mrjoy-bundler-audit 0.1.4

data/lib/bundler/audit.rb

@@ -0,0 +1,21 @@
+#
+# Copyright (c) 2013 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Modifications Copyright (c) 2013 Jon Frisby (jfrisby@mrjoy.com), or their
+# respective authors.
+#
+# mrjoy-bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# mrjoy-bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with mrjoy-bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'bundler/audit/database'
+require 'bundler/audit/version'

data/lib/bundler/audit/advisory.rb

@@ -0,0 +1,142 @@
+#
+# Copyright (c) 2013 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Modifications Copyright (c) 2013 Jon Frisby (jfrisby@mrjoy.com), or their
+# respective authors.
+#
+# mrjoy-bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# mrjoy-bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with mrjoy-bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'yaml'
+
+module Bundler
+  module Audit
+    class Advisory < Struct.new(:path,
+                                :cve,
+                                :url,
+                                :title,
+                                :description,
+                                :cvss_v2,
+                                :unaffected_versions,
+                                :patched_versions)
+
+      #
+      # Loads the advisory from a YAML file.
+      #
+      # @param [String] path
+      #   The path to the advisory YAML file.
+      #
+      # @return [Advisory]
+      #
+      # @api semipublic
+      #
+      def self.load(path)
+        data = YAML.load_file(path)
+        cve = data['cve']
+
+        unless data.kind_of?(Hash)
+          raise("advisory data in #{path.dump} was not a Hash")
+        end
+
+        parse_versions = lambda { |versions|
+          Array(versions).map do |version|
+            Gem::Requirement.new(*version.split(', '))
+          end
+        }
+
+        return new(
+          path,
+          cve,
+          data['url'],
+          data['title'],
+          data['description'],
+          data['cvss_v2'],
+          parse_versions[data['unaffected_versions']],
+          parse_versions[data['patched_versions']]
+        )
+      end
+
+      #
+      # Determines how critical the vulnerability is.
+      #
+      # @return [:low, :medium, :high]
+      #   The criticality of the vulnerability based on the CVSSv2 score.
+      #
+      def criticality
+        case cvss_v2
+        when 0.0..3.3  then :low
+        when 3.3..6.6  then :medium
+        when 6.6..10.0 then :high
+        end
+      end
+
+      #
+      # Checks whether the version is not affected by the advisory.
+      #
+      # @param [Gem::Version] version
+      #   The version to compare against {#unaffected_version}.
+      #
+      # @return [Boolean]
+      #   Specifies whether the version is not affected by the advisory.
+      #
+      # @since 0.2.0
+      #
+      def unaffected?(version)
+        unaffected_versions.any? do |unaffected_version|
+          unaffected_version === version
+        end
+      end
+
+      #
+      # Checks whether the version is patched against the advisory.
+      #
+      # @param [Gem::Version] version
+      #   The version to compare against {#patched_version}.
+      #
+      # @return [Boolean]
+      #   Specifies whether the version is patched against the advisory.
+      #
+      # @since 0.2.0
+      #
+      def patched?(version)
+        patched_versions.any? do |patched_version|
+          patched_version === version
+        end
+      end
+
+      #
+      # Checks whether the version is vulnerable to the advisory.
+      #
+      # @param [Gem::Version] version
+      #   The version to compare against {#patched_versions}.
+      #
+      # @return [Boolean]
+      #   Specifies whether the version is vulnerable to the advisory or not.
+      #
+      def vulnerable?(version)
+        !patched?(version) && !unaffected?(version)
+      end
+
+      #
+      # Converts the advisory to a String.
+      #
+      # @return [String]
+      #   The CVE identifier.
+      #
+      def to_s
+        "CVE-#{cve}"
+      end
+
+    end
+  end
+end

data/lib/bundler/audit/cli.rb

@@ -0,0 +1,124 @@
+#
+# Copyright (c) 2013 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Modifications Copyright (c) 2013 Jon Frisby (jfrisby@mrjoy.com), or their
+# respective authors.
+#
+# mrjoy-bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# mrjoy-bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with mrjoy-bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'bundler/audit/scanner'
+require 'bundler/audit/version'
+
+require 'bundler'
+require 'bundler/vendored_thor'
+
+module Bundler
+  module Audit
+    class CLI < Thor
+
+      default_task :check
+      map '--version' => :version
+
+      desc 'check', 'Checks the Gemfile.lock for insecure dependencies'
+      method_option :verbose, :type => :boolean, :aliases => '-v'
+      method_option :ignore, :type => :array, :aliases => '-i'
+
+      def check
+        scanner    = Scanner.new
+        vulnerable = false
+
+        scanner.scan(:ignore => options.ignore) do |result|
+          vulnerable = true
+
+          case result
+          when Scanner::InsecureSource
+            print_warning "Insecure Source URI found: #{result.source}"
+          when Scanner::UnpatchedGem
+            print_advisory result.gem, result.advisory
+          end
+        end
+
+        if vulnerable
+          say "Unpatched versions found!", :red
+          exit 1
+        else
+          say "No unpatched versions found", :green
+        end
+      end
+
+      desc 'version', 'Prints the bundler-audit version'
+      def version
+        database = Database.new
+
+        puts "#{File.basename($0)} #{VERSION} (advisories: #{database.size})"
+      end
+
+      protected
+
+      def say(string="", color=nil)
+        color = nil unless $stdout.tty?
+        super(string, color)
+      end
+
+      def print_warning(message)
+        say message, :yellow
+      end
+
+      def print_advisory(gem, advisory)
+        say "Name: ", :red
+        say gem.name
+
+        say "Version: ", :red
+        say gem.version
+
+        say "Advisory: ", :red
+        say "CVE-#{advisory.cve}"
+
+        say "Criticality: ", :red
+        case advisory.criticality
+        when :low    then say "Low"
+        when :medium then say "Medium", :yellow
+        when :high   then say "High", [:red, :bold]
+        else              say "Unknown"
+        end
+
+        say "URL: ", :red
+        say advisory.url
+
+        if options.verbose?
+          say "Description:", :red
+          say
+
+          print_wrapped advisory.description, :indent => 2
+          say
+        else
+
+          say "Title: ", :red
+          say advisory.title
+        end
+
+        unless advisory.patched_versions.empty?
+          say "Solution: upgrade to ", :red
+          say advisory.patched_versions.join(', ')
+        else
+          say "Solution: ", :red
+          say "remove or disable this gem until a patch is available!", [:red, :bold]
+        end
+
+        say
+      end
+
+    end
+  end
+end

data/lib/bundler/audit/database.rb

@@ -0,0 +1,187 @@
+#
+# Copyright (c) 2013 Hal Brodigan (postmodern.mod3 at gmail.com)
+# Modifications Copyright (c) 2013 Jon Frisby (jfrisby@mrjoy.com), or their
+# respective authors.
+#
+# mrjoy-bundler-audit is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# mrjoy-bundler-audit is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with mrjoy-bundler-audit.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+require 'bundler/audit/advisory'
+
+require 'yaml'
+
+module Bundler
+  module Audit
+    #
+    # Represents the directory of advisories, grouped by gem name
+    # and CVE number.
+    #
+    class Database
+
+      # directory containing advisories
+      PATH =  File.expand_path(File.join(File.dirname(__FILE__),'..','..','..','data','ruby-advisory-db','gems'))
+
+      # The path to the advisory database
+      attr_reader :path
+
+      #
+      # Initializes the Advisory Database.
+      #
+      # @param [String] path
+      #   The path to the advisory database.
+      #
+      # @raise [ArgumentError]
+      #   The path was not a directory.
+      #
+      def initialize(path=PATH)
+        unless File.directory?(path)
+          raise(ArgumentError,"#{path.dump} is not a directory")
+        end
+
+        @path = path
+      end
+
+      #
+      # Enumerates over every advisory in the database.
+      #
+      # @yield [advisory]
+      #   If a block is given, it will be passed each advisory.
+      #
+      # @yieldparam [Advisory] advisory
+      #   An advisory from the database.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def advisories(&block)
+        return enum_for(__method__) unless block_given?
+
+        each_advisory_path do |path|
+          yield Advisory.load(path)
+        end
+      end
+
+      #
+      # Enumerates over advisories for the given gem.
+      #
+      # @param [String] name
+      #   The gem name to lookup.
+      #
+      # @yield [advisory]
+      #   If a block is given, each advisory for the given gem will be yielded.
+      #
+      # @yieldparam [Advisory] advisory
+      #   An advisory for the given gem.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def advisories_for(name)
+        return enum_for(__method__,name) unless block_given?
+
+        each_advisory_path_for(name) do |path|
+          yield Advisory.load(path)
+        end
+      end
+
+      #
+      # Verifies whether the gem is effected by any advisories.
+      #
+      # @param [Gem::Specification] gem
+      #   The gem to verify.
+      #
+      # @yield [advisory]
+      #   If a block is given, it will be passed advisories that effect
+      #   the gem.
+      #
+      # @yieldparam [Advisory] advisory
+      #   An advisory that effects the specific version of the gem.
+      #
+      # @return [Enumerator]
+      #   If no block is given, an Enumerator will be returned.
+      #
+      def check_gem(gem)
+        return enum_for(__method__,gem) unless block_given?
+
+        advisories_for(gem.name) do |advisory|
+          if advisory.vulnerable?(gem.version)
+            yield advisory
+          end
+        end
+      end
+
+      #
+      # The number of advisories within the database.
+      #
+      # @return [Integer]
+      #   The number of advisories.
+      #
+      def size
+        each_advisory_path.count
+      end
+
+      #
+      # Converts the database to a String.
+      #
+      # @return [String]
+      #   The path to the database.
+      #
+      def to_s
+        @path
+      end
+
+      #
+      # Inspects the database.
+      #
+      # @return [String]
+      #   The inspected database.
+      #
+      def inspect
+        "#<#{self.class}:#{self}>"
+      end
+
+      protected
+
+      #
+      # Enumerates over every advisory path in the database.
+      #
+      # @yield [path]
+      #   The given block will be passed each advisory path.
+      #
+      # @yieldparam [String] path
+      #   A path to an advisory `.yml` file.
+      #
+      def each_advisory_path(&block)
+        Dir.glob(File.join(@path,'*','*.yml'),&block)
+      end
+
+      #
+      # Enumerates over the advisories for the given gem.
+      #
+      # @param [String] name
+      #   The gem of the gem.
+      #
+      # @yield [path]
+      #   The given block will be passed each advisory path.
+      #
+      # @yieldparam [String] path
+      #   A path to an advisory `.yml` file.
+      #
+      def each_advisory_path_for(name,&block)
+        Dir.glob(File.join(@path,name,'*.yml'),&block)
+      end
+
+    end
+  end
+end