pronto-bundler_audit 0.5.1 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63349abd213ac458a9949296e1ca83d99518cb74dda60eef2c043f49d4020352
-  data.tar.gz: 271978a3b61cd6f9b9cc53bc4610d8226959194539c3087344fe7f37ffb758f5
+  metadata.gz: be60a36fb202bbe2b740917510a6b190658d68791240662551954367515ebd12
+  data.tar.gz: d568065fff3c7b49dbc4f46a19615093bdcc4c13b0f6a067f519afb000d8a896
 SHA512:
-  metadata.gz: cc71c4b6d16ae1d9f3461c4ab03cdda9bbaae9c99b85354e50332f3481e54d2c190ba5880374a6bd6de58dfd7f67eab3ad5bfd1a92b9eee170d81e76c446ba01
-  data.tar.gz: 10bce0f64508e85154408a878449deccbd7176e8cb5b7ed668038b746b998f5e14ab13ed693527f9370fd12bec1a6db95460df8a81fff99f25d8466b580d870b
+  metadata.gz: aa11ae92eb8809537687a93540da7b25fb2fe9cd4940ec625483e2eb10e639b3b0aea994e62f17e0b3128d3b38b54fec1e67ed53f4a33e50e7a6cf5f02c1ab1b
+  data.tar.gz: d33d55ffb3414f7cd0b7bf64b48ea3b439f93b0c5e9954063565bd63a9c863e7bcc509599c84999d11b57a40a7fa5dbbf22880b5109ee8b59584648a40d8e582

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+### 0.6.0 - 2019-11-30
+- [#7](https://github.com/pdobb/pronto-bundler_audit/pull/7) Add configurability via .pronto-bundler_audit.yml file
+  - For now, the only configuration available is ignoring advisories in the bundler_audit scan. See the [README](https://github.com/pdobb/pronto-bundler_audit#configuration).
+
 ### 0.5.1 - 2019-10-24
 - Fix Pronto -> GitHub reporting errors
   - If Gemfile.lock is not in the PR then Pronto would fail when attempting to create a comment on the Gemfile.lock file withing the PR.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    pronto-bundler_audit (0.5.1)
+    pronto-bundler_audit (0.6.0)
       bundler-audit (~> 0)
       pronto (~> 0)
 
@@ -19,7 +19,7 @@ GEM
     byebug (11.0.1)
     coderay (1.1.2)
     docile (1.3.2)
-    faraday (0.17.0)
+    faraday (0.17.1)
       multipart-post (>= 1.2, < 3)
     gitlab (4.12.0)
       httparty (~> 0.14, >= 0.14.0)

data/README.md

@@ -33,15 +33,32 @@ Tested MRI Ruby Versions:
 
 ## Usage
 
-Once installed as a gem, this runner activate automatically when [running Pronto](https://github.com/prontolabs/pronto#usage) -- no configuration is required.
+Once installed as a gem, this runner activates automatically when [running Pronto](https://github.com/prontolabs/pronto#usage) -- no configuration is required.
 
-Note: Unlike most Pronto runners, pronto-bundler_audit will always scan Gemfile.lock whenever Pronto is run. That is, this runner does not only run against patches/diffs made on Gemfile.lock. The point is to find issues/advisories on every Pronto run, not just when Gemfile.lock has been updated. Because that wouldn't really help us find vulnerabilities in a project's gems in a timely fashion.
+Note: Unlike most Pronto runners, pronto-bundler_audit will always scan Gemfile.lock whenever Pronto is run. That is, this runner does not only run against patches/diffs made on Gemfile.lock. The point is to find issues/advisories on every Pronto run, not just when Gemfile.lock has been updated. Because, otherwise, this gem  wouldn't really help us find vulnerabilities in a project's gems in a timely fashion.
 
-### Examples
+## Configuration
 
-#### Local Pronto Run
+Configuration of the pronto-bundler_audit gem is available by creating a YAML file on the project root, called `.pronto-bundler_audit.yml`.
 
-##### Compact Mode
+Available configuration options include:
+
+```yaml
+Advisories:
+  # Send the following advisory names to bundler_audit's `ignored` option.
+  Ignore:
+    - CVE-YYYY-####1
+    - CVE-YYYY-####2
+```
+
+The above acts the same as running `bundle-audit check --ignore CVE-YYYY-####1 CVE-YYYY-####2`.
+
+
+## Examples
+
+### Local Pronto Run
+
+#### Compact Mode
 
 ```bash
 $ pronto run -c=master --runner bundler_audit
@@ -49,7 +66,7 @@ Running Pronto::BundlerAudit
 Gemfile.lock: E: Gem: bootstrap-sass v3.4.0 | Medium Advisory: XSS vulnerability in bootstrap-sass -- CVE-2019-8331 (https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/) | Solution: Upgrade to >= 3.4.1.
 ```
 
-##### Verbose Mode
+#### Verbose Mode
 
 ```bash
 $ pronto run -c=master --runner bundler_audit
@@ -74,11 +91,11 @@ Solution: Upgrade to >= 3.4.1.
 
 #### Github Pull Request - Comments
 
-##### Verbose Mode
+#### Verbose Mode
 
 ![Github Comment - Verbose](images/github-comment-verbose.png)
 
-##### Compact Mode
+#### Compact Mode
 
 Note: Not yet available by configuration.
 

data/lib/formatter/github_pull_request_review_formatter.rb

@@ -3,7 +3,9 @@ module Pronto
     # Pronto::Formatter::GithubPullRequestReviewFormatter comes from the
     # Pronto gem itself.
     #
-    # The methods below are a feature overrides to:
+    # # Note: Ignore `method redefined` warnings on these methods.
+    #
+    # The methods below are feature overrides to:
     #   1. prevent the {#line_number} class from failing if none of the patches
     #      contain the `message.line.new_lineno` value found. Which can happen
     #      in the context of this pronto-bundler audit gem since we aren't

data/lib/pronto/bundler_audit.rb

@@ -17,6 +17,10 @@ module Pronto
   class BundlerAudit < ::Pronto::Runner
     GEMFILE_LOCK_FILENAME = "Gemfile.lock"
 
+    def self.configuration
+      @configuration ||= Pronto::BundlerAudit::Configuration.new
+    end
+
     # @return [Array<Pronto::Message>] one for each issue found
     def run
       results = Auditor.call
@@ -42,6 +46,7 @@ module Pronto
   end
 end
 
+require "pronto/bundler_audit/configuration"
 require "pronto/bundler_audit/version"
 require "pronto/bundler_audit/auditor"
 require "pronto/bundler_audit/results/pronto_messages_adapter"

data/lib/pronto/bundler_audit/configuration.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Pronto
+  class BundlerAudit
+    # Pronto::BundlerAudit::Configuration loads configuration for the
+    # pronto-bundler_audit gem from the `.pronto-bundler_audit.yml` file and
+    # provides service methods for reading configuration settings.
+    class Configuration
+      def initialize(path: ".pronto-bundler_audit.yml")
+        @config_file_path = path
+      end
+
+      # @return [Array<Sring>] the Advisory Names for bundler_audit to ignore
+      def ignored_advisories
+        configuration.dig("Advisories", "Ignore")
+      end
+
+      private
+
+      def configuration
+        @configuration ||=
+          if File.exist?(@config_file_path)
+            YAML.load(configuration_file.read)
+          else
+            {}
+          end
+      end
+
+      def configuration_file
+        File.open(@config_file_path)
+      end
+    end
+  end
+end

data/lib/pronto/bundler_audit/scanner.rb

@@ -2,6 +2,7 @@
 
 require_relative "results/insecure_source"
 require_relative "results/unpatched_gem"
+require "yaml"
 
 module Pronto
   class BundlerAudit
@@ -32,14 +33,19 @@ module Pronto
 
       # Invoke the 3rd-party bundler-audit Gem.
       #
+      # @param ignore_advisories [Array<String>] the advisories to be ignored
+      #   by the bundler_audit scan
+      #
       # @return [Array] if insecure sources are found or if gems with an
       #   advisory are found, the Array will contain
       #   ::Bundler::Audit::Scanner::InsecureSource
       #   or ::Bundler::Audit::Scanner::UnpatchedGem objects, respectively.
       #     - Bundler::Audit::Scanner::InsecureSource = Struct.new(:source)
       #     - Bundler::Audit::Scanner::UnpatchedGem = Struct.new(:gem, :advisory)
-      def run_scanner
-        ::Bundler::Audit::Scanner.new.scan
+      def run_scanner(
+            ignored_advisories:
+              Pronto::BundlerAudit.configuration.ignored_advisories)
+        ::Bundler::Audit::Scanner.new.scan(ignore: ignored_advisories)
       end
 
       # Convert the passed in `scan_result` class/value into a local Results::*

data/lib/pronto/bundler_audit/version.rb

@@ -3,6 +3,6 @@
 module Pronto
   # Pronto::BundlerAuditVersion
   module BundlerAuditVersion
-    VERSION = "0.5.1"
+    VERSION = "0.6.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pronto-bundler_audit
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.6.0
 platform: ruby
 authors:
 - Paul Dobbins
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-10-24 00:00:00.000000000 Z
+date: 2019-11-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -213,6 +213,7 @@ files:
 - lib/pronto/bundler_audit/advisory_formatters/compact.rb
 - lib/pronto/bundler_audit/advisory_formatters/verbose.rb
 - lib/pronto/bundler_audit/auditor.rb
+- lib/pronto/bundler_audit/configuration.rb
 - lib/pronto/bundler_audit/gemfile_lock/scanner.rb
 - lib/pronto/bundler_audit/results/base_result.rb
 - lib/pronto/bundler_audit/results/insecure_source.rb