paraxial 1.0.2 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3849213ba15a24d63699e026fbf59c0c3633d66c2f9c3a20a787ecbb43d6a727
-  data.tar.gz: ea7d9cf3fcd4909b51c98c0922b83e834c7d04a5df204cfc64e44b2701e0eb09
+  metadata.gz: 51fd89540b5bb3bea0b1487cc67e255c6b8597f87215ff70256370a1499b78c9
+  data.tar.gz: 863d248900cb324777b4bfe11dc7bd0dfffd9bc4766642c2d63502b2804fbfe2
 SHA512:
-  metadata.gz: 860660578753aa78749fbadedcf1fc5789bc41ad1d89d1afbf17b60c10dfc6ddc8f6900a082d99b4e915db65e3e99c9c36ee490c05e49853dd681071865546a7
-  data.tar.gz: fb5bfb5f315482914d0fad182489180558be34975f8e1224ce07f906b29ca59c7642d153505b0ec6cb5903e8c7b24e492ca301e91a2015c64b0379ae93d01e8d
+  metadata.gz: 33df2b745e8cc43b41a4bb36cff045039fc8db0d807676d025d38553ecaf39a9f2fde3b26aafe11f12b9ddd1ff5560c18146b7d481a695c14184a6943bbf85cb
+  data.tar.gz: be45476d228f23b7dc49436a97802c284abcaa6561f76ab49b5bfa1a729ecdaefb3d8f84d043737920eb2b72411e40eb84e42eec8eba1e433a0b801dce7f7df9

data/lib/paraxial/cli.rb

@@ -20,13 +20,42 @@ module Paraxial
 
     def scan
       puts "[Paraxial] v#{Paraxial::VERSION} Scan starting..."
-      if check_rubocop_configuration
-        puts '[Paraxial] .rubocop.yml is valid.'
-      else
-        puts '[Paraxial] .rubocop.yml is missing rubocop-erb. To scan embedded Ruby files for security problems, add:'
-        puts '.rubocop.yml'
+
+      case check_rubocop_configuration
+      when :does_not_exist
+        puts '[Paraxial] .paraxial-rubocop.yml does not exist. This file is required for the scan to run, add:'
+        puts '.paraxial-rubocop.yml'
         puts 'require:'
         puts '- rubocop-erb'
+        puts ''
+        exit(1)
+      when :found_no_erb
+        puts '[Paraxial] .paraxial-rubocop.yml is missing rubocop-erb. To scan embedded Ruby files for security problems, add:'
+        puts '.paraxial-rubocop.yml'
+        puts 'require:'
+        puts '- rubocop-erb'
+        puts ''
+      when :found_with_erb
+        puts '[Paraxial] .paraxial-rubocop.yml is valid, .erb files will be scanned.'
+      end
+
+      paraxial_config = get_paraxial_configuration
+
+      if paraxial_config && paraxial_config["ignore-gems"]
+        puts '[Paraxial] .paraxial.yml configuration file found.'
+        puts '[Paraxial] Gems ignored by dependency scan:'
+        puts paraxial_config["ignore-gems"]
+      elsif paraxial_config == :error
+        puts '[Paraxial] .paraxial.yml file is not well formed and is being ignored.'
+        paraxial_config = false
+      elsif paraxial_config
+        puts '[Paraxial] .paraxial.yml does not define a valid configuration. Using default configuration.'
+        paraxial_config = false
+      elsif paraxial_config == false
+        puts '[Paraxial] .paraxial.yml configuration file was not found. Using default configuration.'
+      else
+        puts '[Paraxial] .paraxial.yml configuration is empty. Using default configuration.'
+        paraxial_config = false
       end
 
       if Paraxial::Helpers.get_api_key.nil?
@@ -40,22 +69,29 @@ module Paraxial
         exit_code = options[:exit_code]
 
         cops = 'Paraxial,Security/Eval,Security/IoMethods,Security/JSONLoad,Security/MarshalLoad,Security/Open,Security/YAMLLoad'
+        rubo_config = '--config .paraxial-rubocop.yml'
         if options[:debug_rubocop]
           puts '[Paraxial] rubocop debug enabled'
-          rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json 2>/dev/null`
-          debug_rubocop = `rubocop -d --require paraxial --only #{cops} --disable-pending-cops 2>&1`
+          rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json #{rubo_config} 2>/dev/null`
+          debug_rubocop = `rubocop --debug --require paraxial --only #{cops} --disable-pending-cops #{rubo_config} 2>&1`
           puts debug_rubocop
         else
-          rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json`
+          rubocop = `rubocop --require paraxial --only #{cops} --disable-pending-cops --format json #{rubo_config}`
         end
         lockfile = File.read('./Gemfile.lock')
         api_key = ENV['PARAXIAL_API_KEY']
         uri = URI.parse(Paraxial::Helpers.get_paraxial_url + '/api/ruby_scan')
         headers = { 'Content-Type': 'application/json' }
 
-        body = { rubocop: rubocop, lockfile: lockfile, api_key: api_key, timestamp: Paraxial.get_timestamp }
+        body = { rubocop: rubocop, lockfile: lockfile, api_key: api_key, paraxial_config: paraxial_config, timestamp: Paraxial.get_timestamp }
         response = Net::HTTP.post(uri, body.to_json, headers)
         m = JSON.parse(response.body)
+
+        if m['ok'].nil?
+          puts "[Paraxial] Upload failed, check if PARAXIAL_API_KEY is valid"
+          exit(1)
+        end
+
         findings = m['ok']['findings']
         puts
         puts "[Paraxial] Scan count: #{findings.length}"
@@ -113,18 +149,33 @@ module Paraxial
 
     private
 
+    def get_paraxial_configuration
+      config_file = File.join(Dir.pwd, '.paraxial.yml')
+
+      return false unless File.exist?(config_file)
+
+      begin
+        YAML.load_file(config_file)
+      rescue
+        :error
+      end
+    end
+
     def check_rubocop_configuration
-      rubocop_file = File.join(Dir.pwd, '.rubocop.yml')
+      # return values:
+      # :does_not_exist, :found_no_erb, :found_with_erb
+
+      rubocop_file = File.join(Dir.pwd, '.paraxial-rubocop.yml')
 
-      return false unless File.exist?(rubocop_file)
+      return :does_not_exist unless File.exist?(rubocop_file)
 
       config = YAML.load_file(rubocop_file)
       required_key = 'require'
 
-      if config.is_a?(Hash) && config[required_key].is_a?(Array)
-        config[required_key].include?('rubocop-erb')
+      if config.is_a?(Hash) && config[required_key].is_a?(Array) && config[required_key].include?('rubocop-erb')
+        :found_with_erb
       else
-        false
+        :found_no_erb
       end
     end
   end

data/lib/paraxial/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paraxial
-  VERSION = '1.0.2'
+  VERSION = '1.2.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paraxial
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.2.0
 platform: ruby
 authors:
 - Michael Lubas
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-10-16 00:00:00.000000000 Z
+date: 2024-11-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
@@ -133,7 +133,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.7
+rubygems_version: 3.5.11
 signing_key:
 specification_version: 4
 summary: Paraxial.io Ruby Agent