github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-26 11:01:44 +01:00
Code Issues Packages Projects Releases Wiki Activity

resolve issue #810

Browse Source
This commit is contained in:
Jeremy Long
2017-07-21 06:10:03 -04:00
parent 60b8bde19a
commit 0183457b7a
4 changed files with 15 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
View File

@@ -50,7 +50,6 @@ import org.slf4j.LoggerFactory;
* *
* @author Dale Visser * @author Dale Visser
*/ */
@Experimental
public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer { public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
/** /**

1
dependency-check-core/src/main/resources/dependencycheck.properties
View File

@@ -97,6 +97,7 @@ analyzer.composer.lock.enabled=true
analyzer.python.distribution.enabled=true analyzer.python.distribution.enabled=true
analyzer.python.package.enabled=true analyzer.python.package.enabled=true
analyzer.ruby.gemspec.enabled=true analyzer.ruby.gemspec.enabled=true
analyzer.bundle.audit.enabled=true
analyzer.autoconf.enabled=true analyzer.autoconf.enabled=true
analyzer.cmake.enabled=true analyzer.cmake.enabled=true
analyzer.assembly.enabled=true analyzer.assembly.enabled=true

13
src/site/markdown/analyzers/bundle-audit.md Normal file
View File

@@ -0,0 +1,13 @@
Ruby Bundle-audit Analyzer
=====================
OWASP dependency-check includes an analyzer that will execute [bundle-audit](https://github.com/rubysec/bundler-audit#readme)
and include the results in the dependency-check report. This is useful for multi-language
projects and merging the results of multiple software composition analysis tools.
```shell
$ sudo gem install bundler-audit
$ bundle-audit update
```
Files Types Scanned: Gemfile.lock

1
src/site/markdown/analyzers/index.md
View File

@@ -12,6 +12,7 @@ to extract identification information from the files analyzed.
| [NSP](./nsp-analyzer.html) | [Node Security Project](https://nodesecurity.io) is used to analyze Node.js' `package.json` files for known vulnerable packages.| | [NSP](./nsp-analyzer.html) | [Node Security Project](https://nodesecurity.io) is used to analyze Node.js' `package.json` files for known vulnerable packages.|
| [Nuspec](./nuspec-analyzer.html) | Nuget package specification file (\*.nuspec) | Uses XPath to parse specification XML. | | [Nuspec](./nuspec-analyzer.html) | Nuget package specification file (\*.nuspec) | Uses XPath to parse specification XML. |
| [OpenSSL](./openssl.html) | OpenSSL Version Source Header File (opensslv.h) | Regex parse of the OPENSSL_VERSION_NUMBER macro definition. | | [OpenSSL](./openssl.html) | OpenSSL Version Source Header File (opensslv.h) | Regex parse of the OPENSSL_VERSION_NUMBER macro definition. |
| [Ruby bundle-audit](./bundle-audit.html) | Ruby Gemfile.lcok files | Executes bundle-audit and incorporates the results into the dependency-check report. |
Experimental Analyzers Experimental Analyzers
---------------------- ----------------------