diff --git a/lib/bundler/audit/scanner.rb b/lib/bundler/audit/scanner.rb index 1db3a468..9b1e23ff 100644 --- a/lib/bundler/audit/scanner.rb +++ b/lib/bundler/audit/scanner.rb @@ -224,7 +224,7 @@ def scan_specs(options={}) config.ignore end - @lockfile.specs.each do |gem| + @lockfile.specs.select { |gem| gem.platform == "ruby" }.each do |gem| @database.check_gem(gem) do |advisory| is_ignored = ignore.intersect?(advisory.identifiers.to_set) next if is_ignored diff --git a/spec/bundle/secure/Gemfile b/spec/bundle/secure/Gemfile index b3f2800c..8c4f4478 100644 --- a/spec/bundle/secure/Gemfile +++ b/spec/bundle/secure/Gemfile @@ -1,4 +1,4 @@ source 'https://rubygems.org' -gem 'rails', '~> 5.2' +gem 'rails', '~> 7.0.4' gem 'rails-html-sanitizer', '~> 1.4.3' diff --git a/spec/bundle/secure/Gemfile.lock b/spec/bundle/secure/Gemfile.lock index f50e4ad9..56056241 100644 --- a/spec/bundle/secure/Gemfile.lock +++ b/spec/bundle/secure/Gemfile.lock @@ -1,55 +1,78 @@ GEM remote: https://rubygems.org/ specs: - actioncable (5.2.8) - actionpack (= 5.2.8) + actioncable (7.0.4) + actionpack (= 7.0.4) + activesupport (= 7.0.4) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailer (5.2.8) - actionpack (= 5.2.8) - actionview (= 5.2.8) - activejob (= 5.2.8) + actionmailbox (7.0.4) + actionpack (= 7.0.4) + activejob (= 7.0.4) + activerecord (= 7.0.4) + activestorage (= 7.0.4) + activesupport (= 7.0.4) + mail (>= 2.7.1) + net-imap + net-pop + net-smtp + actionmailer (7.0.4) + actionpack (= 7.0.4) + actionview (= 7.0.4) + activejob (= 7.0.4) + activesupport (= 7.0.4) mail (~> 2.5, >= 2.5.4) + net-imap + net-pop + net-smtp rails-dom-testing (~> 2.0) - actionpack (5.2.8) - actionview (= 5.2.8) - activesupport (= 5.2.8) - rack (~> 2.0, >= 2.0.8) + actionpack (7.0.4) + actionview (= 7.0.4) + activesupport (= 7.0.4) + rack (~> 2.0, >= 2.2.0) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.0, >= 1.0.2) - actionview (5.2.8) - activesupport (= 5.2.8) + rails-html-sanitizer (~> 1.0, >= 1.2.0) + actiontext (7.0.4) + actionpack (= 7.0.4) + activerecord (= 7.0.4) + activestorage (= 7.0.4) + activesupport (= 7.0.4) + globalid (>= 0.6.0) + nokogiri (>= 1.8.5) + actionview (7.0.4) + activesupport (= 7.0.4) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) - rails-html-sanitizer (~> 1.0, >= 1.0.3) - activejob (5.2.8) - activesupport (= 5.2.8) + rails-html-sanitizer (~> 1.1, >= 1.2.0) + activejob (7.0.4) + activesupport (= 7.0.4) globalid (>= 0.3.6) - activemodel (5.2.8) - activesupport (= 5.2.8) - activerecord (5.2.8) - activemodel (= 5.2.8) - activesupport (= 5.2.8) - arel (>= 9.0) - activestorage (5.2.8) - actionpack (= 5.2.8) - activerecord (= 5.2.8) - marcel (~> 1.0.0) - activesupport (5.2.8) + activemodel (7.0.4) + activesupport (= 7.0.4) + activerecord (7.0.4) + activemodel (= 7.0.4) + activesupport (= 7.0.4) + activestorage (7.0.4) + actionpack (= 7.0.4) + activejob (= 7.0.4) + activerecord (= 7.0.4) + activesupport (= 7.0.4) + marcel (~> 1.0) + mini_mime (>= 1.1.0) + activesupport (7.0.4) concurrent-ruby (~> 1.0, >= 1.0.2) - i18n (>= 0.7, < 2) - minitest (~> 5.1) - tzinfo (~> 1.1) - arel (9.0.0) + i18n (>= 1.6, < 2) + minitest (>= 5.1) + tzinfo (~> 2.0) builder (3.2.4) concurrent-ruby (1.1.10) crass (1.0.6) - erubi (1.10.0) + erubi (1.11.0) globalid (1.0.0) activesupport (>= 5.0) - i18n (1.10.0) + i18n (1.12.0) concurrent-ruby (~> 1.0) loofah (2.18.0) crass (~> 1.0.2) @@ -60,63 +83,67 @@ GEM method_source (1.0.0) mini_mime (1.1.2) mini_portile2 (2.8.0) - minitest (5.15.0) + minitest (5.16.3) + net-imap (0.3.1) + net-protocol + net-pop (0.1.2) + net-protocol + net-protocol (0.1.3) + timeout + net-smtp (0.3.2) + net-protocol nio4r (2.5.8) - nokogiri (1.13.6) + nokogiri (1.13.9) mini_portile2 (~> 2.8.0) racc (~> 1.4) - nokogiri (1.13.6-x86_64-linux) + nokogiri (1.13.9-x86_64-linux) racc (~> 1.4) racc (1.6.0) rack (2.2.4) - rack-test (1.1.0) - rack (>= 1.0, < 3) - rails (5.2.8) - actioncable (= 5.2.8) - actionmailer (= 5.2.8) - actionpack (= 5.2.8) - actionview (= 5.2.8) - activejob (= 5.2.8) - activemodel (= 5.2.8) - activerecord (= 5.2.8) - activestorage (= 5.2.8) - activesupport (= 5.2.8) - bundler (>= 1.3.0) - railties (= 5.2.8) - sprockets-rails (>= 2.0.0) + rack-test (2.0.2) + rack (>= 1.3) + rails (7.0.4) + actioncable (= 7.0.4) + actionmailbox (= 7.0.4) + actionmailer (= 7.0.4) + actionpack (= 7.0.4) + actiontext (= 7.0.4) + actionview (= 7.0.4) + activejob (= 7.0.4) + activemodel (= 7.0.4) + activerecord (= 7.0.4) + activestorage (= 7.0.4) + activesupport (= 7.0.4) + bundler (>= 1.15.0) + railties (= 7.0.4) rails-dom-testing (2.0.3) activesupport (>= 4.2.0) nokogiri (>= 1.6) rails-html-sanitizer (1.4.3) loofah (~> 2.3) - railties (5.2.8) - actionpack (= 5.2.8) - activesupport (= 5.2.8) + railties (7.0.4) + actionpack (= 7.0.4) + activesupport (= 7.0.4) method_source - rake (>= 0.8.7) - thor (>= 0.19.0, < 2.0) + rake (>= 12.2) + thor (~> 1.0) + zeitwerk (~> 2.5) rake (13.0.6) - sprockets (4.0.3) - concurrent-ruby (~> 1.0) - rack (> 1, < 3) - sprockets-rails (3.4.2) - actionpack (>= 5.2) - activesupport (>= 5.2) - sprockets (>= 3.0.0) thor (1.2.1) - thread_safe (0.3.6) - tzinfo (1.2.9) - thread_safe (~> 0.1) + timeout (0.3.0) + tzinfo (2.0.5) + concurrent-ruby (~> 1.0) websocket-driver (0.7.5) websocket-extensions (>= 0.1.0) websocket-extensions (0.1.5) + zeitwerk (2.6.1) PLATFORMS ruby x86_64-linux DEPENDENCIES - rails (~> 5.2) + rails (~> 7.0.4) rails-html-sanitizer (~> 1.4.3) BUNDLED WITH diff --git a/spec/bundle/unpatched_gems/Gemfile b/spec/bundle/unpatched_gems/Gemfile index 40f61778..186221bb 100644 --- a/spec/bundle/unpatched_gems/Gemfile +++ b/spec/bundle/unpatched_gems/Gemfile @@ -1,3 +1,4 @@ source 'https://rubygems.org' gem 'activerecord', '3.2.10' +gem 'nokogiri', '1.13.6' diff --git a/spec/bundle/unpatched_gems/Gemfile.lock b/spec/bundle/unpatched_gems/Gemfile.lock index 81e6b636..43183358 100644 --- a/spec/bundle/unpatched_gems/Gemfile.lock +++ b/spec/bundle/unpatched_gems/Gemfile.lock @@ -17,7 +17,14 @@ GEM concurrent-ruby (1.1.7) i18n (0.9.5) concurrent-ruby (~> 1.0) + mini_portile2 (2.8.0) multi_json (1.15.0) + nokogiri (1.13.6) + mini_portile2 (~> 2.8.0) + racc (~> 1.4) + nokogiri (1.13.6-x86_64-linux) + racc (~> 1.4) + racc (1.6.0) tzinfo (0.3.58) PLATFORMS @@ -26,6 +33,7 @@ PLATFORMS DEPENDENCIES activerecord (= 3.2.10) + nokogiri (= 1.13.6) BUNDLED WITH - 2.2.0 + 2.3.4 diff --git a/spec/scanner_spec.rb b/spec/scanner_spec.rb index 6c742a77..d229108a 100644 --- a/spec/scanner_spec.rb +++ b/spec/scanner_spec.rb @@ -33,6 +33,10 @@ result.advisory.vulnerable?(result.gem.version) }).to be_truthy end + + it "should have duplicates due to platform" do + expect(subject.select { |advisory| advisory.gem.name == 'nokogiri' }.map { |advisory| "#{advisory.gem.name}##{advisory.gem.version}##{advisory.gem.platform}" }).to eq(["nokogiri#1.13.6#ruby"]) + end end context "when the :ignore option is given" do diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index 79daae56..bb99a759 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -12,7 +12,7 @@ module Fixtures module Database PATH = File.join(ROOT,'database') - COMMIT = '89cdde9a725bb6f8a483bca97c5da344e060ac61' + COMMIT = '137a425b9f4f30f895df8765b0e773400170803d' def self.clone system 'git', 'clone', '--quiet', Bundler::Audit::Database::URL, PATH