package-audit 0.7.0 → 0.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 117d0d8171512241e50a454b4d20a7282406719ad0a64f0805588152e24afd35
-  data.tar.gz: 11c35e745e5a07ba2321cd8c301136e45e5daf3a1a03ab07d63cb5de7b860099
+  metadata.gz: a14d75d3c6f64af8c327c492e0d0c1bcf98fc3119964e63d944fc33fc6ce6b8e
+  data.tar.gz: 01f5eaac43d53a65ac42a46a736793b8dbe56f4ad3531a8e649d9516b85a5027
 SHA512:
-  metadata.gz: f1a2add78503fbbba1af45a7e311a69b9cc5e1e17de4bff0e3707267a988ec65697b8a6cf1aab996be67ca6629939555dcfc1728ba9fd16afb524ef8b7083f8a
-  data.tar.gz: 4ff3cdd346772bc543ea0aa5b57bdb1eb6c983a1a2fdc43c78b29f9b029e3615b91c44b0caf6df3a68cd0ee0c6da64acfc6083b2ac023464f74e9fad226be41f
+  metadata.gz: 9f2599769354017f84a5eb4f5da8cb6b67b69be12ed6f67126ed0701b1746461960c24ecd1ba7d2cf81d5719ca18234f1f9bdcb645a5bb9d8916faaca040ee96
+  data.tar.gz: 9eeeb933dd6e5535c0fdcdfca6fea339ca34fc1a611460b68ea0274da083ec08be63424eb82c7229ed939cf05fe49621bbf9f4d04af9abffc6001f7a43e507cb

data/lib/package/audit/npm/npm_meta_data.rb

@@ -1,5 +1,6 @@
 require 'json'
 require 'net/http'
+require 'openssl'
 require 'socket'
 
 module Package
@@ -50,7 +51,7 @@ module Package
           handle_error(package, e, network_errors)
         end
 
-        def make_request_with_retry(package_name, retry_count)
+        def make_request_with_retry(package_name, retry_count) # rubocop:disable Metrics/MethodLength
           response = make_request(package_name)
           return nil if response.is_a?(Net::HTTPNotFound) # Skip 404s - likely private packages
 
@@ -58,12 +59,15 @@ module Package
             response.is_a?(Net::HTTPSuccess)
 
           response
-        rescue Net::OpenTimeout, Net::ReadTimeout, SocketError, Errno::ECONNREFUSED, Errno::EHOSTUNREACH
+        rescue Net::OpenTimeout, Net::ReadTimeout, SocketError, Errno::ECONNREFUSED, Errno::EHOSTUNREACH => e
           return nil if retry_count >= MAX_RETRIES
 
           retry_after_delay(retry_count)
           retry_count += 1
           retry
+        rescue OpenSSL::SSL::SSLError => e
+          warn "Warning: SSL verification failed for #{package_name}: #{e.message}"
+          nil
         end
 
         def handle_error(package, error, network_errors)
@@ -79,6 +83,8 @@ module Package
           http = Net::HTTP.new(uri.host, uri.port)
           http.use_ssl = true
           http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+          http.cert_store = OpenSSL::X509::Store.new
+          http.cert_store.set_default_paths
           http.read_timeout = TIMEOUT
           http.open_timeout = TIMEOUT
 

data/lib/package/audit/ruby/gem_meta_data.rb

@@ -1,4 +1,5 @@
 require_relative '../models/package'
+require 'openssl'
 
 module Package
   module Audit
@@ -170,15 +171,24 @@ module Package
           }
         end
 
-        def fetch_gem_version_dates(gem_name)
+        def fetch_gem_version_dates(gem_name) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
           uri = build_api_uri(gem_name)
           response = make_http_request(uri)
 
           return nil unless success_response?(response)
 
           parse_version_dates(response.body)
+        rescue Net::OpenTimeout, Net::ReadTimeout => e
+          log_api_error(gem_name, "Network timeout: #{e.message}") if debug_mode?
+          nil
+        rescue OpenSSL::SSL::SSLError => e
+          log_api_error(gem_name, "SSL verification failed: #{e.message}") if debug_mode?
+          nil
+        rescue SocketError, Errno::ECONNREFUSED => e
+          log_api_error(gem_name, "Network error: #{e.message}") if debug_mode?
+          nil
         rescue StandardError => e
-          log_api_error(gem_name, e) if debug_mode?
+          log_api_error(gem_name, e.message) if debug_mode?
           nil
         end
 
@@ -206,6 +216,9 @@ module Package
         def create_http_client(uri)
           Net::HTTP.new(uri.host, uri.port).tap do |http|
             http.use_ssl = true
+            http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+            http.cert_store = OpenSSL::X509::Store.new
+            http.cert_store.set_default_paths
             http.read_timeout = HTTP_READ_TIMEOUT
             http.open_timeout = HTTP_OPEN_TIMEOUT
           end

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.7.0'
+    VERSION = '0.7.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.7.1
 platform: ruby
 authors:
 - Vadim Kononov
@@ -111,7 +111,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 3.6.9
 specification_version: 4
 summary: A helper tool to find outdated, deprecated and vulnerable dependencies.
 test_files: []