ruby_audit 1.3.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 529f49e7e88c457cb4c29a4aace7564b7753d2252541d61a4383110e6a7e8b48
-  data.tar.gz: cd616a710742a529c9782f032980e3d6c350aab2e6bff3c683b5886d2123e39e
+  metadata.gz: b939a8de9d5f33649faf17b6181580235b4c40566e5582d99220bcf36588afb2
+  data.tar.gz: 22d2f224e26baac967f47a402f971175c3c7489af24720f31edc2d3d301efa5e
 SHA512:
-  metadata.gz: ce3763a7c324c47adf80a8558e6b3f11ed579730f7ebca3a726e40bd3a23ee98928c7f3dc6c3fc63823010a9cdc2c56672c4e58a6cb2a6cf1118ef7bfcbcf9d5
-  data.tar.gz: aab0478eb61ab75e739d6197394cf0bd6dac75bf96f66c94cd115329a510f82f0917837374d226266cec043383759b59ce3cebd904d0df9858532354cc5b140c
+  metadata.gz: c04e0bf277cbb8ad80690abb7adb4680c811479e952e08257a9ae7a89792fb33e08acc7a1674195a88592c01a865fd47a2d71501b9642c37330dcd1f71bbca12
+  data.tar.gz: 5c54e924a470a1d9ecc7e8f913ddd50aa3e5d8f4540a70afa8e9636187cac3d9ecd4993d62f3bb6936d791bcc259c3bebf2ebe305e492905950c9709cc4a9d26

data/.rspec

@@ -1 +1,2 @@
 --color
+--warnings  

data/.rubocop.yml

@@ -1,4 +1,9 @@
-Metrics/LineLength:
+AllCops:
+  TargetRubyVersion: 2.5
+  NewCops: enable
+  SuggestExtensions: false
+
+Layout/LineLength:
   Exclude:
     - 'ruby_audit.gemspec'
 
@@ -6,7 +11,7 @@ Metrics/MethodLength:
   Max: 15
 
 Metrics/BlockLength:
-  ExcludedMethods:
+  IgnoredMethods:
     - describe
 
 Style/Documentation:

data/.ruby-version

@@ -1 +1 @@
-2.7.1
+3.0.0

data/.travis.yml

@@ -3,7 +3,8 @@ cache: bundler
 rvm:
   - 2.5.8
   - 2.6.6
-  - 2.7.1
+  - 2.7.2
+  - 3.0.0
 branches:
   only:
     - master

data/CHANGELOG.md

@@ -5,6 +5,17 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ## [Unreleased]
 
+## [2.0.0] - 2021-03-22
+
+### Added
+
+* Require bundler-audit 0.8
+* Added Ruby 3.0 to the Travis matrix
+
+### Removed
+
+* Removed support for bundler-audit 0.7
+
 ## [1.3.0] - 2020-07-01
 
 ### Added
@@ -66,7 +77,8 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 * Initial Release
 
-[Unreleased]: https://github.com/civisanalytics/ruby_audit/compare/v1.3.0...HEAD
+[Unreleased]: https://github.com/civisanalytics/ruby_audit/compare/v2.0.0...HEAD
+[1.3.0]: https://github.com/civisanalytics/ruby_audit/compare/v1.3.0...v2.0.0
 [1.3.0]: https://github.com/civisanalytics/ruby_audit/compare/v1.2.0...v1.3.0
 [1.2.0]: https://github.com/civisanalytics/ruby_audit/compare/v1.1.0...v1.2.0
 [1.1.0]: https://github.com/civisanalytics/ruby_audit/compare/v1.0.1...v1.1.0

data/README.md

@@ -1,6 +1,6 @@
 # RubyAudit
 
-[![Build Status](https://travis-ci.org/civisanalytics/ruby_audit.svg?branch=master)](https://travis-ci.org/civisanalytics/ruby_audit)
+[![Build Status](https://travis-ci.com/civisanalytics/ruby_audit.svg?branch=master)](https://travis-ci.com/civisanalytics/ruby_audit)
 [![Gem Version](https://badge.fury.io/rb/ruby_audit.svg)](http://badge.fury.io/rb/ruby_audit)
 
 RubyAudit checks your current version of Ruby and RubyGems against known security vulnerabilities (CVEs), alerting you if you are using an insecure version.

data/lib/ruby_audit.rb

@@ -1,4 +1,3 @@
-require 'bundler/audit/cli'
 require 'ruby_audit/cli'
 require 'ruby_audit/database'
 require 'ruby_audit/scanner'

data/lib/ruby_audit/cli.rb

@@ -1,5 +1,10 @@
+require 'thor'
+
 module RubyAudit
-  class CLI < Bundler::Audit::CLI
+  class CLI < ::Thor
+    default_task :check
+    map '--version' => :version
+
     desc 'check', 'Checks Ruby and RubyGems for insecure versions'
     method_option :ignore, type: :array, aliases: '-i'
     method_option :no_update, type: :boolean, aliases: '-n'
@@ -52,6 +57,72 @@ module RubyAudit
 
     private
 
+    def say(message = '', color = nil)
+      color = nil unless $stdout.tty?
+      super(message.to_s, color)
+    end
+
+    # rubocop:disable Metrics/AbcSize
+    # rubocop:disable Metrics/CyclomaticComplexity
+    # rubocop:disable Metrics/MethodLength
+    # rubocop:disable Metrics/PerceivedComplexity
+    def print_advisory(gem, advisory)
+      say 'Name: ', :red
+      say gem.name
+
+      say 'Version: ', :red
+      say gem.version
+
+      say 'Advisory: ', :red
+
+      if advisory.cve
+        say advisory.cve_id
+      elsif advisory.osvdb
+        say advisory.osvdb_id
+      elsif advisory.ghsa
+        say advisory.ghsa_id
+      end
+
+      say 'Criticality: ', :red
+      case advisory.criticality
+      when :none     then say 'None'
+      when :low      then say 'Low'
+      when :medium   then say 'Medium', :yellow
+      when :high     then say 'High', %i[red bold]
+      when :critical then say 'Critical', %i[red bold]
+      else                say 'Unknown'
+      end
+
+      say 'URL: ', :red
+      say advisory.url
+
+      if options.verbose?
+        say 'Description:', :red
+        say
+
+        print_wrapped advisory.description, indent: 2
+        say
+      else
+
+        say 'Title: ', :red
+        say advisory.title
+      end
+
+      if advisory.patched_versions.empty?
+        say 'Solution: ', :red
+        say 'remove or disable this gem until a patch is available!', %i[red bold]
+      else
+        say 'Solution: upgrade to ', :red
+        say advisory.patched_versions.join(', ')
+      end
+
+      say
+    end
+    # rubocop:enable Metrics/PerceivedComplexity
+    # rubocop:enable Metrics/MethodLength
+    # rubocop:enable Metrics/CyclomaticComplexity
+    # rubocop:enable Metrics/AbcSize
+
     def check_for_stale_database
       database = Database.new
       return unless database.size == 89

data/lib/ruby_audit/database.rb

@@ -1,3 +1,5 @@
+require 'bundler/audit/database'
+
 module RubyAudit
   class Database < Bundler::Audit::Database
     def advisories_for(name, type)

data/lib/ruby_audit/scanner.rb

@@ -1,5 +1,8 @@
+require 'bundler/audit/results/unpatched_gem'
+require 'set'
+
 module RubyAudit
-  class Scanner < Bundler::Audit::Scanner
+  class Scanner
     class Version
       def initialize(name, version)
         @name = name
@@ -52,14 +55,16 @@ module RubyAudit
     end
 
     def scan_inner(specs, type, options = {})
-      return enum_for(__method__, options) unless block_given?
+      return enum_for(__method__, specs, type, options) unless block_given?
 
       ignore = Set[]
       ignore += options[:ignore] if options[:ignore]
 
       specs.each do |spec|
         @database.send("check_#{type}".to_sym, spec) do |advisory|
-          yield UnpatchedGem.new(spec, advisory) unless ignore.intersect?(advisory.identifiers.to_set)
+          unless ignore.intersect?(advisory.identifiers.to_set)
+            yield Bundler::Audit::Results::UnpatchedGem.new(spec, advisory)
+          end
         end
       end
     end

data/lib/ruby_audit/version.rb

@@ -1,3 +1,3 @@
 module RubyAudit
-  VERSION = '1.3.0'.freeze
+  VERSION = '2.0.0'.freeze
 end

data/ruby_audit.gemspec

@@ -15,17 +15,18 @@ Gem::Specification.new do |spec|
                        'version. It complements bundler-audit, providing ' \
                        'complete coverage for your Ruby stack.'
   spec.homepage      = 'https://github.com/civisanalytics/ruby_audit'
-  spec.license       = 'GPLv3'
+  spec.license       = 'GPL-3.0-or-later'
 
+  spec.required_ruby_version = ['>= 2.5', '< 3.1']
   spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
   spec.bindir        = 'exe'
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ['lib']
 
-  spec.add_dependency 'bundler-audit', '~> 0.7.0'
+  spec.add_dependency 'bundler-audit', '~> 0.8.0'
   spec.add_development_dependency 'pry', '~> 0.13.0'
   spec.add_development_dependency 'rake', '~> 13.0'
   spec.add_development_dependency 'rspec', '~> 3.9'
-  spec.add_development_dependency 'rubocop', '~> 0.86.0'
+  spec.add_development_dependency 'rubocop', '~> 1.9.1'
   spec.add_development_dependency 'timecop', '~> 0.9.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ruby_audit
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Jeff Cousens, Mike Saelim
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-07-01 00:00:00.000000000 Z
+date: 2021-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.0
+        version: 0.8.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.7.0
+        version: 0.8.0
 - !ruby/object:Gem::Dependency
   name: pry
   requirement: !ruby/object:Gem::Requirement
@@ -72,14 +72,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.86.0
+        version: 1.9.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.86.0
+        version: 1.9.1
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
@@ -128,9 +128,9 @@ files:
 - ruby_audit.gemspec
 homepage: https://github.com/civisanalytics/ruby_audit
 licenses:
-- GPLv3
+- GPL-3.0-or-later
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -138,15 +138,18 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.5'
+  - - "<"
+    - !ruby/object:Gem::Version
+      version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.2.3
+signing_key:
 specification_version: 4
 summary: Checks Ruby and RubyGems against known vulnerabilities.
 test_files: []