Check your gems whether affected by RubyGems.org gem replacement vulnerability and mitigation
- Ruby 2.1+
- git
$ gem install rubygems_check_replacement_vulnerability
Run rubygems_check_replacement_vulnerability vulnerable_gems command
$ rubygems_check_replacement_vulnerability vulnerable_gems --username=<USERNAME>Example
$ rubygems_check_replacement_vulnerability vulnerable_gems --username=sue445
sue445's vulnerable gems
- faker-precure : 0.0.2, 0.0.3
- fluent-plugin-out_chatwork : 0.0.1, 0.0.2, 0.0.3
- pebbles-tokyu_ruby_kaigi : 0.0.2
- rspec-every_item : 0.0.1
- rspec-parameterized : 0.1.2
- rspec-temp_dir : 0.0.1, 0.0.2, 0.0.3Algorithm
- Search gem versions that including the conditions of the following
- name contains a dash (e.g.
blank-blank) - pushed between June 11th, 2014 and April 2nd, 2016
- name contains a dash (e.g.
Run rubygems_check_replacement_vulnerability verify_gem command
$ rubygems_check_replacement_vulnerability verify_gem --name=<GEM_NAME> --repo-url=<REPO_URL>Example
$ rubygems_check_replacement_vulnerability verify_gem --name=rspec-temp_dir --repo-url=git@github.com:sue445/rspec-temp_dir.git
Unpacked gem: '/var/folders/mx/mmp8n_lx48v8_fr294_zjggw0000gn/T/gem-20160414-51500-dtg1p7/rspec-temp_dir-0.0.1'
[Info] rspec-temp_dir 0.0.1 is safe!
Unpacked gem: '/var/folders/mx/mmp8n_lx48v8_fr294_zjggw0000gn/T/gem-20160414-51500-1hpgj5i/rspec-temp_dir-0.0.2'
[Info] rspec-temp_dir 0.0.2 is safe!
Unpacked gem: '/var/folders/mx/mmp8n_lx48v8_fr294_zjggw0000gn/T/gem-20160414-51500-7aquji/rspec-temp_dir-0.0.3'
[Info] rspec-temp_dir 0.0.3 is safe!Algorithm
- Download specified gem file (e.g.
rspec-temp_dir-0.0.3.gem) from rubygems.org - Unpack gem to temporary directory
- e.g.
gem unpack rspec-temp_dir-0.0.3.gem
- e.g.
- Clone from remote repository to temporary directory
- e.g.
git clone git@github.com:sue445/rspec-temp_dir.git
- e.g.
- Checkout version tag
- e.g.
git checkout v0.0.3 - If version tag is not found, print warning message
- e.g.
[Warn] Not found tag v0.0.3 in repository
- e.g.
- e.g.
- Compare all files between unpacked gem files and repository files
Run help
$ rubygems_check_replacement_vulnerability help
Commands:
rubygems_check_replacement_vulnerability help [COMMAND] # Describe available commands or one specifi...
rubygems_check_replacement_vulnerability verify_gem n, --name=NAME u, --repo-url=REPO_URL # Verify whether replacemented gem
rubygems_check_replacement_vulnerability version # Show version
rubygems_check_replacement_vulnerability vulnerable_gems u, --username=USERNAME # Show vulnerable gems$ rubygems_check_replacement_vulnerability help vulnerable_gems
Usage:
rubygems_check_replacement_vulnerability vulnerable_gems u, --username=USERNAME
Options:
u, --username=USERNAME # Username of rubygems.org
f, [--format=FORMAT] # Print format (plain, yaml, json)
# Default: plain
Show vulnerable gems$ rubygems_check_replacement_vulnerability help verify_gem
Usage:
rubygems_check_replacement_vulnerability verify_gem n, --name=NAME u, --repo-url=REPO_URL
Options:
n, --name=NAME # Gem name
v, [--version=VERSION] # Version to check (default: all vulnerable versions)
u, --repo-url=REPO_URL # Git repository url (e.g. git@github.com:rails/rails.git)
p, [--prefix=PREFIX] # gemspec path prefix in repo (e.g. activerecord/)
Verify whether replacemented gem
After checking out the repo, run bin/setup to install dependencies. Then, run rake spec to run the tests. You can also run bin/console for an interactive prompt that will allow you to experiment. Run bundle exec rubygems_check_replacement_vulnerability to use the gem in this directory, ignoring other installed copies of this gem.
To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release, which will create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.
Bug reports and pull requests are welcome on GitHub at https://github.com/sue445/rubygems_check_replacement_vulnerability.
The gem is available as open source under the terms of the MIT License.