected" do
|
103
103
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.3"}]
|
104
|
-
@check.vuln
|
104
|
+
expect(@check.vuln?).to eq(true)
|
105
105
|
end
|
106
106
|
|
107
107
|
it "is not reported when a fixed release is detected" do
|
108
108
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.5"}]
|
109
|
-
@check.vuln
|
109
|
+
expect(@check.vuln?).to eq(false)
|
110
110
|
end
|
111
111
|
it "is not reported when a fixed release is detected" do
|
112
112
|
@check.dependencies = [{:name=>"rack", :version=>"1.5.2"}]
|
113
|
-
@check.vuln
|
113
|
+
expect(@check.vuln?).to eq(false)
|
114
114
|
end
|
115
115
|
end
|
@@ -6,29 +6,29 @@ describe "The CVE-2013-0256 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "fires when vulnerable ruby (1.9.3-p382) and rdoc version (2.3.0) has been found" do
|
8
8
|
@check.options={:detected_ruby=>{:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"381"}, :dependencies=>[{:name=>"rdoc", :version=>'2.3.0'}, :root_dir=>"."]}
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "fires when vulnerable ruby (1.9.2-p342) and rdoc version (2.3.0) has been found" do
|
12
12
|
@check.options={:detected_ruby=>{:engine=>"ruby", :version=>"1.9.2", :patchlevel=>"342"}, :dependencies=>[{:name=>"rdoc", :version=>'2.3.0'}, :root_dir=>"."]}
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(true)
|
14
14
|
end
|
15
15
|
|
16
16
|
it "fires when vulnerable ruby (1.9.3-p382) and rdoc version (3.12) has been found" do
|
17
17
|
@check.options={:detected_ruby=>{:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"381"}, :dependencies=>[{:name=>"rdoc", :version=>'3.12'}, :root_dir=>"."]}
|
18
|
-
@check.vuln
|
18
|
+
expect(@check.vuln?).to eq(true)
|
19
19
|
end
|
20
20
|
it "fires when vulnerable ruby (1.9.2-p342) and rdoc version (3.12) has been found" do
|
21
21
|
@check.options={:detected_ruby=>{:engine=>"ruby", :version=>"1.9.2", :patchlevel=>"342"}, :dependencies=>[{:name=>"rdoc", :version=>'3.12'}, :root_dir=>"."]}
|
22
|
-
@check.vuln
|
22
|
+
expect(@check.vuln?).to eq(true)
|
23
23
|
end
|
24
24
|
|
25
25
|
it "doesn't fire when not vulnerable ruby (1.9.3-p383) is found but vulnerable rdoc version (3.12) has been found" do
|
26
26
|
@check.options={:detected_ruby=>{:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"383"}, :dependencies=>[{:name=>"rdoc", :version=>'3.12'}, :root_dir=>"."]}
|
27
|
-
@check.vuln
|
27
|
+
expect(@check.vuln?).to eq(false)
|
28
28
|
end
|
29
29
|
|
30
30
|
it "doesn't fire when vulnerable ruby (1.9.3-p382) is found but not vulnerable rdoc version (3.13) has been found" do
|
31
31
|
@check.options={:detected_ruby=>{:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"322"}, :dependencies=>[{:name=>"rdoc", :version=>'3.13'}, :root_dir=>"."]}
|
32
|
-
@check.vuln
|
32
|
+
expect(@check.vuln?).to eq(false)
|
33
33
|
end
|
34
34
|
end
|
@@ -7,38 +7,38 @@ describe "The CVE-2013-0262 vulnerability" do
|
|
7
7
|
|
8
8
|
it "is reported when the vulnerable gem is detected" do
|
9
9
|
@check.dependencies = [{:name=>"rack", :version=>"1.5.0"}]
|
10
|
-
@check.vuln
|
10
|
+
expect(@check.vuln?).to eq(true)
|
11
11
|
end
|
12
12
|
it "is reported when the vulnerable gem is detected" do
|
13
13
|
@check.dependencies = [{:name=>"rack", :version=>"1.5.1"}]
|
14
|
-
@check.vuln
|
14
|
+
expect(@check.vuln?).to eq(true)
|
15
15
|
end
|
16
16
|
it "is reported when the vulnerable gem is detected" do
|
17
17
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.0"}]
|
18
|
-
@check.vuln
|
18
|
+
expect(@check.vuln?).to eq(true)
|
19
19
|
end
|
20
20
|
it "is reported when the vulnerable gem is detected" do
|
21
21
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.1"}]
|
22
|
-
@check.vuln
|
22
|
+
expect(@check.vuln?).to eq(true)
|
23
23
|
end
|
24
24
|
it "is reported when the vulnerable gem is detected" do
|
25
25
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.2"}]
|
26
|
-
@check.vuln
|
26
|
+
expect(@check.vuln?).to eq(true)
|
27
27
|
end
|
28
28
|
it "is reported when the vulnerable gem is detected" do
|
29
29
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.3"}]
|
30
|
-
@check.vuln
|
30
|
+
expect(@check.vuln?).to eq(true)
|
31
31
|
end
|
32
32
|
it "is reported when the vulnerable gem is detected" do
|
33
33
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.4"}]
|
34
|
-
@check.vuln
|
34
|
+
expect(@check.vuln?).to eq(true)
|
35
35
|
end
|
36
36
|
it "is not reported when a fixed release is detected" do
|
37
37
|
@check.dependencies = [{:name=>"rack", :version=>"1.4.5"}]
|
38
|
-
@check.vuln
|
38
|
+
expect(@check.vuln?).to eq(false)
|
39
39
|
end
|
40
40
|
it "is not reported when a fixed release is detected" do
|
41
41
|
@check.dependencies = [{:name=>"rack", :version=>"1.5.2"}]
|
42
|
-
@check.vuln
|
42
|
+
expect(@check.vuln?).to eq(false)
|
43
43
|
end
|
44
44
|
end
|
@@ -6,10 +6,10 @@ describe "The CVE-2013-1607 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "is reported when a pdfkit gem version 0.5.2 is detected" do
|
8
8
|
@check.dependencies = [{:name=>"pdfkit", :version=>"0.5.2"}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "is not reported when a pdfkit gem version 0.5.3 is detected" do
|
12
12
|
@check.dependencies = [{:name=>"pdfkit", :version=>"0.5.3"}]
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(false)
|
14
14
|
end
|
15
15
|
end
|
@@ -8,24 +8,24 @@ describe "The CVE-2013-1655 vulnerability" do
|
|
8
8
|
it "is detected if vulnerable version of puppet rubygem is detect when running on ruby 1.9.3 and 2.0.0" do
|
9
9
|
@check.options[:dependencies]=[{:name=>"puppet", :version=>'2.7.20'}]
|
10
10
|
@check.options[:detected_ruby] = {:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p342"}
|
11
|
-
@check.vuln
|
11
|
+
expect(@check.vuln?).to eq(true)
|
12
12
|
end
|
13
13
|
it "is ignored if only vulnerable version of puppet rubygem has been found" do
|
14
14
|
@check.options[:detected_ruby] = {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p358"}
|
15
|
-
@check.vuln
|
15
|
+
expect(@check.vuln?).to eq(false)
|
16
16
|
end
|
17
17
|
|
18
18
|
it "is ignored if only the vulnerable ruby interpreter version has been found" do
|
19
19
|
@check.options[:dependencies]=[{:name=>"puppet", :version=>'8.7.21'}]
|
20
20
|
@check.options[:detected_ruby] = {:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p342"}
|
21
21
|
# @check.dump_status
|
22
|
-
@check.vuln
|
22
|
+
expect(@check.vuln?).to eq(false)
|
23
23
|
end
|
24
24
|
|
25
25
|
it "is ignored if none of the prerequisites have been met" do
|
26
26
|
@check.options[:dependencies]=[{:name=>"puppet", :version=>'8.7.21'}]
|
27
27
|
@check.options[:detected_ruby] = {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p342"}
|
28
28
|
# @check.dump_status
|
29
|
-
@check.vuln
|
29
|
+
expect(@check.vuln?).to eq(false)
|
30
30
|
end
|
31
31
|
end
|
@@ -6,18 +6,18 @@ describe "The CVE-2013-1756 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "is reported when dragonfly version 0.9.12 is used" do
|
8
8
|
@check.dependencies = [{:name=>"dragonfly", :version=>'0.9.12'}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "is reported when dragonfly version 0.8.12 is used" do
|
12
12
|
@check.dependencies = [{:name=>"dragonfly", :version=>'0.8.12'}]
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(true)
|
14
14
|
end
|
15
15
|
it "is reported when dragonfly version 0.7.12 is used" do
|
16
16
|
@check.dependencies = [{:name=>"dragonfly", :version=>'0.7.12'}]
|
17
|
-
@check.vuln
|
17
|
+
expect(@check.vuln?).to eq(true)
|
18
18
|
end
|
19
19
|
it "is not reported when dragonfly version 0.9.13 is used" do
|
20
20
|
@check.dependencies = [{:name=>"dragonfly", :version=>'0.9.13'}]
|
21
|
-
@check.vuln
|
21
|
+
expect(@check.vuln?).to eq(false)
|
22
22
|
end
|
23
23
|
end
|
@@ -6,10 +6,10 @@ describe "The CVE-2013-2090 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "fires when vulnerable cremefraiche version is used" do
|
8
8
|
@check.dependencies = [{:name=>"cremefraiche", :version=>'0.6.1'}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "doesn't fire when not vulnerable cremefraiche version is used" do
|
12
12
|
@check.dependencies = [{:name=>"cremefraiche", :version=>'0.6.2'}]
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(false)
|
14
14
|
end
|
15
15
|
end
|
@@ -6,6 +6,6 @@ describe "The CVE-2013-2105 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "is reported when show_in_browser vulnerable version is reported (0.0.3)" do
|
8
8
|
@check.dependencies = [{:name=>'show_in_browser', :version=>'0.0.3'}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
end
|
@@ -6,22 +6,22 @@ describe "The CVE-2013-2119 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "fires when vulnerable passenger version is used" do
|
8
8
|
@check.dependencies = [{:name=>"passenger", :version=>"4.0.4"}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "fires when vulnerable passenger version is used" do
|
12
12
|
@check.dependencies = [{:name=>"passenger", :version=>"4.0.0"}]
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(true)
|
14
14
|
end
|
15
15
|
it "fires when vulnerable passenger version is used" do
|
16
16
|
@check.dependencies = [{:name=>"passenger", :version=>"3.0.20"}]
|
17
|
-
@check.vuln
|
17
|
+
expect(@check.vuln?).to eq(true)
|
18
18
|
end
|
19
19
|
it "doesn't fire when not vulnerable passenger version is used" do
|
20
20
|
@check.dependencies = [{:name=>"passenger", :version=>"4.0.5"}]
|
21
|
-
@check.vuln
|
21
|
+
expect(@check.vuln?).to eq(false)
|
22
22
|
end
|
23
23
|
it "doesn't fire when not vulnerable passenger version is used" do
|
24
24
|
@check.dependencies = [{:name=>"passenger", :version=>"3.0.21"}]
|
25
|
-
@check.vuln
|
25
|
+
expect(@check.vuln?).to eq(false)
|
26
26
|
end
|
27
27
|
end
|
@@ -6,10 +6,10 @@ describe "The CVE-2013-2512 vulnerability" do
|
|
6
6
|
end
|
7
7
|
it "is reported when a ftpd gem version 0.2.1 is detected" do
|
8
8
|
@check.dependencies = [{:name=>"ftpd", :version=>"0.2.1"}]
|
9
|
-
@check.vuln
|
9
|
+
expect(@check.vuln?).to eq(true)
|
10
10
|
end
|
11
11
|
it "is not reported when a ftpd gem version 0.2.2 is detected" do
|
12
12
|
@check.dependencies = [{:name=>"ftpd", :version=>"0.2.2"}]
|
13
|
-
@check.vuln
|
13
|
+
expect(@check.vuln?).to eq(false)
|
14
14
|
end
|
15
15
|
end
|