Sign upLogin

codeclimate/codeclimate-bundler-audit

View on GitHub
Star

Showing 12 of 12 total issues

OS Command Injection in Rake
Open

    rake (12.2.1)
Severity: Critical
Found in Gemfile.lock by bundler-audit

Advisory: CVE-2020-8130

Criticality: High

URL: https://github.com/advisories/GHSA-jppv-gw3r-w3q8

Solution: upgrade to >= 12.3.3

Block has too many lines. [91/25]
Open

  describe Analyzer do
    describe "#run" do
      it "raises an error when no Gemfile.lock exists" do
        directory = fixture_directory("no_gemfile_lock")
Severity: Minor
Found in spec/cc/engine/bundler_audit/analyzer_spec.rb by rubocop

This cop checks if the length of a block exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable. The cop can be configured to ignore blocks passed to certain methods.

Block has too many lines. [89/25]
Open

    describe "#run" do
      it "raises an error when no Gemfile.lock exists" do
        directory = fixture_directory("no_gemfile_lock")

        expect { Analyzer.new(directory: directory).run }.
Severity: Minor
Found in spec/cc/engine/bundler_audit/analyzer_spec.rb by rubocop

This cop checks if the length of a block exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable. The cop can be configured to ignore blocks passed to certain methods.

Method has too many lines. [19/10]
Open

        def to_json(*a)
          {
            categories: %w[Security],
            check_name: CHECK_NAME,
            content: {
Severity: Minor
Found in lib/cc/engine/bundler_audit/unpatched_gem_issue.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Method has too many lines. [19/10]
Open

        def to_json(*a)
          {
            categories: %w[Security],
            check_name: CHECK_NAME,
            content: {
Severity: Minor
Found in lib/cc/engine/bundler_audit/insecure_source_issue.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Method has too many lines. [15/10]
Open

        def run
          raise(GemfileLockNotFound, "No Gemfile.lock found.") unless gemfile_lock_exists?
          return unless gemfile_lock_in_include_paths?

          Dir.mktmpdir do |dir|
Severity: Minor
Found in lib/cc/engine/bundler_audit/analyzer.rb by rubocop

This cop checks if the length of a method exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable.

Method run has a Cognitive Complexity of 9 (exceeds 5 allowed). Consider refactoring.
Open

        def run
          raise(GemfileLockNotFound, "No Gemfile.lock found.") unless gemfile_lock_exists?
          return unless gemfile_lock_in_include_paths?

          Dir.mktmpdir do |dir|
Severity: Minor
Found in lib/cc/engine/bundler_audit/analyzer.rb - About 55 mins to fix

Cognitive Complexity

Cognitive Complexity is a measure of how difficult a unit of code is to intuitively understand. Unlike Cyclomatic Complexity, which determines how difficult your code will be to test, Cognitive Complexity tells you how difficult your code will be to read and comprehend.

A method's cognitive complexity is based on a few simple rules:

  • Code is not considered more complex when it uses shorthand that the language provides for collapsing multiple statements into one
  • Code is considered more complex for each "break in the linear flow of the code"
  • Code is considered more complex when "flow breaking structures are nested"

Further reading

Block has too many lines. [28/25]
Open

  describe UnpatchedGemRemediation do
    describe "#points" do
      it "returns major upgrade remediation points when an upgrade requies a major version bump" do
        remediation = UnpatchedGemRemediation.new("1.0.0", %w[2.0.1 3.0.1])
Severity: Minor
Found in spec/cc/engine/bundler_audit/remediation_spec.rb by rubocop

This cop checks if the length of a block exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable. The cop can be configured to ignore blocks passed to certain methods.

Block has too many lines. [26/25]
Open

    describe "#points" do
      it "returns major upgrade remediation points when an upgrade requies a major version bump" do
        remediation = UnpatchedGemRemediation.new("1.0.0", %w[2.0.1 3.0.1])

        expect(remediation.points).to eq(UnpatchedGemRemediation::MAJOR_UPGRADE_POINTS)
Severity: Minor
Found in spec/cc/engine/bundler_audit/remediation_spec.rb by rubocop

This cop checks if the length of a block exceeds some maximum value. Comment lines can optionally be ignored. The maximum allowed length is configurable. The cop can be configured to ignore blocks passed to certain methods.

Prefer JSON.parse over JSON.load.
Open

        stdout.string.split("\0").map { |issue| JSON.load(issue) }
Severity: Minor
Found in spec/cc/engine/bundler_audit/analyzer_spec.rb by rubocop

This cop checks for the use of JSON class methods which have potential security issues.

Autocorrect is disabled by default because it's potentially dangerous. If using a stream, like JSON.load(open('file')), it will need to call #read manually, like JSON.parse(open('file').read). If reading single values (rather than proper JSON objects), like JSON.load('false'), it will need to pass the quirks_mode: true option, like JSON.parse('false', quirks_mode: true). Other similar issues may apply.

Example:

# always offense
JSON.load("{}")
JSON.restore("{}")

# no offense
JSON.parse("{}")

Prefer JSON.parse over JSON.load.
Open

        JSON.load(body)
Severity: Minor
Found in spec/cc/engine/bundler_audit/analyzer_spec.rb by rubocop

This cop checks for the use of JSON class methods which have potential security issues.

Autocorrect is disabled by default because it's potentially dangerous. If using a stream, like JSON.load(open('file')), it will need to call #read manually, like JSON.parse(open('file').read). If reading single values (rather than proper JSON objects), like JSON.load('false'), it will need to pass the quirks_mode: true option, like JSON.parse('false', quirks_mode: true). Other similar issues may apply.

Example:

# always offense
JSON.load("{}")
JSON.restore("{}")

# no offense
JSON.parse("{}")

Do not use empty case condition, instead use an if expression.
Open

          case
Severity: Minor
Found in lib/cc/engine/bundler_audit/unpatched_gem_remediation.rb by rubocop

This cop checks for case statements with an empty condition.

Example:

# bad:
case
when x == 0
  puts 'x is 0'
when y == 0
  puts 'y is 0'
else
  puts 'neither is 0'
end

# good:
if x == 0
  puts 'x is 0'
elsif y == 0
  puts 'y is 0'
else
  puts 'neither is 0'
end

# good: (the case condition node is not empty)
case n
when 0
  puts 'zero'
when 1
  puts 'one'
else
  puts 'more'
end
Severity
Category
Status
Source
Language