pronto-bundler_audit 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14598d0b688654057c7bf84f388f5d9881394d916c89e93aabed9f359046fa4e
-  data.tar.gz: aebe7dc2245ad8459e002bb2e2454343bec3c0f6906ce67b97d310dadeb36cca
+  metadata.gz: 2a6328fffd859750def2c69f570ea970ecc44aa1b31362dfa03b5933cde49201
+  data.tar.gz: c6c226e11867996c7d19d53089a31e20b87acaebe3593713f11d310f7e1b602b
 SHA512:
-  metadata.gz: 107cc7d4a03d1db7cca881a5a0e3f8fc63efa57f43aeb328fc65bcd75eb569e89d5a77d5fd968c02b9904fd7983a5430ce5535e1985c566d061883aba0017369
-  data.tar.gz: 3047f3525a76613c0199c05353c4a2342434a07e689c586dfd1586a70c533cd263879567b7ebc8f9549bb70f618a83340014316589f0c3710cff78df50cc9d64
+  metadata.gz: df67a7343d90292e9b15fdfeb6c75eab64b76b27a98ee1feffb3ac9b2c1ef3f0e20822048a595018904d19655c8c82142635644409e01faaee3fa313fccc5826
+  data.tar.gz: 167db3c4bfbd04bec6b25d519f0fd060809de610f899d8e3cc166601baac28ffcc512129ab02496305899df4b7f192fc77a274352f4cc2fcdfcb8f6c846e5edb

data/.rubocop

@@ -0,0 +1,4 @@
+--display-cop-names
+--display-style-guide
+--extra-details
+--format=fuubar

data/.rubocop.yml

@@ -0,0 +1,156 @@
+AllCops:
+  UseCache: true
+  DisplayCopNames: true
+  DisplayStyleGuide: true
+  ExtraDetails: false
+  TargetRubyVersion: 2.5.3
+
+Layout/ClassStructure:
+  Enabled: true
+  Categories:
+    module_inclusion:
+      - extend
+      - include
+      - prepend
+    attributes:
+      - attr_accessor
+      - attr_reader
+      - attr_writer
+  ExpectedOrder:
+    - constants
+    - module_inclusion
+    - attributes
+    - public_class_methods
+    - initializer
+    - public_methods
+    - predicates
+    - protected_methods
+    - private_methods
+
+Layout/DotPosition:
+  EnforcedStyle: trailing
+
+Layout/EmptyLineAfterGuardClause:
+  Enabled: true
+
+Layout/EndOfLine:
+  EnforcedStyle: lf
+
+Layout/IndentFirstArgument:
+  EnforcedStyle: consistent_relative_to_receiver
+
+Layout/IndentFirstArrayElement:
+  EnforcedStyle: consistent
+
+Layout/IndentFirstHashElement:
+  EnforcedStyle: consistent
+
+Layout/MultilineAssignmentLayout:
+  Enabled: true
+
+Layout/MultilineMethodCallBraceLayout:
+  EnforcedStyle: same_line
+
+Layout/MultilineMethodCallIndentation:
+  EnforcedStyle: indented_relative_to_receiver
+
+Layout/MultilineMethodDefinitionBraceLayout:
+  EnforcedStyle: same_line
+
+Layout/MultilineOperationIndentation:
+  Enabled: false # Waiting for e.g. `indented_relative_to_receiver`.
+
+Lint/AmbiguousOperator:
+  Enabled: false # Conflicts with other rules.
+
+Lint/AmbiguousRegexpLiteral:
+  Enabled: false # Conflicts with other rules.
+
+Lint/Void:
+  CheckForMethodsWithNoSideEffects: true
+
+Metrics/BlockLength:
+  ExcludedMethods:
+    - new
+    - describe # Tests
+    - context # Tests
+    - ips # Benchmarking
+
+Metrics/ClassLength:
+  Exclude:
+    - "test/**/*"
+    - "lib/object_inspector/formatters/templating_formatter.rb"
+
+Metrics/LineLength:
+  Max: 80
+  Exclude:
+    - "test/**/*"
+    - "object_inspector.gemspec"
+
+Naming/UncommunicativeMethodParamName:
+  AllowedNames:
+    - a
+    - b
+
+Style/Alias:
+  EnforcedStyle: prefer_alias_method
+
+Style/BlockDelimiters:
+  Enabled: false # Reconsider later.
+
+Style/ClassAndModuleChildren:
+  AutoCorrect: true
+  Exclude:
+    - "test/**/*"
+
+Style/CollectionMethods:
+  Enabled: true
+  PreferredMethods:
+    collect: map
+    collect!: map!
+    find_all: select
+    detect: detect
+    inject: inject
+
+Style/EmptyElse:
+  # It"s helpful to show intent by including a comment in an else block.
+  Enabled: false
+
+Style/EmptyMethod:
+  EnforcedStyle: expanded
+
+Style/ExpandPathArguments:
+  Exclude:
+    - "object_inspector.gemspec"
+
+Style/FormatString:
+  Enabled: false # % notation with an Array just reads better sometimes.
+
+Style/Lambda:
+  EnforcedStyle: literal
+
+Style/NumericPredicate:
+  Enabled: false # Trying to be welcoming to earlier versions of Ruby.
+  # AutoCorrect: true
+
+Style/RegexpLiteral:
+  EnforcedStyle: mixed
+
+Style/RescueStandardError:
+  EnforcedStyle: implicit
+
+Style/ReturnNil:
+  Enabled: true
+
+Style/StringMethods:
+  Enabled: true
+
+Style/SingleLineMethods:
+  Exclude:
+    - "test/**/*_test.rb"
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+### 0.3.0 - 2019-05-03
+- Internal rewrite into smaller objects with full test coverage
+- Switch to using the verbose advisory formatter by default
+
 ### 0.2.1 - 2019-04-30
 - Fix handling of the Pronto::Git::Patches collection in Pronto::BundlerAudit#run
 - Ensure an Array is returned by Pronto::BundlerAudit#run, as expected by Pronto

data/Gemfile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 source "https://rubygems.org"
 
 # Specify your gem's dependencies in pronto-bundler_audit.gemspec

data/Gemfile.lock

@@ -1,14 +1,14 @@
 PATH
   remote: .
   specs:
-    pronto-bundler_audit (0.2.1)
+    pronto-bundler_audit (0.3.0)
       bundler-audit (~> 0)
       pronto (~> 0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.5.2)
+    addressable (2.6.0)
       public_suffix (>= 2.0.2, < 4.0)
     ansi (1.5.0)
     ast (2.4.0)
@@ -29,7 +29,6 @@ GEM
       multi_xml (>= 0.5.2)
     jaro_winkler (1.5.2)
     json (2.2.0)
-    metaclass (0.0.4)
     method_source (0.9.2)
     mime-types (3.2.2)
       mime-types-data (~> 3.2015)
@@ -40,8 +39,7 @@ GEM
       builder
       minitest (>= 5.0)
       ruby-progressbar
-    mocha (1.8.0)
-      metaclass (~> 0.0.1)
+    much-stub (0.1.0)
     multi_xml (0.6.0)
     multipart-post (2.0.0)
     octokit (4.14.0)
@@ -65,7 +63,7 @@ GEM
     public_suffix (3.0.3)
     rainbow (3.0.0)
     rake (12.3.2)
-    rubocop (0.68.0)
+    rubocop (0.68.1)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
       parser (>= 2.5, != 2.5.1.1)
@@ -74,9 +72,9 @@ GEM
       unicode-display_width (>= 1.4.0, < 1.6)
     ruby-progressbar (1.10.0)
     rugged (0.28.1)
-    sawyer (0.8.1)
-      addressable (>= 2.3.5, < 2.6)
-      faraday (~> 0.8, < 1.0)
+    sawyer (0.8.2)
+      addressable (>= 2.3.5)
+      faraday (> 0.8, < 2.0)
     simplecov (0.16.1)
       docile (~> 1.1)
       json (>= 1.8, < 3)
@@ -95,7 +93,7 @@ DEPENDENCIES
   byebug (~> 11)
   minitest (~> 5)
   minitest-reporters (~> 1)
-  mocha (~> 1)
+  much-stub (~> 0)
   pronto-bundler_audit!
   pry (~> 0)
   pry-byebug (~> 3)

data/README.md

@@ -64,7 +64,6 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## TODO
 
-* Add more tests
 * Add configuration for compact vs expanded advisories reporting
 
 ## Contributing

data/Rakefile

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "bundler/gem_tasks"
 require "rake/testtask"
 
@@ -7,4 +9,4 @@ Rake::TestTask.new(:test) do |t|
   t.test_files = FileList["test/**/*_test.rb"]
 end
 
-task :default => :test
+task default: :test

data/bin/console

@@ -1,4 +1,5 @@
 #!/usr/bin/env ruby
+# frozen_string_literal: true
 
 require "bundler/setup"
 require "pronto/bundler_audit"

data/lib/pronto/bundler_audit/advisory_formatters/base_advisory_formatter.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+module Pronto
+  class BundlerAudit
+    module AdvisoryFormatters
+      # Pronto::BundlerAudit::AdvisoryFormatters::BaseAdvisoryFormatter is an
+      # abstract base class for formatting Bundler::Audit::Advisory objects
+      # as a String in the context of the given `gem`
+      # (Bundler::LazySpecification).
+      class BaseAdvisoryFormatter
+        # param gem [Bundler::LazySpecification]
+        # param advisory [Bundler::Audit::Advisory]
+        def initialize(gem:, advisory:)
+          @gem = gem
+          @advisory = advisory
+        end
+
+        def to_s
+          raise NotImplementedError
+        end
+
+        private
+
+        def gem_name
+          @gem.name
+        end
+
+        def gem_version
+          @gem.version
+        end
+
+        def advisory_description
+          if @advisory.cve
+            "CVE-#{@advisory.cve}"
+          elsif @advisory.osvdb
+            @advisory.osvdb
+          end
+        end
+
+        def advisory_criticality
+          str = @advisory.criticality.to_s.capitalize
+          str = "Unknown" if str.empty?
+          str
+        end
+
+        def advisory_url
+          @advisory.url
+        end
+
+        def advisory_title
+          @advisory.title
+        end
+
+        def advisory_solution
+          if any_patched_versions?
+            "Upgrade to #{patched_versions}."
+          else
+            "Remove or disable this gem until a patch is available!"
+          end
+        end
+
+        def patched_versions
+          @advisory.patched_versions.join(", ")
+        end
+
+        def any_patched_versions?
+          !@advisory.patched_versions.empty?
+        end
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/advisory_formatters/compact.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative "base_advisory_formatter"
+
+module Pronto
+  class BundlerAudit
+    module AdvisoryFormatters
+      # Pronto::BundlerAudit::AdvisoryFormatters::Compact is a compact message
+      # formatter for the given gem object and Bundler::Audit::Advisory#advisory
+      # object.
+      class Compact < BaseAdvisoryFormatter
+        def to_s
+          [
+            "Gem: #{gem_name} v#{gem_version}",
+            "#{advisory_criticality} Advisory: #{advisory_title} -- "\
+              "#{advisory_description} (#{advisory_url})",
+            "Solution: #{advisory_solution}"
+          ].join(" | ")
+        end
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/advisory_formatters/verbose.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative "base_advisory_formatter"
+
+module Pronto
+  class BundlerAudit
+    module AdvisoryFormatters
+      # Pronto::BundlerAudit::AdvisoryFormatters::Verbose is a verbose message
+      # formatter for the given gem object and Bundler::Audit::Advisory#advisory
+      # object.
+      class Verbose < BaseAdvisoryFormatter
+        def to_s
+          [
+            "Name: #{gem_name}",
+            "Version: #{gem_version}",
+            "Advisory: #{advisory_description}",
+            "Criticality: #{advisory_criticality}",
+            "URL: #{advisory_url}",
+            "Title: #{advisory_title}",
+            "Solution: #{advisory_solution}"
+          ].join("\n")
+        end
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/auditor.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "pronto/bundler_audit/scanner"
+
+module Pronto
+  class BundlerAudit
+    # Pronto::BundlerAudit::Auditor:
+    # 1. updates the local ruby security database, and then
+    # 2. runs {Pronto::BundlerAudit::Scanner#call} on the given `patch`.
+    class Auditor
+      def initialize(patch)
+        @patch = patch
+      end
+
+      # @return (see: #run_scan)
+      def call
+        update_ruby_advisory_db
+        run_scanner
+      end
+
+      private
+
+      def update_ruby_advisory_db
+        Bundler::Audit::Database.update!(quiet: true)
+      end
+
+      # @return [Array>] if no advisories were found
+      # @return [Array<Pronto::Message>] if advisories were found
+      def run_scanner
+        scanner = Scanner.new(@patch)
+        scanner.call
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/results/base_result.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Pronto
+  class BundlerAudit
+    module Results
+      # Pronto::BundlerAudit::Results::BaseResult is an abstract base class for
+      # the various Bundler::Audit::Scanner::* issue types.
+      class BaseResult
+        def initialize(scan_result)
+          @scan_result = scan_result
+          @gem = scan_result.gem
+          @advisory = scan_result.advisory
+        end
+
+        def call
+          report_result
+        end
+
+        private
+
+        def report_result
+          raise NotImplementedError
+        end
+
+        def build_message(message, level:, line:)
+          Message.new(
+            GEMFILE_LOCK_FILENAME,
+            line,
+            level,
+            message,
+            nil,
+            Pronto::BundlerAudit)
+        end
+
+        def message
+          raise NotImplementedError
+        end
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/results/insecure_source.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require_relative "base_result"
+
+module Pronto
+  class BundlerAudit
+    module Results
+      # Pronto::BundlerAudit::Results::InsecureSource builds a Pronto::Message
+      # for Bundler::Audit::Scanner::InsecureSource issues.
+      class InsecureSource < BaseResult
+        private
+
+        def report_result
+          build_message(
+            message,
+            line: nil,
+            level: :warning)
+        end
+
+        def message
+          "Insecure Source URI found: #{@scan_result.source}"
+        end
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/results/unpatched_gem.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require_relative "base_result"
+require "pronto/bundler_audit/advisory_formatters/verbose"
+require "pronto/bundler_audit/advisory_formatters/compact"
+
+module Pronto
+  class BundlerAudit
+    module Results
+      # Pronto::BundlerAudit::Results::UnpatchedGem builds a Pronto::Message for
+      # Bundler::Audit::Scanner::UnpatchedGem issues.
+      class UnpatchedGem < BaseResult
+        def initialize(scan_result, patch:)
+          super(scan_result)
+          @patch = patch
+        end
+
+        private
+
+        def report_result
+          build_message(
+            message,
+            level: :error,
+            line: find_relevant_line)
+        end
+
+        # @return [Pronto::Git::Line]
+        def find_relevant_line
+          first_added_line_for_affected_gem_name(@gem.name)
+        end
+
+        # @return [Pronto::Git::Line]
+        def first_added_line_for_affected_gem_name(gem_name)
+          @patch.added_lines.detect { |line| line.content.include?(gem_name) }
+        end
+
+        def message
+          advisory_formatter.to_s
+        end
+
+        def advisory_formatter
+          # TODO: Switch type based on configuration options, once available.
+          AdvisoryFormatters::Verbose.new(gem: @gem, advisory: @advisory)
+        end
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/scanner.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "results/insecure_source"
+require_relative "results/unpatched_gem"
+
+module Pronto
+  class BundlerAudit
+    # Pronto::BundlerAudit::Scanner runs runs Bundler::Audit::Scanner#scan on
+    # the given patch and then calls a {Pronto::BundlerAudit::BaseResult} based
+    # for each scan result.
+    class Scanner
+      def initialize(patch)
+        @patch = patch
+      end
+
+      # @return [Array>] if no advisories were found
+      # @return [Array<Pronto::Message>] if advisories were found)
+      def call
+        run_scan
+      end
+
+      private
+
+      def run_scan
+        run_scanner.map do |scan_result|
+          match_result(scan_result).call
+        end
+      end
+
+      def run_scanner
+        Bundler::Audit::Scanner.new.scan
+      end
+
+      def match_result(scan_result)
+        case scan_result
+        when Bundler::Audit::Scanner::InsecureSource
+          Results::InsecureSource.new(scan_result, patch: @patch)
+        when Bundler::Audit::Scanner::UnpatchedGem
+          Results::UnpatchedGem.new(scan_result, patch: @patch)
+        else
+          raise ArgumentError, "Unexpected type: #{scan_result.class}"
+        end
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/version.rb

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 module Pronto
   # Pronto::BundlerAuditVersion
   module BundlerAuditVersion
-    VERSION = "0.2.1"
+    VERSION = "0.3.0"
   end
 end

data/lib/pronto/bundler_audit.rb

@@ -1,8 +1,8 @@
+# frozen_string_literal: true
+
 require "pronto"
 require "bundler/audit/database"
 require "bundler/audit/scanner"
-require "pronto/bundler_audit/version"
-require "pronto/bundler_audit/patch_handler"
 
 module Pronto
   # Pronto::BundlerAudit is a Pronto::Runner that:
@@ -12,13 +12,13 @@ module Pronto
   # 3. Runs bundle-audit to scan the Gemfile.lock
   # 4. Returns an Array of Pronto::Message objects if any advisories are found
   class BundlerAudit < Runner
-    GEMFILE_LOCK_FILENAME = "Gemfile.lock".freeze
+    GEMFILE_LOCK_FILENAME = "Gemfile.lock"
 
     # @return [Array] per Pronto expectation
     def run
       if (patch = find_relevant_patch)
-        patch_handler = PatchHandler.new(patch, runner: self)
-        patch_handler.call
+        auditor = Auditor.new(patch)
+        auditor.call
       else
         []
       end
@@ -38,3 +38,6 @@ module Pronto
     end
   end
 end
+
+require "pronto/bundler_audit/version"
+require "pronto/bundler_audit/auditor"

data/pronto-bundler_audit.gemspec

@@ -1,4 +1,6 @@
-lib = File.expand_path("../lib", __FILE__)
+# frozen_string_literal: true
+
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require "pronto/bundler_audit/version"
 
@@ -8,40 +10,31 @@ Gem::Specification.new do |spec|
   spec.authors       = ["Paul Dobbins"]
   spec.email         = ["paul.dobbins@icloud.com"]
 
-  spec.summary       = %q{Pronto runner for bundler-audit, patch-level verification for bundler.}
+  spec.summary       =
+    "Pronto runner for bundler-audit, patch-level verification for bundler."
   spec.homepage      = "http://github.com/pdobb/pronto-bundler_audit"
   spec.license       = "MIT"
 
-  # Prevent pushing this gem to RubyGems.org. To allow pushes either set the 'allowed_push_host'
-  # to allow pushing to a single host or delete this section to allow pushing to any host.
-  # if spec.respond_to?(:metadata)
-  #   spec.metadata["allowed_push_host"] = "TODO: Set to 'http://mygemserver.com'"
-
-  #   spec.metadata["homepage_uri"] = spec.homepage
-  #   spec.metadata["source_code_uri"] = "https://github.com/pdobb/pronto-bundler_audit"
-  #   spec.metadata["changelog_uri"] = "https://github.com/pdobb/pronto-bundler_audit/blob/master/CHANGELOG.md"
-  # else
-  #   raise "RubyGems 2.0 or newer is required to protect against " \
-  #     "public gem pushes."
-  # end
-
   # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files         = Dir.chdir(File.expand_path('..', __FILE__)) do
-    `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  # The `git ls-files -z` loads the files in the RubyGem that have been added
+  # into git.
+  spec.files         = Dir.chdir(File.expand_path(__dir__)) do
+    `git ls-files -z`.split("\x0").reject { |f|
+      f.match(%r{^(test|spec|features)/})
+    }
   end
   spec.bindir        = "exe"
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency "pronto", "~> 0"
   spec.add_runtime_dependency "bundler-audit", "~> 0"
+  spec.add_runtime_dependency "pronto", "~> 0"
 
   spec.add_development_dependency "bundler", "~> 2"
   spec.add_development_dependency "byebug", "~> 11"
   spec.add_development_dependency "minitest", "~> 5"
   spec.add_development_dependency "minitest-reporters", "~> 1"
-  spec.add_development_dependency "mocha", "~> 1"
+  spec.add_development_dependency "much-stub", "~> 0"
   spec.add_development_dependency "pry", "~> 0"
   spec.add_development_dependency "pry-byebug", "~> 3"
   spec.add_development_dependency "rake", "~> 12"

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: pronto-bundler_audit
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Paul Dobbins
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-04-30 00:00:00.000000000 Z
+date: 2019-05-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: pronto
+  name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -25,7 +25,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: bundler-audit
+  name: pronto
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -95,19 +95,19 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1'
 - !ruby/object:Gem::Dependency
-  name: mocha
+  name: much-stub
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: pry
   requirement: !ruby/object:Gem::Requirement
@@ -192,6 +192,8 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
+- ".rubocop"
+- ".rubocop.yml"
 - ".travis.yml"
 - CHANGELOG.md
 - Gemfile
@@ -204,7 +206,14 @@ files:
 - images/github-check.png
 - images/github-comment.png
 - lib/pronto/bundler_audit.rb
-- lib/pronto/bundler_audit/patch_handler.rb
+- lib/pronto/bundler_audit/advisory_formatters/base_advisory_formatter.rb
+- lib/pronto/bundler_audit/advisory_formatters/compact.rb
+- lib/pronto/bundler_audit/advisory_formatters/verbose.rb
+- lib/pronto/bundler_audit/auditor.rb
+- lib/pronto/bundler_audit/results/base_result.rb
+- lib/pronto/bundler_audit/results/insecure_source.rb
+- lib/pronto/bundler_audit/results/unpatched_gem.rb
+- lib/pronto/bundler_audit/scanner.rb
 - lib/pronto/bundler_audit/version.rb
 - pronto-bundler_audit.gemspec
 homepage: http://github.com/pdobb/pronto-bundler_audit

data/lib/pronto/bundler_audit/patch_handler.rb

@@ -1,165 +0,0 @@
-module Pronto
-  class BundlerAudit < Runner
-    # Pronto::BundlerAudit::PatchHandler runs Bundle Audit on the given patch
-    # and returns an Array of Pronto::Message objects if any advisories are
-    # found.
-    class PatchHandler
-      def initialize(patch, runner:)
-        @patch = patch
-        @runner = runner
-      end
-
-      # @return (see: #run_scan)
-      def call
-        update_ruby_advisory_db
-        run_scan
-      end
-
-      private
-
-      def update_ruby_advisory_db
-        Bundler::Audit::Database.update!(quiet: true)
-      end
-
-      # @return [Array>] if no advisories were found
-      # @return [Array<Pronto::Message>] if advisories were found
-      def run_scan
-        scanner = Bundler::Audit::Scanner.new
-
-        scanner.scan.inject([]) do |acc, scan_result|
-          acc << process_scan_result(scan_result)
-        end
-      end
-
-      def process_scan_result(scan_result)
-        case scan_result
-        when Bundler::Audit::Scanner::InsecureSource
-          report_insecure_source_scan_result
-        when Bundler::Audit::Scanner::UnpatchedGem
-          report_unpatched_gem_scan_result(scan_result)
-        else
-          raise ArgumentError, "unexpected type: #{scan_result.class}"
-        end
-      end
-
-      def report_insecure_source_scan_result(scan_result)
-        build_warning_message(
-          "Insecure Source URI found: #{scan_result.source}")
-      end
-
-      def report_unpatched_gem_scan_result(scan_result)
-        advisory =
-          AdvisoryFormatter.new(
-            gem: scan_result.gem, advisory: scan_result.advisory)
-        message = advisory.to_compact_s
-        line = find_relevant_line(advisory)
-
-        build_error_message(message, line: line)
-      end
-
-      # @return [Pronto::Git::Line]
-      def find_relevant_line(advisory)
-        first_added_line_for_affected_gem_name(advisory.gem_name)
-      end
-
-      # @return [Pronto::Git::Line]
-      def first_added_line_for_affected_gem_name(gem_name)
-        @patch.added_lines.detect { |line| line.content.include?(gem_name) }
-      end
-
-      def build_warning_message(message)
-        build_message(message, level: :warning)
-      end
-
-      def build_error_message(message, line:)
-        build_message(message, level: :error, line: line)
-      end
-
-      def build_message(message, level:, line:)
-        Message.new(
-          GEMFILE_LOCK_FILENAME, line, level, message, nil, @runner.class)
-      end
-
-      # Pronto::BundlerAudit::PatchHandler::AdvisoryFormatter is a message
-      # formatter for the given gem object and Bundler::Audit::Advisory#advisory
-      # object.
-      class AdvisoryFormatter
-        # param gem [Bundler::LazySpecification]
-        # param advisory [Bundler::Audit::Advisory]
-        def initialize(gem:, advisory:)
-          @gem = gem
-          @advisory = advisory
-        end
-
-        def to_s
-          [
-            "Name: #{gem_name}",
-            "Version: #{gem_version}",
-            "Advisory: #{advisory_description}",
-            "Criticality: #{advisory_criticality}",
-            "URL: #{advisory_url}",
-            "Title: #{advisory_title}",
-            "Solution: #{advisory_solution}"
-          ].join("\n")
-        end
-
-        def to_compact_s
-          [
-            "Gem: #{gem_name} v#{gem_version}",
-            "#{advisory_criticality} Advisory: #{advisory_title} -- "\
-              "#{advisory_description} (#{advisory_url})",
-            "Solution: #{advisory_solution}"
-          ].join(" | ")
-        end
-
-        def gem_name
-          @gem.name
-        end
-
-        private
-
-        def gem_version
-          @gem.version
-        end
-
-        def advisory_description
-          if @advisory.cve
-            "CVE-#{@advisory.cve}"
-          elsif @advisory.osvdb
-            @advisory.osvdb
-          end
-        end
-
-        def advisory_criticality
-          str = @advisory.criticality.to_s.capitalize
-          str = "Unknown" if str.empty?
-          str
-        end
-
-        def advisory_url
-          @advisory.url
-        end
-
-        def advisory_title
-          @advisory.title
-        end
-
-        def advisory_solution
-          if any_patched_versions?
-            "Upgrade to #{patched_versions}."
-          else
-            "Remove or disable this gem until a patch is available!"
-          end
-        end
-
-        def patched_versions
-          @advisory.patched_versions.join(', ')
-        end
-
-        def any_patched_versions?
-          !@advisory.patched_versions.empty?
-        end
-      end
-    end
-  end
-end