gem_guard 0.1.10 → 1.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0370d291f988c0082519f85fdfaffc6fd2acfad9150f91e1c0c66e4d913fd2c0
-  data.tar.gz: 81378c1f38167cccd7ff0ed7f6fb8399556afe40bb29421d2d50601e5aafed91
+  metadata.gz: 2870725c07a4b4c39c53e01c031663a934db6f9e457ad75f509d2ee6e3e35684
+  data.tar.gz: 6f630c2ef6939a0c5de8c3b8982781a907065b8c1a3901483f1101910387e244
 SHA512:
-  metadata.gz: f07731cbc1d4b3dffe6494a4749dfac41cd31849df39e5e712b3735322135131a59f8dd06aaa790c39104d632637d050e3a25e58a9b92c9441accde55a90126e
-  data.tar.gz: 5906908cb03aac3227f78b16cc49b5e8a7b78756361b809840c1b8de9a5dfb3bc5d138954a3703f051e2ee62e8eaea11cb047e1073882c5b2bf3f2715a36468e
+  metadata.gz: 6b7c598cd6789dfdf5d3b90c82fc9f2ade69c730418f1d2a9f6ba6c22555fad01b7e4bbd438bbb03d6116f429176a407e9b0f13221c47fd2cd0e9e2175563e98
+  data.tar.gz: 822e03ed7fa56e17d170abf92db8677fb27f92ff04d0f52ecdc1793c73db9aab3052e37e6cbcb28b7a217f3a30a7fb062a3860169f908067b2c3672964d9f977

data/lib/gem_guard/auto_fixer.rb

@@ -0,0 +1,162 @@
+require "bundler"
+require "fileutils"
+
+module GemGuard
+  class AutoFixer
+    def initialize(lockfile_path = "Gemfile.lock", gemfile_path = "Gemfile")
+      @lockfile_path = lockfile_path
+      @gemfile_path = gemfile_path
+      @backup_created = false
+    end
+
+    def fix_vulnerabilities(vulnerable_dependencies, options = {})
+      dry_run = options.fetch(:dry_run, false)
+      interactive = options.fetch(:interactive, false)
+      create_backup = options.fetch(:backup, true)
+
+      unless File.exist?(@gemfile_path)
+        raise "Gemfile not found at #{@gemfile_path}. Auto-fix requires a Gemfile."
+      end
+
+      unless File.exist?(@lockfile_path)
+        raise "Gemfile.lock not found at #{@lockfile_path}. Run 'bundle install' first."
+      end
+
+      fixes = plan_fixes(vulnerable_dependencies)
+
+      if fixes.empty?
+        return {status: :no_fixes_needed, message: "No automatic fixes available."}
+      end
+
+      if dry_run
+        return {status: :dry_run, fixes: fixes, message: "Dry run completed. #{fixes.length} fixes planned."}
+      end
+
+      if interactive && !confirm_fixes(fixes)
+        return {status: :cancelled, message: "Fix operation cancelled by user."}
+      end
+
+      create_lockfile_backup if create_backup
+
+      applied_fixes = apply_fixes(fixes)
+
+      {
+        status: :completed,
+        fixes: applied_fixes,
+        message: "Applied #{applied_fixes.length} fixes successfully."
+      }
+    end
+
+    private
+
+    def plan_fixes(vulnerable_dependencies)
+      fixes = []
+
+      vulnerable_dependencies.each do |vuln_dep|
+        dependency = vuln_dep.dependency
+        vulnerability = vuln_dep.vulnerability
+
+        # Extract the recommended version from the fix suggestion
+        recommended_version = extract_version_from_fix(vuln_dep.recommended_fix)
+
+        next unless recommended_version
+
+        # Check if the recommended version is available and safe
+        if version_available_and_safe?(dependency.name, recommended_version)
+          fixes << {
+            gem_name: dependency.name,
+            current_version: dependency.version,
+            target_version: recommended_version,
+            vulnerability_id: vulnerability.id,
+            severity: vulnerability.severity
+          }
+        end
+      end
+
+      fixes
+    end
+
+    def extract_version_from_fix(fix_command)
+      # Extract version from commands like "bundle update nokogiri --to 1.18.9"
+      match = fix_command.match(/--to\s+([^\s]+)/)
+      match ? match[1] : nil
+    end
+
+    def version_available_and_safe?(gem_name, version)
+      # Check if the version exists on RubyGems
+      # This is a simplified check - in production, you might want more robust validation
+      return false if version.nil? || version.empty?
+
+      # Basic semantic version validation
+      version.match?(/^\d+\.\d+(\.\d+)?/)
+    end
+
+    def confirm_fixes(fixes)
+      puts "\n🔧 Planned Fixes:"
+      puts "=" * 50
+
+      fixes.each do |fix|
+        severity_emoji = severity_emoji(fix[:severity])
+        puts "#{severity_emoji} #{fix[:gem_name]}: #{fix[:current_version]} → #{fix[:target_version]}"
+        puts "   Fixes: #{fix[:vulnerability_id]}"
+      end
+
+      puts "\n⚠️  This will modify your Gemfile.lock and may require bundle install."
+      print "Do you want to proceed? (y/N): "
+
+      response = $stdin.gets.chomp.downcase
+      response == "y" || response == "yes"
+    end
+
+    def severity_emoji(severity)
+      case severity.to_s.downcase
+      when /critical/
+        "🔴"
+      when /high/
+        "🟠"
+      when /medium/
+        "🟡"
+      else
+        "🟢"
+      end
+    end
+
+    def create_lockfile_backup
+      return if @backup_created
+
+      backup_path = "#{@lockfile_path}.backup.#{Time.now.strftime("%Y%m%d_%H%M%S")}"
+      FileUtils.cp(@lockfile_path, backup_path)
+      @backup_created = true
+      puts "📦 Created backup: #{backup_path}"
+    end
+
+    def apply_fixes(fixes)
+      applied_fixes = []
+
+      fixes.each do |fix|
+        if apply_single_fix(fix)
+          applied_fixes << fix
+          puts "✅ Updated #{fix[:gem_name]} to #{fix[:target_version]}"
+        else
+          puts "❌ Failed to update #{fix[:gem_name]}"
+        end
+      end
+
+      # Run bundle install to update the lockfile
+      if applied_fixes.any?
+        puts "\n🔄 Running bundle install to update lockfile..."
+        system("bundle install")
+      end
+
+      applied_fixes
+    end
+
+    def apply_single_fix(fix)
+      # Use bundler to update the specific gem
+      command = "bundle update #{fix[:gem_name]} --conservative"
+
+      # Execute the bundle update command
+      system(command, out: File::NULL, err: File::NULL)
+    end
+  end
+end

data/lib/gem_guard/cli.rb

@@ -190,6 +190,87 @@ module GemGuard
       end
     end
 
+    desc "fix", "Automatically fix vulnerable dependencies"
+    option :lockfile, type: :string, desc: "Path to Gemfile.lock"
+    option :gemfile, type: :string, desc: "Path to Gemfile"
+    option :dry_run, type: :boolean, desc: "Show planned fixes without applying them"
+    option :interactive, type: :boolean, desc: "Ask for confirmation before applying fixes"
+    option :no_backup, type: :boolean, desc: "Skip creating backup of Gemfile.lock"
+    option :config, type: :string, desc: "Config file path"
+    def fix
+      config = Config.new(options[:config] || ".gemguard.yml")
+
+      lockfile_path = options[:lockfile] || config.lockfile_path
+      gemfile_path = options[:gemfile] || "Gemfile"
+      dry_run = options[:dry_run] || false
+      interactive = options[:interactive] || false
+      create_backup = !options[:no_backup]
+
+      unless File.exist?(lockfile_path)
+        puts "Error: #{lockfile_path} not found"
+        exit EXIT_ERROR
+      end
+
+      unless File.exist?(gemfile_path)
+        puts "Error: #{gemfile_path} not found. Auto-fix requires a Gemfile."
+        exit EXIT_ERROR
+      end
+
+      begin
+        # First, scan for vulnerabilities
+        dependencies = Parser.new.parse(lockfile_path)
+        vulnerabilities = VulnerabilityFetcher.new.fetch_for(dependencies)
+        analysis = Analyzer.new.analyze(dependencies, vulnerabilities)
+
+        if analysis.vulnerable_dependencies.empty?
+          puts "✅ No vulnerabilities found. Nothing to fix!"
+          exit EXIT_SUCCESS
+        end
+
+        # Apply fixes
+        auto_fixer = AutoFixer.new(lockfile_path, gemfile_path)
+        result = auto_fixer.fix_vulnerabilities(
+          analysis.vulnerable_dependencies,
+          dry_run: dry_run,
+          interactive: interactive,
+          backup: create_backup
+        )
+
+        case result[:status]
+        when :no_fixes_needed
+          puts "ℹ️  #{result[:message]}"
+          exit EXIT_SUCCESS
+        when :dry_run
+          puts "🔍 Dry Run Results:"
+          puts "=" * 40
+          result[:fixes].each do |fix|
+            puts "#{fix[:gem_name]}: #{fix[:current_version]} → #{fix[:target_version]}"
+            puts "  Fixes: #{fix[:vulnerability_id]} (#{fix[:severity]})"
+          end
+          puts "\n#{result[:message]}"
+          puts "Run without --dry-run to apply these fixes."
+          exit EXIT_SUCCESS
+        when :cancelled
+          puts "❌ #{result[:message]}"
+          exit EXIT_SUCCESS
+        when :completed
+          puts "🎉 #{result[:message]}"
+          puts "\n📋 Applied Fixes:"
+          result[:fixes].each do |fix|
+            puts "✅ #{fix[:gem_name]}: #{fix[:current_version]} → #{fix[:target_version]}"
+          end
+          puts "\n💡 Run 'gem_guard scan' to verify fixes."
+          exit EXIT_SUCCESS
+        else
+          puts "❌ Unexpected error during fix operation"
+          exit EXIT_ERROR
+        end
+      rescue => e
+        puts "Error: #{e.message}"
+        exit EXIT_ERROR
+      end
+    end
+
     desc "version", "Show gem_guard version"
     def version
       puts GemGuard::VERSION

data/lib/gem_guard/version.rb

@@ -1,3 +1,3 @@
 module GemGuard
-  VERSION = "0.1.10"
+  VERSION = "1.1.2"
 end

data/lib/gem_guard.rb

@@ -3,10 +3,11 @@ require_relative "gem_guard/parser"
 require_relative "gem_guard/vulnerability_fetcher"
 require_relative "gem_guard/analyzer"
 require_relative "gem_guard/reporter"
+require_relative "gem_guard/cli"
+require_relative "gem_guard/config"
 require_relative "gem_guard/sbom_generator"
 require_relative "gem_guard/typosquat_checker"
-require_relative "gem_guard/config"
-require_relative "gem_guard/cli"
+require_relative "gem_guard/auto_fixer"
 
 module GemGuard
   class Error < StandardError; end

data/test_nokogiri.lock.backup.20250810_002252

@@ -0,0 +1,13 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    nokogiri (1.18.8)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  nokogiri
+
+BUNDLED WITH
+   2.4.10

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gem_guard
 version: !ruby/object:Gem::Version
-  version: 0.1.10
+  version: 1.1.2
 platform: ruby
 authors:
 - Wilbur Suero
@@ -99,6 +99,7 @@ files:
 - gem_guard.gemspec
 - lib/gem_guard.rb
 - lib/gem_guard/analyzer.rb
+- lib/gem_guard/auto_fixer.rb
 - lib/gem_guard/cli.rb
 - lib/gem_guard/config.rb
 - lib/gem_guard/parser.rb
@@ -112,6 +113,7 @@ files:
 - templates/github-actions.yml
 - templates/gitlab-ci.yml
 - test_nokogiri.lock
+- test_nokogiri.lock.backup.20250810_002252
 homepage: https://github.com/wilburhimself/gem_guard
 licenses:
 - MIT