base on Patch-level verification for Bundler # bundler-audit [](https://github.com/rubysec/bundler-audit/actions/workflows/ruby.yml) [](https://codeclimate.com/github/rubysec/bundler-audit) [](https://badge.fury.io/rb/bundler-audit) * [Homepage](https://github.com/rubysec/bundler-audit#readme) * [Issues](https://github.com/rubysec/bundler-audit/issues) * [Documentation](http://rubydoc.info/gems/bundler-audit/frames) ## Description Patch-level verification for [bundler]. ## Features * Checks for vulnerable versions of gems in `Gemfile.lock`. * Checks for insecure gem sources (`http://` and `git://`). * Allows ignoring certain advisories that have been manually worked around. * Prints advisory information. * Does not require a network connection. ## Synopsis Audit a project's `Gemfile.lock`: ``` $ bundle-audit Name: actionpack Version: 3.2.10 Advisory: OSVDB-91452 Criticality: Medium URL: http://www.osvdb.org/show/osvdb/91452 Title: XSS vulnerability in sanitize_css in Action Pack Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 Name: actionpack Version: 3.2.10 Advisory: OSVDB-91454 Criticality: Medium URL: http://osvdb.org/show/osvdb/91454 Title: XSS Vulnerability in the `sanitize` helper of Ruby on Rails Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 Name: actionpack Version: 3.2.10 Advisory: OSVDB-89026 Criticality: High URL: http://osvdb.org/show/osvdb/89026 Title: Ruby on Rails params_parser.rb Action Pack Type Casting Parameter Parsing Remote Code Execution Solution: update to ~> 2.3.15, ~> 3.0.19, ~> 3.1.10, >= 3.2.11 Name: activerecord Version: 3.2.10 Advisory: OSVDB-91453 Criticality: High URL: http://osvdb.org/show/osvdb/91453 Title: Symbol DoS vulnerability in Active Record Solution: update to ~> 2.3.18, ~> 3.1.12, >= 3.2.13 Name: activerecord Version: 3.2.10 Advisory: OSVDB-90072 Criticality: Medium URL: http://direct.osvdb.org/show/osvdb/90072 Title: Ruby on Rails Active Record attr_protected Method Bypass Solution: update to ~> 2.3.17, ~> 3.1.11, >= 3.2.12 Name: activerecord Version: 3.2.10 Advisory: OSVDB-89025 Criticality: High URL: http://osvdb.org/show/osvdb/89025 Title: Ruby on Rails Active Record JSON Parameter Parsing Query Bypass Solution: update to ~> 2.3.16, ~> 3.0.19, ~> 3.1.10, >= 3.2.11 Name: activesupport Version: 3.2.10 Advisory: OSVDB-91451 Criticality: High URL: http://www.osvdb.org/show/osvdb/91451 Title: XML Parsing Vulnerability affecting JRuby users Solution: update to ~> 3.1.12, >= 3.2.13 Unpatched versions found! ``` Update the [ruby-advisory-db] that `bundle audit` uses: ``` $ bundle-audit update Updating ruby-advisory-db ... remote: Counting objects: 44, done. remote: Compressing objects: 100% (24/24), done. remote: Total 39 (delta 19), reused 29 (delta 10) Unpacking objects: 100% (39/39), done. From https://github.com/rubysec/ruby-advisory-db * branch master -> FETCH_HEAD Updating 5f8225e..328ca86 Fast-forward CONTRIBUTORS.md | 1 + gems/actionmailer/OSVDB-98629.yml | 17 +++++++++++++++++ gems/cocaine/OSVDB-98835.yml | 15 +++++++++++++++ gems/fog-dragonfly/OSVDB-96798.yml | 13 +++++++++++++ gems/sounder/OSVDB-96278.yml | 13 +++++++++++++ gems/wicked/OSVDB-98270.yml | 14 ++++++++++++++ 6 files changed, 73 insertions(+) create mode 100644 gems/actionmailer/OSVDB-98629.yml create mode 100644 gems/cocaine/OSVDB-98835.yml create mode 100644 gems/fog-dragonfly/OSVDB-96798.yml create mode 100644 gems/sounder/OSVDB-96278.yml create mode 100644 gems/wicked/OSVDB-98270.yml ruby-advisory-db: 64 advisories ``` Update the [ruby-advisory-db] and check `Gemfile.lock` (useful for CI runs): ```shell $ bundle-audit check --update ``` Checking the `Gemfile.lock` without updating the [ruby-advisory-db]: ```shell $ bundle-audit check --no-update ``` Ignore specific advisories: ```shell $ bundle-audit check --ignore OSVDB-108664 ``` Checking a custom `Gemfile.lock` file: ```shell $ bundle-audit check --gemfile-lock Gemfile.custom.lock ``` Output the audit's results in JSON: ```shell $ bundle-audit check --format json ``` Output the audit's results in JSON, to a file: ```shell $ bundle-audit check --format json --output bundle-audit.json ``` ## Rake Tasks Bundler-audit provides `rake` tasks for checking the code and for updating its vulnerability database. Simply add the following code to the `Rakefile`: ```ruby require 'bundler/audit/task' Bundler::Audit::Task.new ``` The following `rake` tasks will then become available: ``` $ rake -T rake bundle:audit rake bundle:audit:update ``` ## Configuration File bundler-audit also supports a per-project configuration file: `.bundler-audit.yml`: ```yaml --- ignore: - CVE-YYYY-XXXX - ... ``` * `ignore:` \[Array\<String\>\] - A list of advisory IDs to ignore. You can provide a path to a config file using the `--config` flag: ```shell $ bundle-audit check --config bundler-audit.custom.yaml ``` ## Requirements * [git] * [ruby] >= 2.0.0 * [rubygems] >= 1.8 * [thor] ~> 1.0 * [bundler] >= 1.2.0, < 3 ## Install ```shell $ [sudo] gem install bundler-audit ``` ### Git * Debian / Ubuntu: ```shell $ sudo apt install git ``` * RedHat / Fedora: ```shell $ sudo dnf install git ``` * Alpine Linux: ```shell $ apk add git ``` * macOS: ```shell $ brew install git ``` ## Contributing 1. https://github.com/rubysec/bundler-audit/fork 2. `git clone YOUR_FORK_URI` 3. `cd bundler-audit/` 4. `bundle install` 5. `bundle exec rake spec` 6. `git checkout -b YOUR_FEATURE` 7. Make your changes 8. `bundle exec rake spec` 9. `git commit -a` 10. `git push origin YOUR_FEATURE` ## License Copyright (c) 2013-2024 Hal Brodigan (postmodern.mod3 at gmail.com) bundler-audit is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. bundler-audit is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with bundler-audit. If not, see <https://www.gnu.org/licenses/>. [git]: https://git-scm.com [ruby]: https://ruby-lang.org [rubygems]: https://rubygems.org [thor]: http://whatisthor.com/ [bundler]: https://bundler.io [OSVDB]: http://osvdb.org/ [ruby-advisory-db]: https://github.com/rubysec/ruby-advisory-db ", Assign "at most 3 tags" to the expected json: {"id":"12568","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"