dependency_spy 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ddb60aae0c5f147e8a30d6ace566ef78bbdc0ec19347ca1f7ba293c9fbeace0
-  data.tar.gz: 7b8af132b777ab01bb86e9bb411b301a6b43efd7e5f5041a60aab32d21ba2dce
+  metadata.gz: 870c1695f62b6c4d5528955daa987ac893ea480a4a2e4ff4416e595170b45fe6
+  data.tar.gz: eb662a8e9f08dc6b6ce5e996e2be7e217b86eab24bb70bb46d19bf25e00db186
 SHA512:
-  metadata.gz: 9f28a41c70c1180129d3ad64324c5eb8248154bdef020751839e7772650c62ad36ff5307e3666d5dbab6d045269d4ce54b19f54c6c5231258260c5a42841b2e3
-  data.tar.gz: 872132f723b4a31fc739680ae336a151cca2b054d900ea5e33e52f1cee37be3f2acf4a8ceb6d4fd867a7bc1cf475c86dca0c1207d8769ec56b86f23e66ac62dd
+  metadata.gz: 8ed9e7adb7aa849e7e33d7d2d725cb39d53ee33f55e49ddf4fa3a87054ef9e55e40a70345b0dea238769e115982a0d4d2848727dbd49fd7662e407984b790e1b
+  data.tar.gz: 2fa757046d9bd09f3bfc75d44a13fa760029560f23573bc56ed786a904b89d7e96072b2b0c5370a46a6171f6b16b5fd0f9075e17154503f4d3b581d98ceb2cb5

data/.gitignore

@@ -112,3 +112,5 @@ build-iPhoneSimulator/
 *.iml
 
 # End of https://www.gitignore.io/api/jetbrains,ruby
+
+.depspy.yml

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    dependency_spy (0.5.0)
+    dependency_spy (0.6.0)
       bibliothecary (~> 6.6)
       colorize (= 0.8.1)
       semantic_range (~> 2.2)
@@ -13,7 +13,7 @@ GEM
   specs:
     ansi (1.5.0)
     ast (2.4.0)
-    bibliothecary (6.7.3)
+    bibliothecary (6.8.4)
       commander
       deb_control
       librariesio-gem-parser
@@ -36,12 +36,12 @@ GEM
       ffi (>= 1.3.0)
     execjs (2.7.0)
     ffi (1.11.1)
-    highline (2.0.2)
+    highline (2.0.3)
     jaro_winkler (1.5.3)
     json (2.2.0)
     kramdown (2.1.0)
     librariesio-gem-parser (1.0.0)
-    libv8 (3.16.14.19-x86_64-linux)
+    libv8 (3.16.14.19)
     oga (2.15)
       ast
       ruby-ll (~> 2.1)
@@ -88,7 +88,7 @@ GEM
       json (>= 1.8, < 3)
       simplecov-html (~> 0.10.0)
     simplecov-html (0.10.2)
-    strings (0.1.5)
+    strings (0.1.6)
       strings-ansi (~> 0.1)
       unicode-display_width (~> 1.5)
       unicode_utils (~> 1.4)
@@ -103,7 +103,7 @@ GEM
       ethon (>= 0.9.0)
     unicode-display_width (1.6.0)
     unicode_utils (1.4.0)
-    yavdb (0.5.2)
+    yavdb (0.5.3)
       execjs (~> 2.7)
       json (~> 2.2)
       kramdown (~> 2.1)

data/example.depspy.yml

@@ -0,0 +1,12 @@
+path: '/path/to/files' # Path to find files. DEFAULT: Dir.pwd
+files: 'comma.sep,file.list' # Specific file list relative to `path`. DEFAULT: All files
+formatter: 'text' # Output format. DEFAULT: text; AVAILABLE: text,json,yaml
+platform: 'rubygems' # Supported YAVDB package manager lookup. DEFAULT: not specified (ALL); AVAILABLE: (See: https://github.com/rtfpessoa/yavdb/blob/master/lib/yavdb/constants.rb#L31)
+output-path: '/path/to/output' # Path to generate report to. DEFAULT: not specified (console output)
+database-path: '/path/to/yavdb/database' # Path to find/store local YAVDB DB. DEFAULT: YAVDB::Constants::DEFAULT_YAVDB_DATABASE_PATH (See: https://github.com/rtfpessoa/yavdb/blob/master/lib/yavdb/constants.rb#L28)
+offline: false # Operate in offline mode (don't try to get YAVDB). Must have local YAVDB available. DEFAULT: false; AVAILABLE: true,false
+severity-threshold: 'low' # Threshold for non-zero exit status. Doesn't change output. DEFAULT: 'low'; AVAILABLE: (See: https://github.com/rtfpessoa/yavdb/blob/master/lib/yavdb/constants.rb#L33)
+with-color: true # Generate colored console output. DEFAULT: true; AVAILABLE: true,false
+ignore: # A list of all YAVDB vulnerability identifiers to ignore. Removes from output.
+  - "identifier:to:ignore:19551105"
+vuln-db-path: '/path/to/yavdb' # Path to local YAVDB for updating. DEFAULT: YAVDB::Constants::DEFAULT_YAVDB_PATH (See: https://github.com/rtfpessoa/yavdb/blob/master/lib/yavdb/constants.rb#L27)

data/lib/dependency_spy/cli.rb

@@ -24,6 +24,7 @@ require_relative 'formatters/yaml'
 require_relative 'outputs/stdout'
 require_relative 'outputs/file'
 require_relative 'helper/helper'
+require_relative 'helper/config_file'
 
 module DependencySpy
   class CLI < Thor
@@ -37,32 +38,49 @@ module DependencySpy
       DependencySpy::Formatters::Yaml
     ]
 
-    class_option('verbose', :type => :boolean, :default => false)
+    class_option('verbose', :type => :boolean)
 
     desc('check', 'Check dependencies for known vulnerabilities')
-    method_option('path', :aliases => :p, :type => :string, :default => Dir.pwd)
+    method_option('config-file-path', :aliases => :c, :type => :string)
+    method_option('path', :aliases => :p, :type => :string)
     method_option('files', :type => :string)
-    method_option('formatter', :aliases => :f, :type => :string, :enum => FORMATTERS.map { |f| f.name.split('::').last.downcase }, :default => FORMATTERS.first.name.split('::').last.downcase)
+    method_option('formatter', :aliases => :f, :type => :string, :enum => FORMATTERS.map { |f| f.name.split('::').last.downcase })
     method_option('platform', :aliases => :m, :type => :string, :enum => YAVDB::Constants::POSSIBLE_PACKAGE_MANAGERS.map(&:downcase))
     method_option('output-path', :aliases => :o, :type => :string)
-    method_option('database-path', :type => :string, :aliases => :p, :default => YAVDB::Constants::DEFAULT_YAVDB_DATABASE_PATH)
-    method_option('offline', :type => :boolean, :default => false)
-    method_option('severity-threshold', :aliases => :s, :type => :string, :enum => YAVDB::Constants::SEVERITIES, :default => 'low')
-    method_option('with-color', :type => :boolean, :default => true)
-    method_option('ignore', :aliases => :i, :type => :array, :default => [])
+    method_option('database-path', :type => :string, :aliases => :p)
+    method_option('offline', :type => :boolean)
+    method_option('severity-threshold', :aliases => :s, :type => :string, :enum => YAVDB::Constants::SEVERITIES)
+    method_option('with-color', :type => :boolean)
+    method_option('ignore', :aliases => :i, :type => :array)
     def check
-      manifests = API.check(options)
+      defaults = {
+        'verbose' => false,
+        'path' => Dir.pwd,
+        'formatter' => FORMATTERS.first.name.split('::').last.downcase,
+        'database-path' => YAVDB::Constants::DEFAULT_YAVDB_DATABASE_PATH,
+        'offline' => false,
+        'severity-threshold' => 'low',
+        'with-color' => true,
+        'ignore' => []
+      }
+      the_options = defaults.merge(options)
 
-      formatted_output = if (options['formatter'] == 'text') && !options['output-path'] && options['with-color']
-                           DependencySpy::Formatters::Text.format(manifests, options['severity-threshold'])
+      api_options = the_options.transform_keys(&:to_sym)
+      api_options[:database_path] = api_options[:'database-path']
+      the_options.freeze
+      api_options.freeze
+      manifests = API.check(api_options)
+
+      formatted_output = if (the_options['formatter'] == 'text') && !the_options['output-path'] && the_options['with-color']
+                           DependencySpy::Formatters::Text.format(manifests, the_options['severity-threshold'])
                          else
                            FORMATTERS
-                             .find { |f| f.name.split('::').last.downcase == options['formatter'] }
+                             .find { |f| f.name.split('::').last.downcase == the_options['formatter'] }
                              .format(manifests)
                          end
 
-      if options['output-path']
-        DependencySpy::Outputs::FileSystem.write(options['output-path'], formatted_output)
+      if the_options['output-path']
+        DependencySpy::Outputs::FileSystem.write(the_options['output-path'], formatted_output)
       else
         DependencySpy::Outputs::StdOut.write(formatted_output)
       end
@@ -71,7 +89,7 @@ module DependencySpy
         manifests.any? do |manifest|
           manifest[:dependencies]&.any? do |dependency|
             dependency[:vulnerabilities]&.any? do |vuln|
-              DependencySpy::Helper.severity_above_threshold?(vuln.severity, options['severity-threshold'])
+              DependencySpy::Helper.severity_above_threshold?(vuln.severity, the_options['severity-threshold'])
             end
           end
         end
@@ -79,11 +97,25 @@ module DependencySpy
       exit(1) if has_vulnerabilities
     end
 
-    method_option('vuln-db-path', :aliases => :d, :type => :string, :default => YAVDB::Constants::DEFAULT_YAVDB_PATH)
+    method_option('vuln-db-path', :aliases => :d, :type => :string)
     desc('update', 'Download or update database from the official yavdb repository.')
 
     def update
-      API.update(options['vuln-db-path'])
+      defaults = {
+        'verbose' => false,
+        'vuln-db-path' => YAVDB::Constants::DEFAULT_YAVDB_PATH
+      }
+      the_options = defaults.merge(options)
+      the_options.freeze
+      API.update(the_options['vuln-db-path'])
+    end
+
+    private
+
+    def options
+      cli_options = super
+      config_file_options = DependencySpy::ConfigFile.get_config(cli_options[:'config-file-path'])
+      config_file_options.merge(cli_options)
     end
 
   end

data/lib/dependency_spy/helper/config_file.rb

@@ -0,0 +1,41 @@
+require 'yaml'
+
+module DependencySpy
+  class ConfigFile
+
+    SAFE_CONFIG_PARAMS = [
+      'path',
+      'files',
+      'formatter',
+      'platform',
+      'output-path',
+      'database-path',
+      'offline',
+      'severity-threshold',
+      'with-color',
+      'ignore',
+      'vuln-db-path'
+    ].freeze
+
+    def self.get_config(config_file_path = nil)
+      if !config_file_path.nil? && !File.file?(config_file_path)
+        puts 'Config file specified but not found.'
+        exit(10)
+
+      end
+
+      begin
+        file_path = config_file_path || '.depspy.yml'
+        config = YAML.load_file(file_path) || {}
+        config.slice(*SAFE_CONFIG_PARAMS)
+      rescue Errno::ENOENT
+        {}
+      rescue Psych::SyntaxError => e
+        puts 'Config File Parsing Error:'
+        puts e.message
+        exit(10)
+      end
+    end
+
+  end
+end

data/lib/dependency_spy/version.rb

@@ -16,6 +16,6 @@
 
 module DependencySpy
 
-  VERSION = '0.5.0'
+  VERSION = '0.6.0'
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependency_spy
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Rodrigo Fernandes
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-07-03 00:00:00.000000000 Z
+date: 2019-10-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: codacy-coverage
@@ -207,6 +207,7 @@ files:
 - bin/depspy
 - bin/setup
 - dependency_spy.gemspec
+- example.depspy.yml
 - examples/Gemfile
 - examples/Gemfile.lock
 - examples/npm-shrinkwrap.json
@@ -218,6 +219,7 @@ files:
 - lib/dependency_spy/formatters/json.rb
 - lib/dependency_spy/formatters/text.rb
 - lib/dependency_spy/formatters/yaml.rb
+- lib/dependency_spy/helper/config_file.rb
 - lib/dependency_spy/helper/helper.rb
 - lib/dependency_spy/outputs/file.rb
 - lib/dependency_spy/outputs/stdout.rb