Project

bundler-organization_audit

0.02
No commit activity in last 3 years
No release in over 3 years
bundler-organization_auditgrosser/bundler-organization_auditHomepageDocumentationSource CodeBug TrackerWiki
Audit all Gemfiles of a user/organization on github for unpatched versions
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Popularity
Downloads
20,697
Stars
50
Forks
2
Watchers
6
 Releases
Current version
0.3.0
Total releases
6
First release
2013-02-18
Latest release
2014-04-29
 Pull Requests
Open Pull Requests
1
Closed Pull Requests
1
Merged Pull Requests
0
Pull Request Acceptance Rate
0%
 Development
Primary Language
Ruby
Licenses
MIT
Average date of last 50 commits
2013-10-26
Reverse Dependencies
0

 Dependencies

Runtime

organization_audit
>= 0.2.0
 Project Readme

Audit all Gemfiles of a user/organization on Github for unpatched versions

# simple
gem install bundler-organization_audit
bundle-audit update # get fresh vulnerability data
bundle-organization-audit ... options ...

Usage

Public repos

For yourself (git config github.user)

bundle-organization-audit
parallel
No Gemfile.lock found

parllel_tests
bundle-audit
No unpatched versions found

rails_example_app
bundle-audit
Name: rack
Version: 1.4.4
Advisory: OSVDB-101458
Criticality: High
URL: http://osvdb.org/show/osvdb/89939
Title: Rack Rack::Session::Cookie Function Timing Attack Remote Code Execution
Patched Versions: ~> 1.1.6, ~> 1.2.8, ~> 1.3.10, ~> 1.4.5, >= 1.5.2

Vulnerable:
https://github.com/grosser/rails_example_app -- Peter Last Committer <peter@last-commit-email.com>

For someone else

bundle-organization-audit --user grosser

Ignore gems (ignores repos that have a %{repo}.gemspec)

bundle-organization-audit --ignore-gems

Silent: only show vulnerable repos

bundle-organization-audit 2>/dev/null

CI: ignore old/unmaintained proejcts, unfixable/unimportant advisories and gems

bundle-organization-audit \
  --ignore https://github.com/xxx/a \
  --ignore https://github.com/xxx/b \
  --ignore-advisory OSVDB-101458 \
  --ignore-gems \
  --organization xxx \
  --token yyy

Private repos

# create a token that has access to your repositories
curl -v -u your-user-name -X POST https://api.github.com/authorizations --data '{"scopes":["repo"]}'
enter your password -> TOKEN

bundle-organization-audit --user your-user --token TOKEN --organization your-organization

Related

  • holepicker does the same check for local projects and running servers
  • bundler-audit check a single local project for vulnerabilities

Development

  • test private repo fetching via cp spec/private{.example,}.yml and filling it out

Author

Michael Grosser
michael@grosser.it
License: MIT
Build Status