Giter Club home page Giter Club logo

codeclimate-bundler-audit's Introduction

Code Climate CLI

Code Climate CircleCI

Overview

codeclimate is a command line interface for the Code Climate analysis platform. It allows you to run Code Climate engines on your local machine inside of Docker containers.

Prerequisites

The Code Climate CLI is distributed and run as a Docker image. The engines that perform the actual analyses are also Docker images. To support this, you must have Docker installed and running locally. We also require that the Docker daemon supports connections on the default Unix socket /var/run/docker.sock.

On macOS, we recommend using Docker for Mac.

Installation

macOS

brew tap codeclimate/formulae
brew install codeclimate

To update the brew package, use brew update first:

brew update
brew upgrade codeclimate

Anywhere

curl -L https://github.com/codeclimate/codeclimate/archive/master.tar.gz | tar xvz
cd codeclimate-* && sudo make install

To upgrade to a newer version, just run those steps again.

Manual Docker invocation

The above packages pull the docker image and install a shell script wrapper. In some cases you may want to run the docker image directly.

To pull the docker image:

docker pull codeclimate/codeclimate

To invoke the CLI via Docker:

docker run \
  --interactive --tty --rm \
  --env CODECLIMATE_CODE="$PWD" \
  --volume "$PWD":/code \
  --volume /var/run/docker.sock:/var/run/docker.sock \
  --volume /tmp/cc:/tmp/cc \
  codeclimate/codeclimate help

Project setup

Configuration

No explicit configuration is needed: by default codeclimate analyze will evaluate supported source files in your repository using our maintainability checks. To change default configuration to customize how the maintainability checks are evaluated, or to turn on open source plugins, see our documentation on advanced configuration.

Plugin installation

Plugins, or "engines", are the docker images that run analysis tools. We support many different plugins, and will only install the ones necessary to run analysis. As part of setting up your project, we recommend running codeclimate engines:install from within your repository before running codeclimate analyze, and after adding any new plugins to your configuration file.

Running analysis

Once you've installed plugins and made any necessary changes to your configuration, run codeclimate analyze to run analysis and see a report on any issues in your repository.

Commands

A list of available commands is accessible by running codeclimate or codeclimate help.

$ codeclimate help

Available commands:
    analyze [-f format] [-e engine[:channel]] [--dev] [path]
    console
    engines:install
    engines:list
    help [command]
    prepare [--allow-internal-ips]
    validate-config
    version

The following is a brief explanation of each available command.

  • analyze Analyze all relevant files in the current working directory. All engines that are enabled in your .codeclimate.yml file will run, one after another. The -f (or format) argument allows you to set the output format of the analysis (using json, text, or html). The --dev flag lets you run engines not known to the CLI, for example if you're an engine author developing your own, unreleased image.

    You can optionally provide a specific path to analyze. If not provided, the CLI will analyze your entire repository, except for your configured exclude_paths. When you do provide an explicit path to analyze, your configured exclude_paths are ignored, and normally excluded files will be analyzed.

    You can also pipe in source in combination with a path to analyze code that is not yet written to disk. This is useful when you want to check if your source code style matches the project's. This is also a good way to implement integration with an editor to check style on the fly.

  • console start an interactive session providing access to the classes within the CLI. Useful for engine developers and maintainers.

  • engines:install Compares the list of engines in your .codeclimate.yml file to those that are currently installed, then installs any missing engines and checks for new images available for existing engines.

  • engines:list Lists all available engines in the Code Climate Docker Hub .

  • help Displays a list of commands that can be passed to the Code Climate CLI.

  • validate-config Validates the .codeclimate.yml file in the current working directory.

  • version Displays the current version of the Code Climate CLI.

Environment Variables

  • To run codeclimate in debug mode:

    CODECLIMATE_DEBUG=1 codeclimate analyze
    

    Prints additional information about the analysis steps, including any stderr produced by engines.

  • To increase the amount of time each engine container may run (default 15 min):

    # 30 minutes
    CONTAINER_TIMEOUT_SECONDS=1800 codeclimate analyze
    
  • You can also configure the default alotted memory with which each engine runs (default is 1,024,000,000 bytes):

    # 2,000,000,000 bytes
    ENGINE_MEMORY_LIMIT_BYTES=2000000000 codeclimate analyze
    

Releasing a new version

CLI's new versions are released automatically when updating VERSION on master.

The releasing process includes;

  1. Push new version to rubygems.
  2. Create a new release on Github and an associated tag.
  3. Update docker images:
  • Push new latest image.
  • Push new image with latest version as tag.

Ideally someone will open a pull request against master updating only VERSION.

There is script in place, which assumes hub is installed, to facilitate that. Check the current VERSION (cat VERSION) and upgrade accordingly running:

./bin/prep-release <VERSION>

Copyright

See LICENSE

codeclimate-bundler-audit's People

Contributors

dantevvp avatar dblandin avatar efueger avatar fede-moya avatar filipesperandio avatar gdiggs avatar jpignata avatar larkinscott avatar maxjacobson avatar noelia-lencina avatar nporteschaikin avatar pbrisbin avatar piotrpawlik avatar pointlessone avatar wfleming avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

codeclimate-bundler-audit's Issues

bundle-audit update?

As it stands now, I think bundle-audit update can only happen when a new image version is created. What can be done to allow the vulnerability database to be updated more often than when a new repo commit?

Why does this fail in a rubygem?

Rubygems are not supposed to commit their Gemfile.lock...

So why is this project running and failing builds on CodeClimate?

Took me so long to figure out this was breaking my CodeClimate integration that I've already begun migrating to other services... (CodeCov, etc)

Please fix!

Failure: https://codeclimate.com/github/pboling/shiftable/builds/26

Screen Shot 2021-10-27 at 7 12 06 PM

  1. I did not turn this on
  2. I don't know how to turn it off
  3. It is breaking my CC build
  4. That prevents my stats from updating, leaving my repo's badges stale
  5. RubyGems shouldn't ever depend on a Gemfile.lock, it doesn't make ANY sense.

๐Ÿ’ข

support finding the Gemfile.lock in a subdirectory

While I understand it is not common for the Gemfile to be anywhere but in the root of the repository, I have a project where it is under the test/ directory. In its current state, this audit is unable to find it and I get the following error:

/usr/src/app/lib/cc/engine/bundler_audit/analyzer.rb:16:in `run': No Gemfile.lock found. (CC::Engine::BundlerAudit::Analyzer::GemfileLockNotFound)
    from /usr/src/app/bin/bundler-audit:7:in `<main>'

Would it be possible to either scan subdirectories or enable a configuration so that the containing directory could be provided?

no vulnerabilities

the same problem as #5 and #7

consider using bundle-audit check --update to auto update the vulnerabilities database

ruby-advisory-db out of date, CC wrongly analyzing upgrades to Rails v4.2.6

On one hand, according to https://hub.docker.com/r/codeclimate/codeclimate-bundler-audit/, it was last pushed 9 days ago.

On the other hand, due to this (already solved) issue in ruby-advisory-db, several vulnerabilities were being wrongly reported for Rails v4.2.6.

It would be nice if you could re-build the image (so it runs bundle-audit update) to get rid of all those fake warnings when analyzing the dependencies' upgrade.

Thank you in advance!

Ignore switch

Is there any way to specify issues to ignore, like can be done with the --ignore switch to bundle-audit on the command line?

Does not find Vulnerability

When I run bundler-audit gem on the command line, it finds:

$ bundle-audit check
Name: uglifier
Version: 2.7.1
Advisory: 126747
Criticality: Unknown
URL: https://github.com/mishoo/UglifyJS2/issues/751
Title: uglifier incorrectly handles non-boolean comparisons during minification
Solution: upgrade to >= 2.7.2

Vulnerabilities found!

When I run in it on CodeClimate CLI, i get:

Starting analysis

Analysis complete! Found 0 issues.

There is version 0.7.0.1 of bundler-audit available

It was released some time ago https://github.com/rubysec/bundler-audit/blob/master/ChangeLog.md

codeclimate-bundler-audit is still using old version.

This is resulting in some vulnerabilities not being found.

Output from version 0.6.1 is not detecting rack vulnerability, which is detected by 0.7.0:

Name: rack
Version: 2.0.9
Advisory: CVE-2020-8161
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA
Description:

  There was a possible directory traversal vulnerability in the Rack::Directory app that is bundled with Rack.

  Versions Affected: rack < 2.2.0 Not affected: Applications that do not use Rack::Directory. Fixed Versions: 2.1.3, >= 2.2.0

  Impact ------

  If certain directories exist in a director that is managed by `Rack::Directory`, an attacker could, using this vulnerability,
  read the contents of files on the server that were outside of the root specified in the Rack::Directory initializer.

  Workarounds -----------

  Until such time as the patch is applied or their Rack version is upgraded, we recommend that developers do not use
  Rack::Directory in their applications.

Solution: upgrade to ~> 2.1.3, >= 2.2.0

Vulnerabilities found!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.