75 lines
2.0 KiB
Bash
75 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
# Verify phase-1/2 minimum security gem/package versions in lockfiles.
|
|
set -euo pipefail
|
|
|
|
semver_ge() {
|
|
printf '%s\n%s\n' "$2" "$1" | sort -V | head -1 | grep -qx "$2"
|
|
}
|
|
|
|
check_gemfile_lock() {
|
|
local file=$1 name min
|
|
echo "Checking ${file}..."
|
|
while read -r name min; do
|
|
[[ -z "$name" ]] && continue
|
|
local ver
|
|
ver=$(grep -E "^ ${name} \(" "$file" | head -1 | sed -E 's/.*\(([0-9][0-9.a-z-]*).*/\1/' || true)
|
|
if [[ -z "$ver" ]]; then
|
|
echo "FAIL: ${name} not found in ${file}"
|
|
exit 1
|
|
fi
|
|
if ! semver_ge "$ver" "$min"; then
|
|
echo "FAIL: ${name} ${ver} < required ${min} in ${file}"
|
|
exit 1
|
|
fi
|
|
echo " OK ${name} ${ver} (>= ${min})"
|
|
done <<'GEMS'
|
|
rack 2.2.13
|
|
nokogiri 1.13.10
|
|
rexml 3.3.9
|
|
tzinfo 1.2.10
|
|
rails-html-sanitizer 1.4.4
|
|
GEMS
|
|
if grep -qE '^ sidekiq \(' "$file"; then
|
|
local sidekiq_ver
|
|
sidekiq_ver=$(grep -E '^ sidekiq \(' "$file" | head -1 | sed -E 's/.*\(([0-9][0-9.a-z-]*).*/\1/')
|
|
if ! semver_ge "$sidekiq_ver" "6.4.0"; then
|
|
echo "FAIL: sidekiq ${sidekiq_ver} < required 6.4.0 in ${file}"
|
|
exit 1
|
|
fi
|
|
echo " OK sidekiq ${sidekiq_ver} (>= 6.4.0)"
|
|
fi
|
|
}
|
|
|
|
check_yarn_lock() {
|
|
local file=$1
|
|
echo "Checking ${file}..."
|
|
local axios ws
|
|
axios=$(grep -A1 '^axios@\^0\.32' "$file" | grep 'version "' | head -1 | sed -E 's/.*version "([^"]+)".*/\1/')
|
|
ws=$(grep -A1 '^ws@\^7\.5' "$file" | grep 'version "' | head -1 | sed -E 's/.*version "([^"]+)".*/\1/')
|
|
if [[ -z "$axios" ]] || ! semver_ge "$axios" "0.32.0"; then
|
|
echo "FAIL: axios ${axios:-missing} < 0.32.0"
|
|
exit 1
|
|
fi
|
|
echo " OK axios ${axios} (>= 0.32.0)"
|
|
if [[ -z "$ws" ]] || ! semver_ge "$ws" "7.5.10"; then
|
|
echo "FAIL: ws ${ws:-missing} < 7.5.10"
|
|
exit 1
|
|
fi
|
|
echo " OK ws ${ws} (>= 7.5.10)"
|
|
}
|
|
|
|
case "${1:-}" in
|
|
ruby)
|
|
check_gemfile_lock "${2:-Gemfile.lock}"
|
|
;;
|
|
yarn)
|
|
check_yarn_lock "${2:-yarn.lock}"
|
|
;;
|
|
*)
|
|
echo "Usage: $0 ruby [Gemfile.lock] | yarn [yarn.lock]"
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "Security pin verification passed."
|