Class: Bundler::Audit::Advisory

Inherits:
Struct
  • Object
show all
Defined in:
lib/bundler/audit/advisory.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#cve ⇒ Object

Returns the value of attribute cve

Returns:

  • (Object) —

    the current value of cve



22
23
24
 
# File 'lib/bundler/audit/advisory.rb', line 22

def cve
  @cve
end

#cvss_v2 ⇒ Object

Returns the value of attribute cvss_v2

Returns:

  • (Object) —

    the current value of cvss_v2



22
23
24
 
# File 'lib/bundler/audit/advisory.rb', line 22

def cvss_v2
  @cvss_v2
end

#description ⇒ Object

Returns the value of attribute description

Returns:

  • (Object) —

    the current value of description



22
23
24
 
# File 'lib/bundler/audit/advisory.rb', line 22

def description
  @description
end

#patched_versions ⇒ Object

Returns the value of attribute patched_versions

Returns:

  • (Object) —

    the current value of patched_versions



22
23
24
 
# File 'lib/bundler/audit/advisory.rb', line 22

def patched_versions
  @patched_versions
end

#title ⇒ Object

Returns the value of attribute title

Returns:

  • (Object) —

    the current value of title



22
23
24
 
# File 'lib/bundler/audit/advisory.rb', line 22

def title
  @title
end

#url ⇒ Object

Returns the value of attribute url

Returns:

  • (Object) —

    the current value of url



22
23
24
 
# File 'lib/bundler/audit/advisory.rb', line 22

def url
  @url
end

Class Method Details

.load(path) ⇒ Advisory

Loads the advisory from a YAML file.

Parameters:

  • path (String) —

    The path to the advisory YAML file.

Returns:



39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
 
# File 'lib/bundler/audit/advisory.rb', line 39

def self.load(path)
  cve  = File.basename(path).chomp('.yml')
  data = YAML.load_file(path)

  unless data.kind_of?(Hash)
    raise("advisory data in #{path.dump} was not a Hash")
  end

  return new(
    cve,
    data['url'],
    data['title'],
    data['description'],
    data['cvss_v2'],
    Array(data['patched_versions']).map { |version|
      Gem::Requirement.new(*version.split(', '))
    },
  )
end

Instance Method Details

#criticality ⇒ :low, ...

Determines how critical the vulnerability is.

Returns:

  • (:low, :medium, :high) —

    The criticality of the vulnerability based on the CVSSv2 score.



65
66
67
68
69
70
71
 
# File 'lib/bundler/audit/advisory.rb', line 65

def criticality
  case cvss_v2
  when 0.0..3.3  then :low
  when 3.3..6.6  then :medium
  when 6.6..10.0 then :high
  end
end

#vulnerable?(version) ⇒ Boolean

Checks whether the version is vulnerable to the advisory.

Parameters:

Returns:

  • (Boolean) —

    Specifies whether the version is vulnerable to the advisory or not.



82
83
84
85
86
 
# File 'lib/bundler/audit/advisory.rb', line 82

def vulnerable?(version)
  !patched_versions.any? do |patched_version|
    patched_version === version
  end
end