secupdater 0.1.0

data/spec/secupdater/cli_spec.rb

@@ -0,0 +1,109 @@
+require "secupdater"
+require "stringio"
+
+RSpec.describe Secupdater::CLI::Commands::Run do
+  let(:out) { StringIO.new }
+  let(:err) { StringIO.new }
+  let(:runner) { instance_double(Secupdater::Runner, call: { "rack" => :published }) }
+  let(:env) { {} }
+
+  def run_cli(*arguments)
+    Dry::CLI.new(Secupdater::CLI::Commands).call(arguments: ["run", *arguments], out: out, err: err)
+  end
+
+  def expect_exit(status, &block)
+    expect(&block).to raise_error(SystemExit) { expect(it.status).to eq(status) }
+  end
+
+  before do
+    stub_const("ENV", env)
+    allow(Secupdater::Runner).to receive(:new).and_return(runner)
+  end
+
+  describe "#call" do
+    context "with --ecosystem rubygems and an advisories path" do
+      it "builds a Runner for rubygems at log level :warn and calls it with the advisories path" do
+        run_cli("--ecosystem=rubygems", "audit.json")
+
+        expect(Secupdater::Runner).to have_received(:new).with(ecosystem: "rubygems", log_level: :warn, publisher: nil)
+        expect(runner).to have_received(:call).with("audit.json")
+      end
+    end
+
+    context "with --verbose" do
+      it "builds the Runner with log level :info" do
+        run_cli("--ecosystem=rubygems", "--verbose", "audit.json")
+
+        expect(Secupdater::Runner).to have_received(:new).with(hash_including(log_level: :info))
+      end
+    end
+
+    context "with --debug" do
+      it "builds the Runner with log level :debug, even when --verbose is also given" do
+        run_cli("--ecosystem=rubygems", "--verbose", "--debug", "audit.json")
+
+        expect(Secupdater::Runner).to have_received(:new).with(hash_including(log_level: :debug))
+      end
+    end
+
+    context "with SECUPDATER_GITLAB_TOKEN set" do
+      let(:env) { { "SECUPDATER_GITLAB_TOKEN" => "token", "CI_PROJECT_ID" => "123", "CI_DEFAULT_BRANCH" => "main" } }
+
+      it "publishes to GitLab using the CI project and default branch" do
+        run_cli("--ecosystem=rubygems", "audit.json")
+
+        expect(Secupdater::Runner).to have_received(:new).with(hash_including(
+          publisher: an_instance_of(Secupdater::Publisher::Gitlab).and(
+            have_attributes(access_token: "token", project_id: "123", target_branch: "main")
+          )
+        ))
+      end
+    end
+
+    context "with SECUPDATER_GITLAB_TOKEN set but no CI_PROJECT_ID" do
+      let(:env) { { "SECUPDATER_GITLAB_TOKEN" => "token", "CI_DEFAULT_BRANCH" => "main" } }
+
+      it "prints which variable is missing and exits non-zero" do
+        expect_exit(1) { run_cli("--ecosystem=rubygems", "audit.json") }
+
+        expect(err.string).to eq("SECUPDATER_GITLAB_TOKEN is set but CI_PROJECT_ID isn't\n")
+      end
+    end
+
+    context "with an unknown --ecosystem" do
+      it "prints an error naming the bad option and exits non-zero" do
+        expect_exit(1) { run_cli("--ecosystem=npm", "audit.json") }
+
+        expect(err.string).to include("--ecosystem=npm")
+        expect(Secupdater::Runner).not_to have_received(:new)
+      end
+    end
+
+    context "without an advisories argument" do
+      it "prints usage and exits non-zero" do
+        expect_exit(1) { run_cli("--ecosystem=rubygems") }
+
+        expect(err.string).to include("ADVISORIES")
+        expect(Secupdater::Runner).not_to have_received(:new)
+      end
+    end
+
+    context "when the advisories file doesn't exist" do
+      before { allow(Secupdater::Runner).to receive(:new).and_call_original }
+
+      it "prints 'Cannot open <path>' and exits non-zero, rather than an Errno::ENOENT backtrace" do
+        expect_exit(1) { run_cli("--ecosystem=rubygems", "missing.json") }
+
+        expect(err.string).to eq("Cannot open missing.json\n")
+      end
+    end
+
+    context "when a dependency fails to update" do
+      let(:runner) { instance_double(Secupdater::Runner, call: { "rack" => :failed, "nokogiri" => :published }) }
+
+      it "exits non-zero" do
+        expect_exit(1) { run_cli("--ecosystem=rubygems", "audit.json") }
+      end
+    end
+  end
+end

data/spec/secupdater/ecosystem/rubygems_spec.rb

@@ -0,0 +1,184 @@
+require "secupdater"
+require "stringio"
+require "tmpdir"
+
+RSpec.describe Secupdater::Ecosystem::Rubygems do
+  subject(:rubygems) { described_class.new }
+
+  def lockfile(css_parser_version)
+    <<~LOCKFILE
+      GEM
+        remote: https://rubygems.org/
+        specs:
+          addressable (2.8.0)
+          css_parser (#{css_parser_version})
+            addressable
+
+      PLATFORMS
+        ruby
+
+      DEPENDENCIES
+        css_parser
+
+      BUNDLED WITH
+         2.5.0
+    LOCKFILE
+  end
+
+  def spec(name, version) = Secupdater::DependencySpec.new(name, "ruby", Gem::Version.new(version))
+
+  around do |example|
+    Dir.mktmpdir do |dir|
+      Dir.chdir(dir) do
+        File.write("Gemfile.lock", lockfile("1.0.0"))
+        example.run
+      end
+    end
+  end
+
+  describe "#parse_advisories(io)" do
+    context "bundle-audit JSON with unpatched_gem and insecure_source results" do
+      let(:report) do
+        {
+          results: [
+            {
+              type: "unpatched_gem",
+              gem: { name: "css_parser", version: "1.0.0" },
+              advisory: { id: "CVE-2024-0001", cve: "2024-0001", osvdb: nil, ghsa: "abcd-efgh", patched_versions: [">= 1.1.0"] }
+            },
+            { type: "insecure_source", source: "http://rubygems.org/" }
+          ]
+        }
+      end
+
+      it "returns one advisory per unpatched gem with a joined cve/ghsa id and patched_versions" do
+        expect(rubygems.parse_advisories(StringIO.new(report.to_json))).to eq([
+          Secupdater::SecurityAdvisory.new("css_parser", "cve/2024-0001-ghsa/abcd-efgh", [">= 1.1.0"])
+        ])
+      end
+    end
+
+    context "an advisory with none of cve, osvdb or ghsa" do
+      let(:report) do
+        {
+          results: [
+            {
+              type: "unpatched_gem",
+              gem: { name: "css_parser", version: "1.0.0" },
+              advisory: { id: "RUBYSEC-2024-1", cve: nil, osvdb: nil, ghsa: nil, patched_versions: [">= 1.1.0"] }
+            }
+          ]
+        }
+      end
+
+      it "falls back to the advisory id" do
+        expect(rubygems.parse_advisories(StringIO.new(report.to_json)).map(&:report_id)).to eq(["RUBYSEC-2024-1"])
+      end
+    end
+  end
+
+  describe "#snapshot" do
+    context "fixture Gemfile.lock in root" do
+      it "maps gem name to DependencySpec with version" do
+        expect(rubygems.snapshot).to eq(
+          "addressable" => spec("addressable", "2.8.0"),
+          "css_parser" => spec("css_parser", "1.0.0")
+        )
+      end
+    end
+  end
+
+  describe "#diff_snapshot" do
+    context "one gem bumped, one added, one removed" do
+      it "returns a diff for each with from/to" do
+        before = { "css_parser" => spec("css_parser", "1.0.0"), "public_suffix" => spec("public_suffix", "4.0.0") }
+        after = { "css_parser" => spec("css_parser", "1.1.0"), "addressable" => spec("addressable", "2.8.0") }
+
+        expect(rubygems.diff_snapshot(before, after)).to contain_exactly(
+          Secupdater::DependencySpecDiff.new(spec("css_parser", "1.0.0"), Gem::Version.new("1.0.0"), Gem::Version.new("1.1.0")),
+          Secupdater::DependencySpecDiff.new(spec("public_suffix", "4.0.0"), Gem::Version.new("4.0.0"), nil),
+          Secupdater::DependencySpecDiff.new(spec("addressable", "2.8.0"), nil, Gem::Version.new("2.8.0"))
+        )
+      end
+    end
+
+    context "unchanged gems" do
+      it "leaves them out of the diff" do
+        snapshot = { "css_parser" => spec("css_parser", "1.0.0") }
+
+        expect(rubygems.diff_snapshot(snapshot, snapshot.dup)).to be_empty
+      end
+    end
+  end
+
+  describe "#satisfies_requirement?" do
+    it "matches ~>, >= and a version that's too low" do
+      expect(rubygems.satisfies_requirement?("1.1.5", "~> 1.1.4")).to be(true)
+      expect(rubygems.satisfies_requirement?("1.2.0", "~> 1.1.4")).to be(false)
+      expect(rubygems.satisfies_requirement?("2.0.0", ">= 1.1.0")).to be(true)
+      expect(rubygems.satisfies_requirement?("1.0.0", ">= 1.1.0")).to be(false)
+    end
+
+    it "matches comma-separated requirements from bundle audit" do
+      expect(rubygems.satisfies_requirement?("7.3.5", "~> 7.3, >= 7.3.5")).to be(true)
+      expect(rubygems.satisfies_requirement?("7.3.4", "~> 7.3, >= 7.3.5")).to be(false)
+      expect(rubygems.satisfies_requirement?("8.0.0", "~> 7.3, >= 7.3.5")).to be(false)
+    end
+  end
+
+  describe "#try_update" do
+    let(:status) { instance_double(Process::Status, success?: true, exitstatus: 0) }
+
+    context "command succeeds" do
+      before do
+        allow(Open3).to receive(:capture2e) do
+          File.write("Gemfile.lock", lockfile("1.1.0"))
+          ["Bundle updated!", status]
+        end
+      end
+
+      it "runs a strict, conservative bundle update at the given level" do
+        rubygems.try_update("css_parser", level: :minor)
+
+        expect(Open3).to have_received(:capture2e).with("bundle", "update", "css_parser", "--conservative", "--minor", "--strict")
+      end
+
+      it "returns the lockfile change with its new and original content" do
+        expect(rubygems.try_update("css_parser", level: :patch)).to eq([
+          Secupdater::FileChange.new("Gemfile.lock", "update", lockfile("1.1.0"), lockfile("1.0.0"))
+        ])
+      end
+    end
+
+    context "command succeeds without changing anything" do
+      before { allow(Open3).to receive(:capture2e).and_return(["Bundle updated!", status]) }
+
+      it "returns no file changes" do
+        expect(rubygems.try_update("css_parser", level: :patch)).to eq([])
+      end
+    end
+
+    context "gem name containing shell metacharacters" do
+      before { allow(Open3).to receive(:capture2e).and_return(["", status]) }
+
+      it "passes it as a single argument without going through a shell" do
+        rubygems.try_update("css_parser; touch pwned", level: :patch)
+
+        expect(Open3).to have_received(:capture2e).with("bundle", "update", "css_parser; touch pwned", "--conservative", "--patch", "--strict")
+      end
+    end
+
+    context "command exits 1" do
+      let(:status) { instance_double(Process::Status, success?: false, exitstatus: 1) }
+
+      before { allow(Open3).to receive(:capture2e).and_return(["Could not find gem 'css_parser'", status]) }
+
+      it "raises UpdateCommandFailed with the integer exit code and combined output" do
+        expect { rubygems.try_update("css_parser", level: :patch) }.to raise_error(Secupdater::UpdateCommandFailed) do
+          expect(it.exit_code).to eq(1)
+          expect(it.output).to eq("Could not find gem 'css_parser'")
+        end
+      end
+    end
+  end
+end

data/spec/secupdater/ecosystem_spec.rb

@@ -0,0 +1,18 @@
+require "secupdater"
+
+RSpec.describe Secupdater::Ecosystem do
+  describe ".resolve" do
+    context "'rubygems'" do
+      it "returns a Secupdater::Ecosystem::Rubygems instance" do
+        expect(described_class.resolve("rubygems")).to be_a(Secupdater::Ecosystem::Rubygems)
+        expect(described_class.resolve("RubyGems")).to be_a(Secupdater::Ecosystem::Rubygems)
+      end
+    end
+
+    context "unknown ecosystem" do
+      it "raises Secupdater::Error naming the ecosystem" do
+        expect { described_class.resolve("npm") }.to raise_error(Secupdater::Error, "Unknown ecosystem: npm")
+      end
+    end
+  end
+end

data/spec/secupdater/publisher/gitlab_spec.rb

@@ -0,0 +1,106 @@
+require "secupdater"
+require "secupdater/publisher"
+require "secupdater/publisher/gitlab"
+
+RSpec.describe Secupdater::Publisher::Gitlab do
+  subject(:gitlab) { described_class.new("access_token", "123", "main") }
+
+  let(:ecosystem) { Secupdater::Ecosystem::Rubygems.new }
+  let(:dep) { Secupdater::DependencySpec.new("css_parser", "ruby", Gem::Version.new("1.0.0")) }
+  let(:advisories) { [Secupdater::SecurityAdvisory.new("css_parser", "cve/2024-0001", [">= 1.1.0"])] }
+  let(:bump) { Secupdater::DependencySpecDiff.new(dep, "1.0.0", "1.1.0") }
+  let(:changes) { [Secupdater::FileChange.new("Gemfile.lock", "update", "abc", "xyz")] }
+
+  let(:headers) do
+    {
+      "PRIVATE-TOKEN" => "access_token",
+      content_type: "application/json"
+    }
+  end
+
+  let(:existing_merge_requests) { [] }
+
+  let!(:find_mr_stub) do
+    stub_request(:get, "https://gitlab.com/api/v4/projects/123/merge_requests")
+      .with(query: { source_branch: "security/css_parser-1.1.0", state: "opened" }, headers: headers)
+      .to_return(status: 200, body: existing_merge_requests.to_json)
+  end
+
+  let!(:create_commit_stub) do
+    stub_request(:post, "https://gitlab.com/api/v4/projects/123/repository/commits")
+      .with(
+        body: {
+          branch: "security/css_parser-1.1.0",
+          start_branch: "main",
+          commit_message: "Upgrade RubyGems dependency css_parser to version 1.1.0",
+          actions: [{ action: "update", file_path: "Gemfile.lock", content: "abc" }]
+        },
+        headers: headers
+      )
+      .to_return(status: 201, body: "{}")
+  end
+
+  let!(:create_mr_stub) do
+    stub_request(:post, "https://gitlab.com/api/v4/projects/123/merge_requests")
+      .with(body: {
+        source_branch: "security/css_parser-1.1.0",
+        target_branch: "main",
+        remove_source_branch: true,
+        labels: [],
+        title: "Upgrade RubyGems dependency css_parser to version 1.1.0",
+        description: "Upgrade RubyGems dependency css_parser to version 1.1.0 to address the following security advisories:\n\n* cve/2024-0001\n",
+      }, headers: headers)
+      .to_return(status: 201, body: "{}")
+  end
+
+  describe "#call(ecosystem, bump, advisories, changes)" do
+    it "creates a commit and a merge request" do
+      gitlab.call(ecosystem, bump, advisories, changes)
+
+      expect(create_commit_stub).to have_been_requested
+      expect(create_mr_stub).to have_been_requested
+    end
+
+    context "deleting a file" do
+      let(:changes) { [Secupdater::FileChange.new("Gemfile.lock", "delete", nil, "xyz")] }
+
+      let!(:create_commit_stub) do
+        stub_request(:post, "https://gitlab.com/api/v4/projects/123/repository/commits")
+          .with(body: hash_including(actions: [{ action: "delete", file_path: "Gemfile.lock" }]))
+          .to_return(status: 201, body: "{}")
+      end
+
+      it "doesn't send content for the action" do
+        gitlab.call(ecosystem, bump, advisories, changes)
+
+        expect(create_commit_stub).to have_been_requested
+      end
+    end
+
+    context "API returns 4xx" do
+      let!(:create_commit_stub) do
+        stub_request(:post, "https://gitlab.com/api/v4/projects/123/repository/commits")
+          .to_return(status: 400, body: '{"message":"A branch called security/css_parser-1.1.0 already exists"}')
+      end
+
+      it "raises Secupdater::Error including the response body" do
+        expect { gitlab.call(ecosystem, bump, advisories, changes) }
+          .to raise_error(Secupdater::Error, /400.*already exists/)
+
+        expect(create_mr_stub).not_to have_been_requested
+      end
+    end
+
+    context "an MR for the branch already exists" do
+      let(:existing_merge_requests) { [{ iid: 1 }] }
+
+      it "doesn't create another one" do
+        gitlab.call(ecosystem, bump, advisories, changes)
+
+        expect(find_mr_stub).to have_been_requested
+        expect(create_commit_stub).not_to have_been_requested
+        expect(create_mr_stub).not_to have_been_requested
+      end
+    end
+  end
+end

data/spec/secupdater/publisher_spec.rb

@@ -0,0 +1,10 @@
+require "secupdater"
+require "secupdater/publisher"
+
+RSpec.describe Secupdater::Publisher do
+  describe ".new" do
+    it "can't be instantiated directly" do
+      expect { described_class.new }.to raise_error(NotImplementedError)
+    end
+  end
+end

data/spec/secupdater/runner_spec.rb

@@ -0,0 +1,56 @@
+require "secupdater"
+require "tmpdir"
+
+RSpec.describe Secupdater::Runner do
+  describe "#initialize" do
+    context "with ecosystem 'rubygems'" do
+      it "resolves the Rubygems ecosystem" do
+        expect(Secupdater::Ecosystem).to receive(:resolve).with("rubygems").and_call_original
+
+        described_class.new(ecosystem: "rubygems")
+      end
+    end
+
+    context "with an unknown ecosystem" do
+      it "raises Secupdater::Error naming the ecosystem" do
+        expect { described_class.new(ecosystem: "npm") }.to raise_error(Secupdater::Error, /npm/)
+      end
+    end
+  end
+
+  describe "#call(advisories_path)" do
+    subject(:runner) { described_class.new(ecosystem: "rubygems", publisher: publisher) }
+
+    let(:ecosystem) { instance_double(Secupdater::Ecosystem::Rubygems) }
+    let(:publisher) { instance_double(Secupdater::Publisher) }
+    let(:update) { instance_double(Secupdater::Update, call: { "rack" => :published }) }
+    let(:advisories) { [Secupdater::SecurityAdvisory.new("rack", "cve/1", [">= 2.0"])] }
+
+    around do |example|
+      Dir.mktmpdir do |dir|
+        Dir.chdir(dir) { example.run }
+      end
+    end
+
+    before do
+      File.write("audit.json", "{}")
+      allow(Secupdater::Ecosystem).to receive(:resolve).and_return(ecosystem)
+      allow(ecosystem).to receive(:parse_advisories) { |io| advisories if io.read == "{}" }
+      allow(Secupdater::Update).to receive(:new).and_return(update)
+    end
+
+    it "parses the advisories file with the ecosystem and passes them to Update" do
+      expect(runner.call("audit.json")).to eq("rack" => :published)
+
+      expect(Secupdater::Update).to have_received(:new)
+        .with(an_instance_of(Dry::Logger::Dispatcher), ecosystem, publisher: publisher)
+      expect(update).to have_received(:call).with(advisories)
+    end
+
+    context "when the advisories file doesn't exist" do
+      it "raises Secupdater::Error naming the path" do
+        expect { runner.call("missing.json") }.to raise_error(Secupdater::Error, "Cannot open missing.json")
+      end
+    end
+  end
+end