From 85381cfa39f958f5b92dd54fbe7168643b445285 Mon Sep 17 00:00:00 2001 From: Jay Varner Date: Mon, 17 Jun 2019 09:33:06 -0700 Subject: [PATCH] Updating GEMs to address security warnings. Updated deprecated use of Faker. --- Gemfile | 2 + Gemfile.lock | 198 ++++++++++++++----------- app/controllers/v1/tours_controller.rb | 2 +- config/initializers/version.rb | 2 +- db/seeds.rb | 4 +- spec/factories/flat_pages.rb | 2 +- spec/factories/media.rb | 4 +- spec/factories/stops.rb | 2 +- spec/factories/tours.rb | 4 +- spec/models/user_spec-fix.rb | 2 +- spec/requests/v3/users_spec.fix | 4 +- 11 files changed, 126 insertions(+), 100 deletions(-) diff --git a/Gemfile b/Gemfile index ab9cbd4..2a8ea85 100644 --- a/Gemfile +++ b/Gemfile @@ -10,6 +10,7 @@ end # Bundle edge Rails instead: gem 'rails', github: 'rails/rails' gem 'rails', '~> 5.2.0' +gem "rack", ">= 2.0.6" gem 'pg' # Multitenancy for Rails and ActiveRecord gem 'apartment' @@ -20,6 +21,7 @@ gem 'acts-as-taggable-on', '~> 5.0' gem 'puma', '~> 3.7' # Use Redis adapter to run Action Cable in production gem 'redis', '~> 3.0' +gem "actionview", ">= 5.2.2.1" # Use ActiveModel has_secure_password # gem 'bcrypt', '~> 3.1.7' diff --git a/Gemfile.lock b/Gemfile.lock index bb9af4c..c79273f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -10,11 +10,16 @@ GIT GIT remote: https://github.com/stympy/faker.git - revision: a9f579d70aa907be7bf895f84cff186124bd9484 + revision: a48340cb30afc2e9be43342b09662b831267a1c5 branch: master specs: - faker (1.9.1) + faker (1.9.3) i18n (>= 0.7) + pastel (~> 0.7.2) + thor (~> 0.20.0) + tty-pager (~> 0.12.0) + tty-screen (~> 0.6.5) + tty-tree (~> 0.3.0) GIT remote: https://github.com/thoughtbot/shoulda-matchers.git @@ -27,55 +32,55 @@ GIT GEM remote: https://rubygems.org/ specs: - actioncable (5.2.1) - actionpack (= 5.2.1) + actioncable (5.2.3) + actionpack (= 5.2.3) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailer (5.2.1) - actionpack (= 5.2.1) - actionview (= 5.2.1) - activejob (= 5.2.1) + actionmailer (5.2.3) + actionpack (= 5.2.3) + actionview (= 5.2.3) + activejob (= 5.2.3) mail (~> 2.5, >= 2.5.4) rails-dom-testing (~> 2.0) - actionpack (5.2.1) - actionview (= 5.2.1) - activesupport (= 5.2.1) + actionpack (5.2.3) + actionview (= 5.2.3) + activesupport (= 5.2.3) rack (~> 2.0) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.2.1) - activesupport (= 5.2.1) + actionview (5.2.3) + activesupport (= 5.2.3) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.0.3) - active_model_serializers (0.10.8) + active_model_serializers (0.10.9) actionpack (>= 4.1, < 6) activemodel (>= 4.1, < 6) case_transform (>= 0.2) jsonapi-renderer (>= 0.1.1.beta1, < 0.3) - activejob (5.2.1) - activesupport (= 5.2.1) + activejob (5.2.3) + activesupport (= 5.2.3) globalid (>= 0.3.6) - activemodel (5.2.1) - activesupport (= 5.2.1) - activerecord (5.2.1) - activemodel (= 5.2.1) - activesupport (= 5.2.1) + activemodel (5.2.3) + activesupport (= 5.2.3) + activerecord (5.2.3) + activemodel (= 5.2.3) + activesupport (= 5.2.3) arel (>= 9.0) - activestorage (5.2.1) - actionpack (= 5.2.1) - activerecord (= 5.2.1) + activestorage (5.2.3) + actionpack (= 5.2.3) + activerecord (= 5.2.3) marcel (~> 0.3.1) - activesupport (5.2.1) + activesupport (5.2.3) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 0.7, < 2) minitest (~> 5.1) tzinfo (~> 1.1) acts-as-taggable-on (5.0.0) activerecord (>= 4.2.8) - airbrussh (1.3.1) + airbrussh (1.3.2) sshkit (>= 1.6.1, != 1.7.0) apartment (2.2.0) activerecord (>= 3.1.2, < 6.0) @@ -83,7 +88,7 @@ GEM public_suffix (>= 2) rack (>= 1.3.6) arel (9.0.0) - bcrypt (3.1.12) + bcrypt (3.1.13) builder (3.2.3) cancancan (2.3.0) capistrano (3.11.0) @@ -91,9 +96,8 @@ GEM i18n rake (>= 10.0.0) sshkit (>= 1.9.0) - capistrano-bundler (1.4.0) + capistrano-bundler (1.5.0) capistrano (~> 3.1) - sshkit (~> 1.2) capistrano-passenger (0.2.0) capistrano (~> 3.0) capistrano-rails (1.4.0) @@ -102,33 +106,34 @@ GEM capistrano-rbenv (2.1.4) capistrano (~> 3.1) sshkit (~> 1.3) - carrierwave (1.2.3) + carrierwave (1.3.1) activemodel (>= 4.0.0) activesupport (>= 4.0.0) mime-types (>= 1.16) case_transform (0.2) activesupport - concurrent-ruby (1.1.1) + concurrent-ruby (1.1.5) crass (1.0.4) database_cleaner (1.7.0) diff-lcs (1.3) - erubi (1.7.1) - factory_bot (4.11.1) - activesupport (>= 3.0.0) - factory_bot_rails (4.11.1) - factory_bot (~> 4.11.1) - railties (>= 3.0.0) - ffi (1.9.25) - globalid (0.4.1) + equatable (0.6.0) + erubi (1.8.0) + factory_bot (5.0.2) + activesupport (>= 4.2.0) + factory_bot_rails (5.0.2) + factory_bot (~> 5.0.2) + railties (>= 4.2.0) + ffi (1.11.1) + globalid (0.4.2) activesupport (>= 4.2.0) httparty (0.13.7) json (~> 1.8) multi_xml (>= 0.5.2) httpclient (2.8.3) - i18n (1.1.1) + i18n (1.6.0) concurrent-ruby (~> 1.0) json (1.8.6) - jsonapi-renderer (0.2.0) + jsonapi-renderer (0.2.2) listen (3.1.5) rb-fsevent (~> 0.9, >= 0.9.4) rb-inotify (~> 0.9, >= 0.9.7) @@ -140,44 +145,47 @@ GEM mini_mime (>= 0.1.1) marcel (0.3.3) mimemagic (~> 0.3.2) - method_source (0.9.1) + method_source (0.9.2) mime-types (3.2.2) mime-types-data (~> 3.2015) - mime-types-data (3.2018.0812) - mimemagic (0.3.2) - mini_magick (4.9.2) + mime-types-data (3.2019.0331) + mimemagic (0.3.3) + mini_magick (4.9.3) mini_mime (1.0.1) - mini_portile2 (2.3.0) + mini_portile2 (2.4.0) minitest (5.11.3) multi_xml (0.6.0) - multipart-post (2.0.0) - net-scp (1.2.1) - net-ssh (>= 2.6.5) - net-ssh (5.0.2) + multipart-post (2.1.1) + net-scp (2.0.0) + net-ssh (>= 2.6.5, < 6.0.0) + net-ssh (5.2.0) nio4r (2.3.1) - nokogiri (1.8.5) - mini_portile2 (~> 2.3.0) + nokogiri (1.10.3) + mini_portile2 (~> 2.4.0) oauth (0.5.4) - parallel (1.12.1) - pg (1.1.3) - public_suffix (3.0.3) - puma (3.12.0) - rack (2.0.5) - rack-cors (1.0.2) + parallel (1.17.0) + pastel (0.7.3) + equatable (~> 0.6) + tty-color (~> 0.5) + pg (1.1.4) + public_suffix (3.1.0) + puma (3.12.1) + rack (2.0.7) + rack-cors (1.0.3) rack-test (1.1.0) rack (>= 1.0, < 3) - rails (5.2.1) - actioncable (= 5.2.1) - actionmailer (= 5.2.1) - actionpack (= 5.2.1) - actionview (= 5.2.1) - activejob (= 5.2.1) - activemodel (= 5.2.1) - activerecord (= 5.2.1) - activestorage (= 5.2.1) - activesupport (= 5.2.1) + rails (5.2.3) + actioncable (= 5.2.3) + actionmailer (= 5.2.3) + actionpack (= 5.2.3) + actionview (= 5.2.3) + activejob (= 5.2.3) + activemodel (= 5.2.3) + activerecord (= 5.2.3) + activestorage (= 5.2.3) + activesupport (= 5.2.3) bundler (>= 1.3.0) - railties (= 5.2.1) + railties (= 5.2.3) sprockets-rails (>= 2.0.0) rails-dom-testing (2.0.3) activesupport (>= 4.2.0) @@ -188,26 +196,26 @@ GEM bcrypt (~> 3.1.7) httparty (~> 0.13.3) rails (>= 3.2.6, < 6) - railties (5.2.1) - actionpack (= 5.2.1) - activesupport (= 5.2.1) + railties (5.2.3) + actionpack (= 5.2.3) + activesupport (= 5.2.3) method_source rake (>= 0.8.7) thor (>= 0.19.0, < 2.0) - rake (12.3.1) + rake (12.3.2) rb-fsevent (0.10.3) - rb-inotify (0.9.10) - ffi (>= 0.5.0, < 2) + rb-inotify (0.10.0) + ffi (~> 1.0) redis (3.3.5) - rspec-core (3.8.0) + rspec-core (3.8.1) rspec-support (~> 3.8.0) - rspec-expectations (3.8.2) + rspec-expectations (3.8.4) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.8.0) - rspec-mocks (3.8.0) + rspec-mocks (3.8.1) diff-lcs (>= 1.2.0, < 2.0) rspec-support (~> 3.8.0) - rspec-rails (3.8.1) + rspec-rails (3.8.2) actionpack (>= 3.0) activesupport (>= 3.0) railties (>= 3.0) @@ -215,10 +223,9 @@ GEM rspec-expectations (~> 3.8.0) rspec-mocks (~> 3.8.0) rspec-support (~> 3.8.0) - rspec-support (3.8.0) + rspec-support (3.8.2) ruby_dep (1.5.0) - spring (2.0.2) - activesupport (>= 4.2) + spring (2.1.0) spring-watcher-listen (2.0.1) listen (>= 2.7, < 4.0) spring (>= 1.2, < 3.0) @@ -229,25 +236,40 @@ GEM actionpack (>= 4.0) activesupport (>= 4.0) sprockets (>= 3.0.0) - sshkit (1.18.0) + sshkit (1.18.2) net-scp (>= 1.1.2) net-ssh (>= 2.8.0) + strings (0.1.5) + strings-ansi (~> 0.1) + unicode-display_width (~> 1.5) + unicode_utils (~> 1.4) + strings-ansi (0.1.0) test-prof (0.9.0) - thor (0.20.0) + thor (0.20.3) thread_safe (0.3.6) + tty-color (0.5.0) + tty-pager (0.12.1) + strings (~> 0.1.4) + tty-screen (~> 0.6) + tty-which (~> 0.4) + tty-screen (0.6.5) + tty-tree (0.3.0) + tty-which (0.4.1) tzinfo (1.2.5) thread_safe (~> 0.1) + unicode-display_width (1.6.0) + unicode_utils (1.4.0) vimeo (1.5.4) httparty (>= 0.4.5) httpclient (>= 2.1.5.2) json (>= 1.1.9) multipart-post (>= 1.0.1) oauth (>= 0.4.3) - websocket-driver (0.7.0) + websocket-driver (0.7.1) websocket-extensions (>= 0.1.0) - websocket-extensions (0.1.3) + websocket-extensions (0.1.4) youtube_rails (1.2.2) - yt (0.32.2) + yt (0.32.3) activesupport yt-support (>= 0.1) yt-support (0.1.3) @@ -256,6 +278,7 @@ PLATFORMS ruby DEPENDENCIES + actionview (>= 5.2.2.1) active_model_serializers (~> 0.10.0.rc3) acts-as-taggable-on (~> 5.0) apartment @@ -273,6 +296,7 @@ DEPENDENCIES mini_magick pg puma (~> 3.7) + rack (>= 2.0.6) rack-cors rails (~> 5.2.0) redis (~> 3.0) diff --git a/app/controllers/v1/tours_controller.rb b/app/controllers/v1/tours_controller.rb index 2ed0e3a..07fa72e 100644 --- a/app/controllers/v1/tours_controller.rb +++ b/app/controllers/v1/tours_controller.rb @@ -4,6 +4,6 @@ # This is only for testing calls to versioned endpoints. class V1::ToursController < ApplicationController def index - json_response(message: Faker::HitchhikersGuideToTheGalaxy.quote) + json_response(message: Faker::Movies::HitchhikersGuideToTheGalaxy.quote) end end diff --git a/config/initializers/version.rb b/config/initializers/version.rb index 3c9df48..912d5d2 100644 --- a/config/initializers/version.rb +++ b/config/initializers/version.rb @@ -1,5 +1,5 @@ module OpenTourApi class Application - VERSION = '3.0.0rc' + VERSION = '3.0.1rc' end end \ No newline at end of file diff --git a/db/seeds.rb b/db/seeds.rb index 60cc08e..56ece18 100644 --- a/db/seeds.rb +++ b/db/seeds.rb @@ -46,9 +46,9 @@ 3.times { FactoryBot.create(:tour_set) } 4.times do - # User.create(display_name: Faker::Lebowski.character) + # User.create(display_name: Faker::Movies::Lebowski) FactoryBot.create(:login) - Login.last.user.update_attribute(:display_name, Faker::Lebowski.character) + Login.last.user.update_attribute(:display_name, Faker::Movies::Lebowski) end TourSet.all.each do |ts| diff --git a/spec/factories/flat_pages.rb b/spec/factories/flat_pages.rb index 051ca26..099bd0e 100644 --- a/spec/factories/flat_pages.rb +++ b/spec/factories/flat_pages.rb @@ -3,7 +3,7 @@ # spec/factories/users.rb FactoryBot.define do factory :flat_page do - title { Faker::HitchhikersGuideToTheGalaxy.planet } + title { Faker::Movies::HitchhikersGuideToTheGalaxy.planet } content { Faker::Hipster.paragraph(2, true, 4) } end end diff --git a/spec/factories/media.rb b/spec/factories/media.rb index 3ee6e4d..7b6151e 100644 --- a/spec/factories/media.rb +++ b/spec/factories/media.rb @@ -3,8 +3,8 @@ # spec/factories/media.rb FactoryBot.define do factory :medium do - title { Faker::RickAndMorty.character } - caption { Faker::RickAndMorty.quote } + title { Faker::TvShows::RickAndMorty.character } + caption { Faker::TvShows::RickAndMorty.quote } # original_image { Rack::Test::UploadedFile.new(Rails.root.join('spec', 'support', 'images', 'otblogo.png'), 'image/png') } remote_original_image_url { Faker::Placeholdit.image } created_at { Faker::Number.number(10) } diff --git a/spec/factories/stops.rb b/spec/factories/stops.rb index 5fed0e6..f62c1ca 100644 --- a/spec/factories/stops.rb +++ b/spec/factories/stops.rb @@ -3,7 +3,7 @@ # spec/factories/stops.rb FactoryBot.define do factory :stop do - title { Faker::HitchhikersGuideToTheGalaxy.planet } + title { Faker::Movies::HitchhikersGuideToTheGalaxy.planet } description { Faker::Hipster.paragraph(2, true, 4) } lat { Faker::Address.latitude } lng { Faker::Address.longitude } diff --git a/spec/factories/tours.rb b/spec/factories/tours.rb index 673fc21..2b8a703 100644 --- a/spec/factories/tours.rb +++ b/spec/factories/tours.rb @@ -3,8 +3,8 @@ # spec/factories/tours.rb FactoryBot.define do factory :tour do - title { Faker::RickAndMorty.character } - description { "

#{Faker::RickAndMorty.quote}

#{Faker::RickAndMorty.quote}

#{Faker::RickAndMorty.quote}

" } + title { Faker::TvShows::RickAndMorty.character } + description { "

#{Faker::TvShows::RickAndMorty.quote}

#{Faker::TvShows::RickAndMorty.quote}

#{Faker::TvShows::RickAndMorty.quote}

" } published { Faker::Boolean.boolean(0.5) } theme { Theme.create! } mode { Mode.create! } diff --git a/spec/models/user_spec-fix.rb b/spec/models/user_spec-fix.rb index c6a2874..209e73c 100644 --- a/spec/models/user_spec-fix.rb +++ b/spec/models/user_spec-fix.rb @@ -9,7 +9,7 @@ context 'creates login' do it 'creates login' do pw = Faker::Internet.password(8) - u = User.create!(displayname: Faker::HitchhikersGuideToTheGalaxy.character) + u = User.create!(displayname: Faker::Movies::HitchhikersGuideToTheGalaxy.character) Login.create!(identification: 'foo@bar.com', password: pw, password_confirmation: pw, user: u) # RailsApiAuth uses `has_secure_password` The `authenticate` method returns # the `Login` object. This just checks that the password authenticates diff --git a/spec/requests/v3/users_spec.fix b/spec/requests/v3/users_spec.fix index 11bf86d..93a0f06 100644 --- a/spec/requests/v3/users_spec.fix +++ b/spec/requests/v3/users_spec.fix @@ -4,7 +4,7 @@ require 'rails_helper' RSpec.describe 'V3::Users', type: :request do # initialize test data - let!(:name) { Faker::HitchhikersGuideToTheGalaxy.character } + let!(:name) { Faker::Movies::HitchhikersGuideToTheGalaxy.character } let!(:pw) { Faker::Internet.password(8) } let!(:email) { Faker::Internet.free_email } let!(:user) { create(:user, displayname: name) } @@ -45,7 +45,7 @@ RSpec.describe 'V3::Users', type: :request do end describe 'POST /users with password' do - let!(:name2) { Faker::HitchhikersGuideToTheGalaxy.character } + let!(:name2) { Faker::Movies::HitchhikersGuideToTheGalaxy.character } let!(:pw2) { Faker::Internet.password(8) } let!(:email2) { Faker::Internet.free_email } # valid payload