3 ms·
For gems I use `bundler-audit`, see: https://github.com/rubysec/bundler-audit https://github.com/rubysec/bundler-audit It checks for vulnerable versions of gem
by itsmrwave 9y ago
For gems I use `bundler-audit`, see:
https://github.com/rubysec/bundler-audit https://github.com/rubysec/bundler-audit
It checks for vulnerable versions of gems in `Gemfile.lock`, checks for insecure gem sources, allows ignoring certain advisories that have been manually worked around, prints advisory information and does not require a network connection.
- bazzargh 9y agoOne of my workmates open-sourced this: https://github.com/livingsocial/bundler-patch https://github.com/livingsocial/bundler-patch ...which is mostly what we used internally for working with bundler-audit. We ran this scan in CI, on deploy, and also on a cron for apps that might not have deployed in a while. Internally this created PRs automatically, and PRs triggered CI, so eg when a nokogiri CVE was announced (which affects a lot of projects), all apps would have tested PRs ready to merge. That piece wasn't open-sourced I think...it's fairly trivial but I'll see if I can get it released. We also did scans on clojure projects, again I'm not sure that's made it out into the world, I'll look into it.
- bazzargh 9y agoThe clojure piece - I'd just forgotten the name. https://github.com/livingsocial/lein-dependency-check https://github.com/livingsocial/lein-dependency-check
- matthewrudy 9y agoFor extra info, bundler-audit relies on https://github.com/rubysec/ruby-advisory-db https://github.com/rubysec/ruby-advisory-db