Class: DependencyBot::Checker::BundleAudit

Inherits:
Object
  • Object
show all
Defined in:
lib/dependency_bot/checker/bundle_audit.rb

Overview

This class is responsible for checking the Gemfile.lock for vulnerabilities using the Bundler::Audit gem. It updates the vulnerability database and scans the Gemfile.lock for known vulnerabilities. It returns an array of DependencyBot::DependencyGem objects for each vulnerable gem found. # Usage: “‘ruby checker = DependencyBot::Checker::BundleAudit.new vulnerable_gems = checker.verify # vulnerable_gems.each do |gem| # puts “Vulnerable gem: #gemgem.name” # end “`

Instance Method Summary collapse

Constructor Details

#initialize ⇒ BundleAudit

Returns a new instance of BundleAudit.



21
22
23
 
# File 'lib/dependency_bot/checker/bundle_audit.rb', line 21

def initialize
  @dependencies = []
end

Instance Method Details

#verify ⇒ Object 



25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/dependency_bot/checker/bundle_audit.rb', line 25

def verify
  # Update the vulnerability database
  Bundler::Audit::Database.update!

  # Scan the Gemfile.lock for vulnerabilities
  scanner = Bundler::Audit::Scanner.new

  scanner.scan do |result|
    @dependencies << DependencyBot::DependencyGem.new(name: result.gem)
  end

  @dependencies
end