gems-validator 0.5.5 → 0.5.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e1dd0c8088ba4f2c4fcb8c6802b72947be6771963a4651cf44899e2ac9b24d2e
-  data.tar.gz: 846333b113ecf3b952ad2650006993ccf5f70773bc53771c2ba451f04675ce7c
+  metadata.gz: b5472b33f721cf9b4af442267af194d2515735e13440bd7edf04f62d4d048843
+  data.tar.gz: bd050caa8bea44cd101284a02a414a8351fd9dbf22a05a55a83ca7cb71e226ea
 SHA512:
-  metadata.gz: 706682037edcdd8738c0604945b316eec80453e2961341b03f3184b298deeaf433101019f787809a8e31fcea690dd4be00b8bd3d12aff8c7f01a23c14e2598d8
-  data.tar.gz: 156557c095d90a0a388db3fd9553df20dd8c09a90b216e9eb11c2345e666fe9471471059de89b8753b89e3785697398869c7e017fbe10cbdd91c892e81fd69cf
+  metadata.gz: c471208da108b33687ca99d55a7eba546074d3511807162e28627ae760cdb0d8770c61b6e12d19b54fb18eb17671584094294eb0374514a8d92d4853f93c5189
+  data.tar.gz: fbceed9d826bd79dd7de2c4a60a1bb663830d89d3f9105077ef691d26d98e44879621f22495184d6f794ad92d2a1665f8d6dbb81a60d28b793909ece7d2c2c98

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gems-validator (0.4.3)
+    gems-validator (0.5.8)
 
 GEM
   remote: https://rubygems.org/

data/lib/gems-validator/audit-service.rb

@@ -3,15 +3,18 @@
 module GemsValidator
   class AuditService
     def initialize()
-      @pwd = Dir.pwd
-      system "bundler-audit check --format json --output #{@pwd}/bundler-audit.json"
-      @read_file = read_parsed_file
+      @audit_response = %x[bundle audit check --format json]
+      parse_response()
+
+      @audit_data = {}
+      generate_data()
     end
 
-    def is_a_vulnerable_gem?(gem_name)
-      gem_vulnerabilities = @read_file["results"].select { |item| item["gem"]["name"] == gem_name }
-      unless gem_vulnerabilities.empty?
-        generate_messages(gem_vulnerabilities)
+    def is_a_vulnerable_gem?(gem)
+      name = gem.name
+      version = gem.version
+      unless @audit_data[name].nil?
+        generate_messages(name, version)
       end
     end
 
@@ -21,16 +24,39 @@ module GemsValidator
       translate_default_criticalities[criticality] || 'não definido'
     end
 
-    def generate_messages(gem_vulnerabilities)
-      GemsValidator::OutputMessage.warn("A gem #{gem_vulnerabilities[0]["gem"]["name"]} na versao #{gem_vulnerabilities[0]["gem"]["version"]} apresenta #{gem_vulnerabilities.size} vulnerabilidade#{gem_vulnerabilities.size > 1 ? "s" : ""}")
-      gem_vulnerabilities.map.with_index do |vulnerability, number|
-        GemsValidator::OutputMessage.warn("*   Título: #{vulnerability["advisory"]["title"]} \n                               Nível: #{get_translate_criticality(vulnerability["advisory"]["criticality"])} \n                               URL: #{vulnerability["advisory"]["url"]}")
+    def generate_messages(name, version)
+      GemsValidator::OutputMessage.warn("A gem #{name} na versão #{version} apresenta #{@audit_data[name]["vulnerabilities"].size} vulnerabilidade#{@audit_data[name]["vulnerabilities"].size > 1 ? "s" : ""}")
+      @audit_data[name]["vulnerabilities"].map.with_index do |vulnerability, number|
+        GemsValidator::OutputMessage.warn("*   Título: #{vulnerability[:title]} \n                               Nível: #{get_translate_criticality(vulnerability[:level])} \n                               URL: #{vulnerability[:url]}")
+      end
+    end
+
+    def generate_data()
+
+      @audit_response["results"].map do |audit_item|
+        gem_name = audit_item["gem"]["name"]
+        if (@audit_data[gem_name])
+          @audit_data[gem_name]["vulnerabilities"].push({"title": audit_item["advisory"]["title"], "level": audit_item["advisory"]["criticality"], "url": audit_item["advisory"]["url"]})
+        else
+          @audit_data[gem_name] = {
+            "vulnerabilities" => [
+              {
+                "title": audit_item["advisory"]["title"], 
+                "level": audit_item["advisory"]["criticality"], 
+                "url": audit_item["advisory"]["url"]
+              }
+            ]
+          }
+        end
       end
     end
     
-    def read_parsed_file
-      file = File.read("#{@pwd}/bundler-audit.json")
-      parsed_file = JSON.parse(file)
+    def parse_response()
+      begin
+        @audit_response = JSON.parse(@audit_response)
+      rescue => exception
+        GemsValidator::OutputMessage.error("Erro ao gerar dados de pacotes vulneraveis.")
+      end
     end
   end
 end

data/lib/gems-validator/gems-service.rb

@@ -4,6 +4,7 @@ module GemsValidator
   class GemsService
     def initialize()
       @access_token = get_token
+      @pwd = Dir.pwd
     end
 
     # Response:
@@ -27,7 +28,7 @@ module GemsValidator
     #   }
     # }
     def get_gems()
-      JSON.parse(gems_formatted_request.body)["data"]
+      gems_formatted_request
     end
 
     private
@@ -45,11 +46,23 @@ module GemsValidator
 
     def gems_formatted_request
       uri = URI('http://ec2-54-173-249-114.compute-1.amazonaws.com:3333/gems/formatted')
-      Net::HTTP.start(uri.host, uri.port) do |http|
-        request = Net::HTTP::Get.new uri
-        request["Authorization"] = @access_token
-        http.request request
+      begin
+        Net::HTTP.start(uri.host, uri.port) do |http|
+          request = Net::HTTP::Get.new uri
+          request["Authorization"] = @access_token
+          response = http.request request
+          parse_body = JSON.parse(response.body)["data"]
+          generate_file("#{@pwd}/.euax-homologated-libraries", parse_body.to_json)
+          parse_body
+        end
+      rescue => exception
+        JSON.parse(File.read("#{@pwd}/.euax-homologated-libraries/gems-response.json"))
       end
     end
+
+    def generate_file(base_url, data)
+      Dir.mkdir(base_url) unless File.exists?(base_url)
+      File.write("#{base_url}/gems-response.json", data)
+    end
   end
 end

data/lib/gems-validator/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module GemsValidator
-  VERSION = "0.5.5"
+  VERSION = "0.5.8"
 end

data/lib/gems-validator.rb

@@ -20,7 +20,7 @@ module GemsValidator
 
       Bundler::Plugin.add_hook('before-install') do |gem|
         GemsValidator::Validate.exec(gem)
-        auditService.is_a_vulnerable_gem?(gem.name)
+        auditService.is_a_vulnerable_gem?(gem)
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gems-validator
 version: !ruby/object:Gem::Version
-  version: 0.5.5
+  version: 0.5.8
 platform: ruby
 authors:
 - henriquesml
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-06-24 00:00:00.000000000 Z
+date: 2022-06-27 00:00:00.000000000 Z
 dependencies: []
 description: gems-validator
 email: