pronto-railroader 0.10.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 9c0368e4b5e011c56731778036ec0e4d512d799c0cbdbb0113740e95326b28e3
+  data.tar.gz: b98f1aecc1cda4c921fb1f767d81257f5979615b7eb93f7489dd41d0c07e5c5a
+SHA512:
+  metadata.gz: 898fa0ee493290b9ac085fa82e1c82156147a8f1fb0ffd702bba8bcefa97140da7f7ed76e0e6c95fbfca5158c66cd8e2fbb6439e713c47a94a49a46000d359f6
+  data.tar.gz: 7bf74244bf678258bec45f5623ecf348eef371c10f103c7f3f8cad559110d6d6cf470a0d2fb28affe3aa44e3c830ca7ef38983b66e1d4a1541238331ec8ef3cf

data/LICENSE

@@ -0,0 +1,22 @@
+The MIT License
+
+Copyright (c) 2017 Mindaugas Mozūras, David A. Wheeler, and
+the Railroader contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,20 @@
+# Pronto runner for Railroader
+
+[![Code Climate](https://codeclimate.com/github/prontolabs/pronto-railroader.png)](https://codeclimate.com/github/prontolabs/pronto-railroader)
+[![Build Status](https://travis-ci.org/prontolabs/pronto-railroader.png)](https://travis-ci.org/prontolabs/pronto-railroader)
+[![Gem Version](https://badge.fury.io/rb/pronto-railroader.png)](http://badge.fury.io/rb/pronto-railroader)
+<!-- [![Dependency Status](https://gemnasium.com/prontolabs/pronto-railroader.png)](https://gemnasium.com/prontolabs/pronto-railroader) -->
+
+Pronto runner for [Railroader](https://github.com/presidentbeef/railroader), security vulnerability scanner for Ruby on Rails (RoR). [What is Pronto?](https://github.com/prontolabs/pronto)
+
+## Severity mapping
+
+Railroader [Confidence](https://github.com/presidentbeef/railroader#confidence-levels) is mapped to severity levels on the
+messages generated by Pronto. High confidence maps to fatal, medium confidence maps to warning, and low confidence maps
+to info.
+
+## History
+
+Note that Railroader is open source software (OSS) and is a project fork of Brakeman.  This gem, pronto-railroader, is a fork of pronto-brakeman.
+
+If you want a pronto service for Brakeman, use pronto-brakeman instead.

data/lib/pronto/railroader.rb

@@ -0,0 +1,58 @@
+require 'pronto'
+require 'railroader'
+
+module Pronto
+  class Railroader < Runner
+    def run
+      files = ruby_patches.map do |patch|
+        patch.new_file_full_path.relative_path_from(repo_path).to_s
+      end
+
+      return [] unless files.any?
+
+      output = ::Railroader.run(app_path: repo_path,
+                              output_formats: [:to_s],
+                              only_files: files)
+      messages_for(ruby_patches, output).compact
+    rescue ::Railroader::NoApplication
+      []
+    end
+
+    def messages_for(ruby_patches, output)
+      output.filtered_warnings.map do |warning|
+        patch = patch_for_warning(ruby_patches, warning)
+
+        next unless patch
+        line = patch.added_lines.find do |added_line|
+          added_line.new_lineno == warning.line
+        end
+
+        new_message(line, warning) if line
+      end
+    end
+
+    def new_message(line, warning)
+      Message.new(line.patch.delta.new_file[:path], line,
+                  severity_for_confidence(warning.confidence),
+                  "Possible security vulnerability: #{warning.message}",
+                  nil, self.class)
+    end
+
+    def severity_for_confidence(confidence_level)
+      case confidence_level
+      when 0 # Railroader High confidence
+        :fatal
+      when 1 # Railroader Medium confidence
+        :warning
+      else # Railroader Low confidence (and other possibilities)
+        :info
+      end
+    end
+
+    def patch_for_warning(ruby_patches, warning)
+      ruby_patches.find do |patch|
+        patch.new_file_full_path.to_s == warning.file
+      end
+    end
+  end
+end

data/lib/pronto/railroader/version.rb

@@ -0,0 +1,5 @@
+module Pronto
+  module RailroaderVersion
+    VERSION = '0.10.1'.freeze
+  end
+end

data/pronto-railroader.gemspec

@@ -0,0 +1,40 @@
+# -*- encoding: utf-8 -*-
+$LOAD_PATH.push File.expand_path('../lib', __FILE__)
+
+require 'pronto/railroader/version'
+require 'English'
+
+Gem::Specification.new do |s|
+  s.name = 'pronto-railroader'
+  s.version = Pronto::RailroaderVersion::VERSION
+  s.platform = Gem::Platform::RUBY
+  s.author = 'David A. Wheeler adn Mindaugas Mozūras'
+  s.email = 'dwheeler@dwheeler.com'
+  s.homepage = 'http://github.com/david-a-wheeler/pronto-railroader'
+  s.summary = 'Pronto runner for Railroader, security vulnerability scanner for RoR'
+
+  s.licenses = ['MIT']
+  s.required_ruby_version = '>= 2.3.0'
+  s.rubygems_version = '1.8.23'
+
+  s.files = `git ls-files`.split($RS).reject do |file|
+    file =~ %r{^(?:
+    spec/.*
+    |Gemfile
+    |Rakefile
+    |\.rspec
+    |\.gitignore
+    |\.rubocop.yml
+    |\.travis.yml
+    )$}x
+  end
+  s.test_files = []
+  s.extra_rdoc_files = ['LICENSE', 'README.md']
+  s.require_paths = ['lib']
+
+  s.add_runtime_dependency('pronto', '~> 0.10.0')
+  s.add_runtime_dependency('railroader', '>= 3.2.0')
+  s.add_development_dependency('rake', '~> 12.0')
+  s.add_development_dependency('rspec', '~> 3.4')
+  s.add_development_dependency('rspec-its', '~> 1.2')
+end

metadata

@@ -0,0 +1,119 @@
+--- !ruby/object:Gem::Specification
+name: pronto-railroader
+version: !ruby/object:Gem::Version
+  version: 0.10.1
+platform: ruby
+authors:
+- David A. Wheeler adn Mindaugas Mozūras
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2019-02-07 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: pronto
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.10.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.10.0
+- !ruby/object:Gem::Dependency
+  name: railroader
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 3.2.0
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.4'
+- !ruby/object:Gem::Dependency
+  name: rspec-its
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.2'
+description: 
+email: dwheeler@dwheeler.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- LICENSE
+- README.md
+files:
+- LICENSE
+- README.md
+- lib/pronto/railroader.rb
+- lib/pronto/railroader/version.rb
+- pronto-railroader.gemspec
+homepage: http://github.com/david-a-wheeler/pronto-railroader
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.3.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.2
+signing_key: 
+specification_version: 4
+summary: Pronto runner for Railroader, security vulnerability scanner for RoR
+test_files: []