package-audit 0.8.1 → 0.8.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d613e9a49c48ae22ef6e156b7f6a6ba1f2ebe8172e30589cc2eabbb5530bfdc1
-  data.tar.gz: aad9e813b4e6d2b73f15b19626fbc70631312d8965823a27d44cceef4c5115aa
+  metadata.gz: 7e0d76f96e0ad7b87f59b178565e72e9d52dddf9f7a579e016ff6779fac6d58a
+  data.tar.gz: cb917258a2025355d73123cb76762254dd92bdac817c72375e4297fbe8cb6b8f
 SHA512:
-  metadata.gz: e6b3406928eb792637f7fbf5de5745a83ae1ce7181febc24d95882c6e38281002bcb953b3f727e18cf983606285f4df428aa36c203ed874a9d919c47c53dad9f
-  data.tar.gz: c6abc41931c2c26b91443474262353b35a0c64b0d2372258fec255f4f9569c127c3e48a172a219ec1fbd5a71fb7d4e3f15a6bbd6e2f717bb8b65ae0da74ec31f
+  metadata.gz: 280d5c3c95dd19ff526723fb7b9c5b387180c63a67d64eab8be9301512c9b3f5d4e252ba1e82317fb5b95e6f86380908344ea766de9ad4539fecd20afeadd3d7
+  data.tar.gz: '09f40855f0197f00fa9fc05826da2ec42506fef23d387569dd108e4623488eb059982e47d7b0bb99f718de6e62140db3817b119b90aea473cc837a7ad2038b60'

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2023 Vadim Kononov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,218 @@
+# Package::Audit
+
+[![Gem Version](https://img.shields.io/gem/v/package-audit.svg?label=Gem&logo=rubygems&logoColor=white)](https://rubygems.org/gems/package-audit)
+[![Ruby](https://img.shields.io/badge/Ruby-2.6%20to%204.0-CC342D?logo=ruby&logoColor=white)](https://github.com/vkononov/package-audit/blob/main/.github/workflows/test.yml)
+[![Test Matrix](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/test.yml?branch=main&label=Test%20Matrix&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/test.yml)
+[![Lint](https://img.shields.io/github/actions/workflow/status/vkononov/package-audit/lint.yml?branch=main&label=Lint&logo=github)](https://github.com/vkononov/package-audit/actions/workflows/lint.yml)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+A useful tool for patch management and prioritization, `package-audit` produces a list of dependencies that are outdated, deprecated or have security vulnerabilities.
+
+Supports **Ruby 2.6 → latest**, with the full Ruby matrix tested daily in CI.
+
+[!["Buy Me A Coffee"](https://www.buymeacoffee.com/assets/img/custom_images/yellow_img.png)](https://www.buymeacoffee.com/vkononov)
+
+## Supported Technologies
+
+* Ruby
+* Node (using Yarn)
+
+## Report Example
+
+![Example Output](docs/example.png)
+
+### Understanding the Flags Column
+
+The Flags column shows which risk types apply to each package:
+
+- `⦗V··⦘` - Vulnerable (has security vulnerabilities)
+- `⦗·O·⦘` - Outdated (newer version available)
+- `⦗··D⦘` - Deprecated (no updates in 2+ years)
+- `⦗VO·⦘` - Both vulnerable and outdated
+- `⦗VOD⦘` - All three risk types apply
+
+The footer uses the same notation (⦗V⦘ulnerable, ⦗O⦘utdated, ⦗D⦘eprecated) as a legend.
+
+## Continuous Integration
+
+This gem provides a return code of `0` to indicate success and `1` to indicate failure. It is specifically designed for seamless integration into continuous integration pipelines.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'package-audit', require: false
+```
+
+And then execute:
+
+```bash
+bundle
+```
+
+Or install it yourself as:
+
+```bash
+gem install package-audit
+```
+
+## Usage
+
+### Basic Report
+
+Run a full audit (`DIR` defaults to current directory):
+
+```bash
+package-audit [DIR]
+```
+
+### Filtering by Risk Type
+
+Show only specific risk types:
+
+```bash
+# Show only deprecated packages
+package-audit [DIR] --deprecated
+
+# Show only vulnerable packages
+package-audit [DIR] --vulnerable
+
+# Show packages that are deprecated and/or vulnerable
+package-audit [DIR] --deprecated --vulnerable
+```
+
+### Excluding Risk Types
+
+Exclude specific risk types from the report:
+
+```bash
+# Show everything except deprecated packages
+package-audit [DIR] --skip-deprecated
+
+# Show everything except outdated packages
+package-audit [DIR] --skip-outdated
+
+# Show only vulnerable packages (exclude deprecated and outdated)
+package-audit [DIR] --skip-deprecated --skip-outdated
+```
+
+**Important:** Packages with multiple risk types are handled intelligently. For example, a package that is both outdated and vulnerable will still appear when using `--skip-outdated` because it has a vulnerability.
+
+### Understanding the Flags Column
+
+The Flags column in the output shows which risk types apply to each package:
+
+- `⦗V··⦘` - Vulnerable (has security vulnerabilities)
+- `⦗·O·⦘` - Outdated (newer version available)
+- `⦗··D⦘` - Deprecated (no updates in 2+ years)
+- `⦗VO·⦘` - Both vulnerable and outdated
+- `⦗VOD⦘` - All three risk types apply
+
+The footer uses the same notation `⦗V⦘ulnerable, ⦗O⦘utdated, ⦗D⦘eprecated` as a legend.
+
+### Scoping Options
+
+Filter by technology or group:
+
+```bash
+# Specific technologies
+package-audit [DIR] -t node -t ruby
+package-audit [DIR] --technology node --technology ruby
+
+# Specific groups
+package-audit [DIR] -g staging -g production
+package-audit [DIR] --group staging --group production
+```
+
+**Note:** `Package::Audit` will attempt to automatically detect the technologies used by the project.
+
+### Configuration
+
+Use a custom configuration file (see [Configuration File](#configuration-file) for details):
+
+```bash
+package-audit [DIR] --config .package-audit.yml
+```
+
+Include packages normally ignored by configuration:
+
+```bash
+package-audit [DIR] --include-ignored
+```
+
+### Output Formats
+
+```bash
+# CSV format
+package-audit [DIR] --format csv
+
+# Markdown format
+package-audit [DIR] --format md
+```
+
+### Other Commands
+
+```bash
+# Show how risk is calculated
+package-audit risk
+
+# Show version
+package-audit version
+```
+
+### Getting Help
+
+```bash
+package-audit help
+package-audit help [COMMAND]
+```
+
+## Configuration File
+
+The `package-audit` gem automatically searches for `.package-audit.yml` in the current directory or in the specified `DIR` if available. However, you have the option to override the default configuration file location by using the `--config` (or `-c`) flag.
+
+#### Below is an example of a configuration file:
+
+```YAML
+technology:
+  node:
+    nth-check:
+      version: 1.0.2
+      vulnerable: false
+  ruby:
+    devise-async:
+      version: 1.0.0
+      deprecated: false
+    puma:
+      version: 6.3.0
+      deprecated: false
+    selenium-webdriver:
+      version: 4.1.0
+      outdated: false
+```
+
+#### This configuration file allows you to specify the following exclusions:
+
+
+* Ignore all security vulnerabilities associated with `nth-check@1.0.2`.
+* Suppress messages regarding potential deprecations for  `device-async@1.0.0` and `puma@6.3.0`.
+* Disable warnings about newer available versions of  `selenium-webdriver@4.1.0`
+
+**Note:** If the installed package version differs from the expected package version specified in the configuration file, the exclusion settings will not apply to that particular package.
+
+**Note:** If a package is reported for multiple reasons (e.g. vulnerable and outdated), it will still be reported unless the exclusion criteria match every reason for being on the report.
+
+> By design, wildcard (`*`) version exclusions are not supported to prevent developers from inadvertently overlooking crucial messages when packages are updated.
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).

data/lib/package/audit/const/cmd.rb

@@ -6,10 +6,6 @@ module Package
         BUNDLE_AUDIT_JSON = 'bundle-audit check --update --quiet --format json "%s" 2>/dev/null'
 
         NPM_AUDIT = 'npm audit'
-        NPM_AUDIT_JSON = 'npm audit --json'
-
-        YARN_AUDIT = 'yarn audit'
-        YARN_AUDIT_JSON = 'yarn audit --json --cwd "%s"'
       end
     end
   end

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -1,13 +1,18 @@
-require 'open3'
+require 'json'
+require 'net/http'
+require 'openssl'
 
-require_relative '../const/cmd'
+require_relative '../const/file'
 require_relative '../enum/vulnerability_type'
 
 module Package
   module Audit
     module Npm
-      class VulnerabilityFinder
-        AUDIT_ADVISORY_REGEX = /^{"type":"auditAdvisory".*$/
+      class VulnerabilityFinder # rubocop:disable Metrics/ClassLength
+        BULK_ADVISORY_URL = 'https://registry.npmjs.org/-/npm/v1/security/advisories/bulk'
+        BATCH_SIZE = 100
+        TIMEOUT = 30
+        VERSION_LINE = /^\s+"?version"?\s+"([^"]+)"/
 
         def initialize(dir, pkgs)
           @dir = dir
@@ -16,48 +21,142 @@ module Package
         end
 
         def run
-          # Suppress Node.js url.parse deprecation warnings from yarn audit command
-          command = format(Const::Cmd::YARN_AUDIT_JSON, @dir)
-          env_vars = { 'NODE_NO_WARNINGS' => '1' }
+          versions_by_name = collect_versions_by_name
+          return [] if versions_by_name.empty?
 
-          json_string_lines, = Open3.capture3(env_vars, command)
-          array = json_string_lines.scan(AUDIT_ADVISORY_REGEX)
-
-          vulnerability_json_array = JSON.parse("[#{array.join(',')}]", symbolize_names: true)
-          vulnerability_json_array.each do |vulnerability_json|
-            update_meta_data(vulnerability_json)
+          versions_by_name.each_slice(BATCH_SIZE) do |batch|
+            batch_versions = batch.to_h
+            fetch_advisories(batch_versions).each do |name, advisories|
+              package_name = name.to_s
+              apply_advisories(package_name, Array(advisories), batch_versions[package_name] || [])
+            end
           end
+
           @vuln_hash.values
         end
 
         private
 
-        def update_meta_data(json)
-          resolution_path = json.dig(:data, :resolution, :path)
-          return unless resolution_path # Skip if no resolution path (private package)
+        def collect_versions_by_name
+          versions_by_name = {}
+
+          (lockfile_packages + @pkg_hash.values.map { |pkg| [pkg.name, pkg.version] }).each do |name, version|
+            next if version.to_s.empty? || version == 'unknown'
+
+            versions = versions_by_name[name] ||= []
+            versions << version unless versions.include?(version)
+          end
+
+          versions_by_name
+        end
+
+        def lockfile_packages
+          path = "#{@dir}/#{Const::File::YARN_LOCK}"
+          return [] unless File.exist?(path)
+
+          packages = []
+          current_names = []
+          File.foreach(path) do |line|
+            current_names, packages = process_lockfile_line(line, current_names, packages)
+          end
+          packages
+        end
+
+        def process_lockfile_line(line, current_names, packages)
+          if lockfile_key_line?(line)
+            [package_names_from_lock_key(line.strip.chomp(':')), packages]
+          elsif (match = line.match(VERSION_LINE))
+            match_version = match[1]
+            current_names.each { |name| packages << [name, match_version] }
+            [[], packages]
+          else
+            [current_names, packages]
+          end
+        end
 
-          parent_name = resolution_path.split('>').first
-          advisory = json[:data][:advisory]
-          package_info = extract_package_info(advisory)
-          update_vulnerability_info(package_info, parent_name, advisory[:severity])
+        def lockfile_key_line?(line)
+          line.match?(/^\S/) && line.include?('@') && line.strip.end_with?(':')
         end
 
-        def extract_package_info(advisory)
-          {
-            name: advisory[:module_name],
-            version: advisory[:findings][0][:version]
-          }
+        def package_names_from_lock_key(key)
+          key.split(',').map do |entry|
+            package_name_from_spec(entry.strip.gsub(/\A["']|["']\z/, ''))
+          end.uniq
+        end
+
+        def package_name_from_spec(spec)
+          if spec.start_with?('@')
+            "@#{spec.split('@', 3)[1]}"
+          else
+            spec.split('@', 2).first
+          end
+        end
+
+        def fetch_advisories(versions_by_name)
+          uri = URI(BULK_ADVISORY_URL)
+          response = make_request(uri, versions_by_name.to_json)
+          unless response.is_a?(Net::HTTPSuccess)
+            warn "Warning: Unable to fetch npm advisories (#{response.code} #{response.message})."
+            return {}
+          end
+
+          JSON.parse(response.body)
+        rescue StandardError => e
+          warn "Warning: Error while fetching npm advisories: #{e.message}"
+          {}
+        end
+
+        def make_request(uri, body)
+          request = Net::HTTP::Post.new(uri)
+          request['Content-Type'] = 'application/json'
+          request['Accept'] = 'application/json'
+          request.body = body
+          create_http_client(uri).request(request)
+        end
+
+        def create_http_client(uri)
+          Net::HTTP.new(uri.host, uri.port).tap do |http|
+            http.use_ssl = true
+            http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+            http.cert_store = OpenSSL::X509::Store.new
+            http.cert_store.set_default_paths
+            http.read_timeout = TIMEOUT
+            http.open_timeout = TIMEOUT
+          end
+        end
+
+        def apply_advisories(name, advisories, versions)
+          advisories.each do |advisory|
+            Array(versions).each do |version|
+              next unless version_matches?(version, advisory['vulnerable_versions'])
+
+              update_vulnerability_info(name, version, advisory['severity'])
+            end
+          end
+        end
+
+        def version_matches?(version, vulnerable_versions)
+          return true if vulnerable_versions.nil? || vulnerable_versions.empty?
+
+          vulnerable_versions.split(/\s*\|\|\s*/).any? do |range|
+            requirements = range.split(/\s+/).reject(&:empty?)
+            next true if requirements.empty?
+
+            Gem::Requirement.new(*requirements).satisfied_by?(Gem::Version.new(version))
+          rescue ArgumentError
+            true
+          end
         end
 
-        def update_vulnerability_info(package_info, parent_name, severity)
-          name = package_info[:name]
-          version = package_info[:version]
+        def update_vulnerability_info(name, version, severity)
           full_name = "#{name}@#{version}"
           vulnerability = severity || Enum::VulnerabilityType::UNKNOWN
 
           @vuln_hash[full_name] ||= Package.new(name, version, 'node')
-          @vuln_hash[full_name].update vulnerabilities: @vuln_hash[full_name].vulnerabilities + [vulnerability]
-          @vuln_hash[full_name].update groups: @pkg_hash[parent_name]&.groups&.map(&:to_s) || []
+          @vuln_hash[full_name].update(
+            vulnerabilities: @vuln_hash[full_name].vulnerabilities + [vulnerability],
+            groups: @pkg_hash[name]&.groups&.map(&:to_s) || []
+          )
         end
       end
     end

data/lib/package/audit/ruby/gem_meta_data.rb

@@ -226,8 +226,8 @@ module Package
 
         def parse_version_dates(response_body)
           versions = JSON.parse(response_body)
-          versions.each_with_object({}) do |version_info, dates|
-            dates[version_info['number']] = version_info['created_at']
+          versions.to_h do |version_info|
+            [version_info['number'], version_info['created_at']]
           end
         end
 

data/lib/package/audit/services/command_parser.rb

@@ -140,7 +140,7 @@ module Package
         when Enum::Technology::RUBY
           Const::Cmd::BUNDLE_AUDIT
         when Enum::Technology::NODE
-          Const::Cmd::YARN_AUDIT
+          Const::Cmd::NPM_AUDIT
         else
           raise ArgumentError, "Unexpected technology \"#{technology}\" found in #{__method__}"
         end

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.8.1'
+    VERSION = '0.8.2'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.8.1
+  version: 0.8.2
 platform: ruby
 authors:
 - Vadim Kononov
@@ -46,6 +46,9 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE.txt
+- README.md
+- docs/example.png
 - exe/package-audit
 - lib/package/audit/cli.rb
 - lib/package/audit/const/cmd.rb
@@ -111,7 +114,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.10
 specification_version: 4
 summary: A helper tool to find outdated, deprecated and vulnerable dependencies.
 test_files: []