risu 1.5.1 → 1.5.2

data/Gemfile.ci

@@ -7,9 +7,7 @@ gem "rails"
 gem "libxml-ruby"
 gem "prawn"
 gem "gruff"
-gem "mysql"
+gem "mysql2"
 gem "rmagick"
 gem "sqlite3"
 gem "simplecov"
-gem "sinatra"
-gem "haml"

data/NEWS.markdown

@@ -1,6 +1,20 @@
 # News
 
-#1.5.1 (August 1, 2012)
+#1.5.2 (July 30, 2012)
+- New Parsed Tags
+	- vmsa
+	- cert-vu
+- Model Changes
+	- Reference Model
+		- Added vmsa() method
+		- Added cert_vu() method
+- Switched from the 'mysql' gem to the 'mysql2' gem for better rails3 support with mysql databases
+	- Note: **This means you need to specify mysql2 as the database adapter**
+- Fixed Ticket #57, which had a sqlite specific query, breaking the query on MySql. Reported by Drew Brunson
+- A few typos and spelling errors corrected
+- Added some PRAGMA's that might speed up SQLite3 usage. If it is still to slow (on insert) It is recommended to use MySQL.
+
+#1.5.1 (July 10, 2012)
 - Host Model
   - top_n_vulnerable(n)
   - risks_by_host(n); updated the query critical instead of high
@@ -24,7 +38,7 @@
 	- cisco-sa as a reference
 	- cisco-bug-id as a reference
 	- ics-alert as a reference
-	- cisco)sr as a reference
+	- cisco-sr as a reference
 	- always_run added to the Item Model (Related to a Registry Svc Check)
 - Spell-checked all of the templates and fixed some spelling issues
 - Added a template for the WSUS Patch Management Report Nessus Plugin ID: 58133
@@ -148,7 +162,7 @@ You can access it via `Host.first.patches` or `Patch.all`
 - Fixed small bug in Windows/Other OS graphs
 - Increased the verboseness of Error messages Ticket #29
 - Added named scopes off the Plugin class Ticket #34
-- Added new PCI related HostProperties Tocket #35
+- Added new PCI related HostProperties Ticket #35
 	- New HostProperties attribute: pci-dss-compliance:
 	- New HostProperties attribute: pcidss:compliance:failed
 	- New HostProperties attribute: pcidss:compliance:passed

data/README.markdown

@@ -2,7 +2,7 @@
 
 Risu is [Nessus](http://www.nessus.org) parser, that converts the generated reports into a [ActiveRecord](http://api.rubyonrails.org/classes/ActiveRecord/Base.html) database, this allows for easy report generation and vulnerability verification.
 
-Version **1.5.1** is the current release.
+Version **1.5.2** is the current release.
 
 ## Requirements
 
@@ -19,13 +19,13 @@ Risu relies heavily on [RubyGems](http://rubygems.org/) to install other depende
 - rmagick
 - gruff
 - prawn
-- mysql
+- mysql2
 
 ## Developmental Requirements
 
 These are all available through [RubyGems](http://rubygems.org/). The should be installed automatically when you install risu, If not this command will install them all:
 
-	% gem install rmagick gruff prawn yard mysql libxml-ruby rails sqlite3 logger yaml
+	% gem install rmagick gruff prawn yard mysql2 libxml-ruby rails sqlite3 logger yaml
 
 **You my need sudo/root access depending on your system setup**
 
@@ -74,7 +74,7 @@ Using the risu Console is just like using Rails. You can access all of the Activ
 	|_|  |_|___/\__,_|
 
 
-	risu Console v1.5.1
+	risu Console v1.5.2
 	>> Host.first
 	=> #<Risu::Models::Host id: 1, report_id: 1, name: "10.69.69.74", os: "Linux Kernel 2.6 on Debian 4.0 (etch)", mac: "XX:XX:XX:XX:XX:XX", start: "2011-04-20 16:29:37", end: "2011-04-20 16:32:14", ip: "10.69.69.74", fqdn: "redada.hammackj.net", netbios: "REDADA", local_checks_proto: nil, smb_login_used: nil, ssh_auth_meth: nil, ssh_login_used: nil, pci_dss_compliance: nil, notes: nil>
 
@@ -82,26 +82,26 @@ Using the risu Console is just like using Rails. You can access all of the Activ
 Several templates are included:
 
 	$ risu -l
-  Available Templates
-  	assets - Generates a Assets Summary Report
-  	cover_sheet - Generates a coversheet with a logo (Example Template)
-  	exec_summary - Generates a simple executive summary.
-  	exec_summary_detailed - Generates a detailed executive summary report
-  	finding_statistics - Generates report finding statistics
-  	findings_host - Generates a findings report by host
-  	findings_summary - Generates a findings summary report
-  	findings_summary_with_pluginid - Generates a Findings Summary with Nessus Plugin ID
-  	graphs - Generates a report with all the graphs in it
-  	host_summary - Generates a Host Summary Report
-  	ms_patch_summary - Generates a Microsoft Patch Summary Report
-  	ms_update_summary - Generates a Microsoft Update Summary Report
-  	ms_wsus_findings - Generates a report based on the findings of the Patch Management: WSUS Report plugin
-  	notable - Notable Vulnerabilities
-  	notable_detailed - Notable Vulnerabilities Detailed
-  	pci_compliance - Generates a PCI Compliance Overview Report
-  	stig_findings_summary - DISA Stig findings summary report
-  	technical_findings - Generates a Technical Findings Report
-  	template - template
+    Available Templates
+        stig_findings_summary - DISA Stig findings summary report
+        pci_compliance - Generates a PCI Compliance Overview Report
+        technical_findings - Generates a Technical Findings Report
+        ms_patch_summary - Generates a Microsoft Patch Summary Report
+        findings_summary_with_pluginid - Generates a Findings Summary with Nessus Plugin ID
+        findings_host - Generates a findings report by host
+        exec_summary - Generates a simple executive summary.
+        finding_statistics - Generates report finding statistics
+        graphs - Generates a report with all the graphs in it
+        findings_summary - Generates a findings summary report
+        assets - Generates a Assets Summary Report
+        cover_sheet - Generates a coversheet with a logo (Example Template)
+        notable_detailed - Notable Vulnerabilities Detailed
+        ms_update_summary - Generates a Microsoft Update Summary Report
+        template - template
+        notable - Notable Vulnerabilities
+        ms_wsus_findings - Generates a report based on the findings of the Patch Management: WSUS Report plugin
+        exec_summary_detailed - Generates a detailed executive summary report
+        host_summary - Generates a Host Summary Report
 	$
 
 The templates are written in ruby using [prawn](http://prawn.majesticseacreature.com/), they are fairly easy to make. I will add any templates as requested. See the 'template' example for creating your own template.
@@ -112,13 +112,7 @@ If you would like to contribute templates/bug fixes/etc to risu. The easiest way
 # Issues
 If you have any problems, bugs or feature requests please use the [github issue tracker](http://github.com/hammackj/risu/issues).
 
-#Donations
-I have received several requests for a method to donate to the project. You can use the following Paypal donation link; if you are interested in donating to the Risu Project. Your donations are welcome and help the development of Risu.
-
-<a href='http://www.pledgie.com/campaigns/16810'><img alt='Click here to lend your support to: Risu and make a donation at www.pledgie.com !' src='http://www.pledgie.com/campaigns/16810.png?skin_name=chrome' border='0' /></a>
-
 # Contact
 You can reach me at jacob[dot]hammack[at]hammackj[dot]com.
 
 You can also contact me on IRC as hammackj on irc.freenode.net, #risu
-

data/Rakefile

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -37,7 +37,7 @@ end
 
 task :release => :build do
   system "gem push #{Risu::APP_NAME}-#{Risu::VERSION}.gem"
-	puts "Just released #{Risu::APP_NAME} v#{Risu::VERSION}. #{Risu::APP_NAME} is always available in RubyGems! More information at http://hammackj.com/projects/risu/"
+	puts "Just released #{Risu::APP_NAME} v#{Risu::VERSION}. #{Risu::APP_NAME} is an Nessus XML parser/database. More information at http://hammackj.com/projects/risu/"
 end
 
 task :clean do
@@ -48,16 +48,20 @@ task :clean do
 	system "rm -rf coverage"
 end
 
-task :default => [:test_unit]
+task :default => [:test_sqlite]
 
-Rake::TestTask.new("test_unit") { |t|
-	t.libs << "test"
-  t.pattern = 'test/*/*_test.rb'
-  t.verbose = true
-}
+task :test_sqlite do
+	ENV['RISU_TEST_ENV'] = "sqlite"
+	Rake::Task['run_tests'].invoke
+end
+
+task :test_mysql do
+	ENV['RISU_TEST_ENV'] = "mysql"
+	Rake::Task['run_tests'].invoke
+end
 
-Rake::TestTask.new("test_functional") { |t|
+Rake::TestTask.new("run_tests") do |t|
 	t.libs << "test"
-  t.pattern = 'test/functional/*_test.rb'
+  t.pattern = 'test/*/*_test.rb'
   t.verbose = true
-}
+end

data/bin/risu

@@ -1,11 +1,11 @@
 #!/usr/bin/env ruby
-
+#
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -14,7 +14,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

data/lib/risu.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -26,7 +26,7 @@
 
 module Risu
 	APP_NAME = "risu"
-	VERSION = "1.5.1"
+	VERSION = "1.5.2"
 	GRAPH_WIDTH = 750
 	EMAIL = "jacob.hammack@hammackj.com"
 	CONFIG_FILE = "./risu.cfg"
@@ -43,7 +43,7 @@ require 'gruff'
 require 'prawn'
 require 'prawn/layout'
 require 'stringio'
-require 'mysql'
+require 'mysql2'
 require 'irb'
 
 require 'optparse'

data/lib/risu/base.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -31,5 +31,4 @@ end
 
 require 'risu/base/template_base'
 require 'risu/base/template_manager'
-require 'risu/base/prawn_templater'
 require 'risu/base/templater'

data/lib/risu/base/schema.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -182,7 +182,7 @@ module Risu
 				add_index :references, :plugin_id
 
 				#Default data for service descriptions
-				#@todo Unused atm, might be better to use a yaml file tho..
+				#@todo Unused ATM, might be better to use a yaml file tho..
 				ServiceDescription.create :name => "www", :description => ""
 				ServiceDescription.create :name => "cifs", :description => ""
 				ServiceDescription.create :name => "smb", :description => ""

data/lib/risu/base/template_base.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

data/lib/risu/base/template_manager.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -35,7 +35,6 @@ module Risu
 			# @param path Path relative to the base_dir of risu
 			#
 			# @return New instance of the template manager with templates loaded.
-			#
 			def initialize (path)
 			  @registered_templates = Array.new
 				@templates = Array.new
@@ -49,7 +48,6 @@ module Risu
 			# Loads templates from a specific path
 			#
 			# @param path Path to templates to load
-			#
 			def load_templates(path)
 				begin
 				  Dir["#{path}/**/*.rb"].each do |x|
@@ -72,8 +70,11 @@ module Risu
 
 			# Validates that a template is a valid template
 			#
+			# @todo look at refactoring this to valid?(template)
+			#
 			# @param template The template to validate
 			#
+			# @return [Boolean] If the template is valid
 			def validate(template)
 			  t = template.new
 
@@ -97,8 +98,7 @@ module Risu
 				return nil
 			end
 
-			# Displays a list of all the templates
-			#
+			# Displays a list of all the templates to STDOUT
 			def display_templates
 				puts "Available Templates"
 			  @registered_templates.each do |x|

data/lib/risu/base/templater.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
@@ -56,7 +56,8 @@ module Risu
 						t.render(output) unless t == nil
 					end
 				rescue => e
-					puts "Error: #{e.message} \n #{e.backtrace.join("\n\t")}\n"
+					raise unless Rails.env.production?
+					puts "Templater Error: #{e.message} \n #{e.backtrace.join("\n\t")}\n"
 				end
 			end
 		end

data/lib/risu/cli.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2010-2012 Arxopia LLC.
 # All rights reserved.
-
+#
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are met:
-
+#
 #     * Redistributions of source code must retain the above copyright
 #       notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above copyright
@@ -12,7 +12,7 @@
 #     * Neither the name of the Arxopia LLC nor the names of its contributors
 #     	may be used to endorse or promote products derived from this software
 #     	without specific prior written permission.
-
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
 # ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 # WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE