mrjoy-bundler-audit 0.1.4 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f3158abba4c10eb30410fb2a42be018476dbe210
-  data.tar.gz: 256bb1a01ddca3973064d3e0f4a1c2091f8daab3
+  metadata.gz: 86bf3607b18010fe5a5a8eea50c278a4972fa133
+  data.tar.gz: bc8390e22500c5f02f45d19f0cfa541d3f1a86bc
 SHA512:
-  metadata.gz: 643fa34a290d6a86bad7beb7586c64b389658d1acbd875b0b64448071ebe957e5b3c652caa437a049215c96d83fdd59195086079332087776eead2a3053f72a0
-  data.tar.gz: 507160bdf0d38683b685802b09e336992d2776dcce1f869fda77e2ed8e5124131a72b1df21e3fac1aa337ad78ea29cec0a741ff6ec021124d664b554c7eab729
+  metadata.gz: abaf90aff0656335877ef86c57058dfbeef7edfc35f2a961531673d2e096f82e3072eba07de2a32bd48e8eb8c1c45d90cb80ce26824e9c787f6df54fcc85d768
+  data.tar.gz: 2a44ca737667dbbbf86435c1a84999ac36f6ad8c45d5c3cdd958d6cba889e678f3fe63aed0bf54d699eb88b8ba0686455497cf0923dc401e5da3fc186ecddb3c

data/.document

@@ -1,3 +1,3 @@
-- 
+-
 ChangeLog.md
 COPYING.txt

data/ChangeLog.md

@@ -1,4 +1,21 @@
-### 0.1.4 / 2013-08-15
+### mrjoy-0.2.1 / 2013-09-13
+
+* Integrate upstream changes from 0.2.0, with local changes from 0.1.4.
+* Make specs automatically refresh `.gitignore`'d `Gemfile.lock` in spec
+  scenarios when the Gemfile has changed in a way that `bundle install` isn't
+  happy about (e.g. version bump on a gem previously listed in the `Gemfile`.)
+
+### 0.2.0 / 2013-03-05
+
+* Require RubyGems >= 1.8.0. Prior versions of RubyGems could not correctly
+  parse approximate version requirements (`~> 1.2.3`).
+* Updated the [ruby-advisory-db].
+* Added {Bundle::Audit::Advisory#unaffected_versions}.
+* Added {Bundle::Audit::Advisory#unaffected?}.
+* Added {Bundle::Audit::Advisory#patched?}.
+* Renamed `Advisory#cve` to {Bundle::Audit::Advisory#id}.
+
+### mrjoy-0.1.4 / 2013-08-15
 
 * RVM compartmentalization for the project (only relevant to people hacking on
   it).
@@ -12,7 +29,7 @@
 * Add ability for individual spec files to be called individually.
 * Rename gem so this can be installed via Rubygems.
 
-### 0.1.3 / 2013-03-05
+### mrjoy-0.1.3 / 2013-03-05
 
 * Require RubyGems >= 1.8.0. Prior versions of RubyGems could not correctly
   parse approximate version requirements (`~> 1.2.3`).

data/README.md

@@ -2,6 +2,7 @@
 
 * [Homepage](https://github.com/MrJoy/mrjoy-bundler-audit#readme)
 * [Issues](https://github.com/MrJoy/mrjoy-bundler-audit/issues)
+* [Documentation](http://rubydoc.info/gems/mrjoy-bundler-audit/frames)
 * [Email](mailto:jfrisby@mrjoy.com)
 * [![Build Status](https://travis-ci.org/MrJoy/mrjoy-bundler-audit.png)](https://travis-ci.org/MrJoy/mrjoy-bundler-audit)
 * [![Code Climate](https://codeclimate.com/github/MrJoy/mrjoy-bundler-audit.png)](https://codeclimate.com/github/MrJoy/mrjoy-bundler-audit)
@@ -13,6 +14,8 @@ Patch-level verification for [Bundler][bundler].
 ## Features
 
 * Checks for vulnerable versions of gems in `Gemfile.lock`.
+* Checks for insecure gem sources (`http://`).
+* Allows ignoring certain advisories that have been manually worked around.
 * Prints advisory information.
 * Does not require a network connection.
 
@@ -21,47 +24,62 @@ Patch-level verification for [Bundler][bundler].
 Audit a projects `Gemfile.lock`:
 
     $ bundle-audit
-    Name: rack
-    Version: 1.4.4
-    CVE: 2013-0263
-    Criticality: High
-    URL: http://osvdb.org/show/osvdb/89939
-    Title: Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution
-    Patched Versions: ~> 1.1.6, ~> 1.2.8, ~> 1.3.10, ~> 1.4.5, >= 1.5.2
-
-    Name: json
-    Version: 1.7.6
-    CVE: 2013-0269
-    Criticality: High
-    URL: http://direct.osvdb.org/show/osvdb/90074
-    Title: Ruby on Rails JSON Gem Arbitrary Symbol Creation Remote DoS
-    Patched Versions: ~> 1.5.4, ~> 1.6.7, >= 1.7.7
-
-    Name: rails
+    Name: actionpack
     Version: 3.2.10
-    CVE: 2013-0155
-    Criticality: High
-    URL: http://osvdb.org/show/osvdb/89025
-    Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
-    Patched Versions: ~> 3.0.19, ~> 3.1.10, >= 3.2.11
-
-    Name: rails
+    Advisory: OSVDB-91452
+    Criticality: Medium
+    URL: http://www.osvdb.org/show/osvdb/91452
+    Title: XSS vulnerability in sanitize_css in Action Pack
+    Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+    
+    Name: actionpack
+    Version: 3.2.10
+    Advisory: OSVDB-91454
+    Criticality: Medium
+    URL: http://osvdb.org/show/osvdb/91454
+    Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails
+    Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+    
+    Name: actionpack
     Version: 3.2.10
-    CVE: 2013-0156
+    Advisory: OSVDB-89026
     Criticality: High
     URL: http://osvdb.org/show/osvdb/89026
-    Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing
-    Remote Code Execution
-    Patched Versions: ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
-
-    Name: rails
+    Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution
+    Solution: upgrade to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
+    
+    Name: activerecord
+    Version: 3.2.10
+    Advisory: OSVDB-91453
+    Criticality: High
+    URL: http://osvdb.org/show/osvdb/91453
+    Title: Symbol DoS vulnerability in Active Record
+    Solution: upgrade to ~> 2.3.18, ~> 3.1.12, >= 3.2.13
+    
+    Name: activerecord
     Version: 3.2.10
-    CVE: 2013-0276
+    Advisory: OSVDB-90072
     Criticality: Medium
     URL: http://direct.osvdb.org/show/osvdb/90072
     Title: Ruby on Rails Active Record attr_protected Method Bypass
-    Patched Versions: ~> 2.3.17, ~> 3.1.11, >= 3.2.12
-
+    Solution: upgrade to ~> 2.3.17, ~> 3.1.11, >= 3.2.12
+    
+    Name: activerecord
+    Version: 3.2.10
+    Advisory: OSVDB-89025
+    Criticality: High
+    URL: http://osvdb.org/show/osvdb/89025
+    Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass
+    Solution: upgrade to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11
+    
+    Name: activesupport
+    Version: 3.2.10
+    Advisory: OSVDB-91451
+    Criticality: High
+    URL: http://www.osvdb.org/show/osvdb/91451
+    Title: XML Parsing Vulnerability affecting JRuby users
+    Solution: upgrade to ~> 3.1.12, >= 3.2.13
+    
     Unpatched versions found!
 
 ## Requirements

data/Rakefile

@@ -23,6 +23,15 @@ require 'rake'
 require 'rubygems/tasks'
 Gem::Tasks.new
 
+desc 'Updates data/ruby-advisory-db'
+task :update do
+  chdir 'data/ruby-advisory-db' do
+    sh 'git', 'pull', 'origin', 'master'
+  end
+
+  sh 'git', 'commit', 'data/ruby-advisory-db', '-m', 'Updated ruby-advisory-db'
+end
+
 require 'rspec/core/rake_task'
 RSpec::Core::RakeTask.new
 
@@ -32,7 +41,15 @@ namespace :spec do
 
     %w[secure unpatched_gems insecure_sources].each do |bundle|
       chdir(File.join(root,bundle)) do
-        sh 'BUNDLE_BIN_PATH="" BUNDLE_GEMFILE="" RUBYOPT="" bundle install --path ../../../vendor/bundle'
+        # rm_f "Gemfile.lock" if(File.exist?("Gemfile.lock"))
+        begin
+          sh 'BUNDLE_BIN_PATH="" BUNDLE_GEMFILE="" RUBYOPT="" bundle install --path ../../../vendor/bundle'
+        rescue
+          if(File.exist?("Gemfile.lock"))
+            puts "Looks like Gemfile may have been updated.  Attempting to update things."
+            sh 'BUNDLE_BIN_PATH="" BUNDLE_GEMFILE="" RUBYOPT="" bundle update'
+          end
+        end
       end
     end
   end
@@ -43,5 +60,5 @@ task :test    => :spec
 task :default => :spec
 
 require 'yard'
-YARD::Rake::YardocTask.new  
+YARD::Rake::YardocTask.new
 task :doc => :yard

data/lib/bundler/audit/advisory.rb

@@ -22,7 +22,7 @@ require 'yaml'
 module Bundler
   module Audit
     class Advisory < Struct.new(:path,
-                                :cve,
+                                :id,
                                 :url,
                                 :title,
                                 :description,
@@ -41,8 +41,8 @@ module Bundler
       # @api semipublic
       #
       def self.load(path)
+        id   = File.basename(path).chomp('.yml')
         data = YAML.load_file(path)
-        cve = data['cve']
 
         unless data.kind_of?(Hash)
           raise("advisory data in #{path.dump} was not a Hash")
@@ -56,7 +56,7 @@ module Bundler
 
         return new(
           path,
-          cve,
+          id,
           data['url'],
           data['title'],
           data['description'],
@@ -127,15 +127,7 @@ module Bundler
         !patched?(version) && !unaffected?(version)
       end
 
-      #
-      # Converts the advisory to a String.
-      #
-      # @return [String]
-      #   The CVE identifier.
-      #
-      def to_s
-        "CVE-#{cve}"
-      end
+      alias to_s id
 
     end
   end

data/lib/bundler/audit/cli.rb

@@ -83,7 +83,7 @@ module Bundler
         say gem.version
 
         say "Advisory: ", :red
-        say "CVE-#{advisory.cve}"
+        say advisory.id
 
         say "Criticality: ", :red
         case advisory.criticality

data/lib/bundler/audit/scanner.rb

@@ -83,7 +83,7 @@ module Bundler
 
         @lockfile.specs.each do |gem|
           @database.check_gem(gem) do |advisory|
-            unless ignore.include?("CVE-#{advisory.cve}")
+            unless ignore.include?(advisory.id)
               yield UnpatchedGem.new(gem,advisory)
             end
           end

data/lib/bundler/audit/version.rb

@@ -20,6 +20,6 @@
 module Bundler
   module Audit
     # bundler-audit version
-    VERSION = '0.1.4'
+    VERSION = '0.2.1'
   end
 end

data/spec/advisory_spec.rb

@@ -5,10 +5,16 @@ require 'bundler/audit/advisory'
 describe Bundler::Audit::Advisory do
   let(:root) { Bundler::Audit::Database::PATH }
   let(:gem)  { 'actionpack' }
-  let(:path) { File.join(root,gem,"OSVDB-89026.yml") }
-  let(:cve)  { YAML.load(File.read(path))['cve'] }
+  let(:id)   { 'OSVDB-84243' }
+  let(:path) { File.join(root,gem,"#{id}.yml") }
   let(:an_unaffected_version) do
-    YAML.load(File.read(path))['unaffected_versions'].first.sub(/^.*?(~>|>=|>|=)\s+/, '')
+    YAML.
+      load(File.read(path))['unaffected_versions'].
+      map { |item| item.split(/\s*,\s*/) }.
+      flatten.
+      select { |ver| ver =~ /^(~>|>=|=|<=)/ }.
+      first.
+      sub(/^.*?(~>|>=|=|<=)\s+/, '')
   end
 
   describe "load" do
@@ -16,7 +22,7 @@ describe Bundler::Audit::Advisory do
 
     subject { described_class.load(path) }
 
-    its(:cve)         { should == cve                 }
+    its(:id)          { should == id                  }
     its(:url)         { should == data['url']         }
     its(:title)       { should == data['title']       }
     its(:cvss_v2)     { should == data['cvss_v2']     }
@@ -58,9 +64,6 @@ describe Bundler::Audit::Advisory do
   end
 
   describe "#unaffected?" do
-    let(:gem)  { 'activerecord' }
-    let(:path) { File.join(root,gem,"OSVDB-82403.yml") }
-
     subject { described_class.load(path) }
 
     context "when passed a version that matches one unaffected version" do
@@ -92,7 +95,7 @@ describe Bundler::Audit::Advisory do
     end
 
     context "when passed a version that matches no patched version" do
-      let(:version) { Gem::Version.new('3.1.9') }
+      let(:version) { Gem::Version.new('2.9.0') }
 
       it "should return false" do
         subject.patched?(version).should be_false
@@ -112,16 +115,13 @@ describe Bundler::Audit::Advisory do
     end
 
     context "when passed a version that matches no patched version" do
-      let(:version) { Gem::Version.new('3.1.9') }
+      let(:version) { Gem::Version.new('2.9.0') }
 
       it "should return true" do
         subject.vulnerable?(version).should be_true
       end
 
       context "when unaffected_versions is not empty" do
-        let(:gem)  { 'activerecord' }
-        let(:path) { File.join(root,gem,"OSVDB-82403.yml") }
-
         subject { described_class.load(path) }
 
         context "when passed a version that matches one unaffected version" do

data/spec/bundle/secure/Gemfile

@@ -1,6 +1,6 @@
 source 'https://rubygems.org'
 
-gem 'rails', '3.2.13'
+gem 'rails', '3.2.14'
 
 # Bundle edge Rails instead:
 # gem 'rails', :git => 'git://github.com/rails/rails.git'

data/spec/integration_spec.rb

@@ -22,7 +22,7 @@ describe "CLI" do
     it "should print advisory information for the vulnerable gems" do
       advisory_pattern = /(Name: [^\n]+
 Version: \d+.\d+.\d+
-Advisory: CVE-\d+-\d+
+Advisory: OSVDB-\d+
 Criticality: (High|Medium)
 URL: http:\/\/(direct|www\.)?osvdb.org\/show\/osvdb\/\d+
 Title: [^\n]*?
@@ -38,7 +38,7 @@ Solution: upgrade to ((~>|=>) \d+.\d+.\d+, )*(~>|=>) \d+.\d+.\d+[\s\n]*?)+/
     let(:directory) { File.join('spec','bundle',bundle) }
 
     let(:command) do
-      File.expand_path(File.join(File.dirname(__FILE__),'..','bin','bundle-audit -i CVE-2013-0156'))
+      File.expand_path(File.join(File.dirname(__FILE__),'..','bin','bundle-audit -i OSVDB-89026'))
     end
 
     subject do
@@ -46,7 +46,7 @@ Solution: upgrade to ((~>|=>) \d+.\d+.\d+, )*(~>|=>) \d+.\d+.\d+[\s\n]*?)+/
     end
 
     it "should not print advisory information for ignored gem" do
-      subject.should_not include("CVE-2013-0156")
+      subject.should_not include("OSVDB-89026")
     end
   end
 

data/spec/scanner_spec.rb

@@ -31,18 +31,18 @@ describe Scanner do
     subject { scanner.scan.to_a }
 
     it "should match unpatched gems to their advisories" do
-      subject[0].gem.name.should == 'actionpack'
-      subject[0].gem.version.to_s.should == '3.2.10'
-      subject[0].advisory.cve.should == '2013-0156'
+      subject.all? { |result|
+        result.advisory.vulnerable?(result.gem.version)
+      }.should be_true
     end
 
     context "when the :ignore option is given" do
-      subject { scanner.scan(:ignore => ['CVE-2013-0156']) }
+      subject { scanner.scan(:ignore => ['OSVDB-89026']) }
 
       it "should ignore the specified advisories" do
-        cves = subject.map { |result| result.advisory.cve }
+        ids = subject.map { |result| result.advisory.id }
 
-        cves.should_not include('2013-0156')
+        ids.should_not include('OSVDB-89026')
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mrjoy-bundler-audit
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.2.1
 platform: ruby
 authors:
 - Postmodern
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-15 00:00:00.000000000 Z
+date: 2013-09-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler