Module: Homebrew::Vulns Private

Defined in:
vulns.rb,
vulns/osv.rb,
vulns/cvss.rb,
vulns/purl.rb,
vulns/match.rb,
vulns/output.rb,
vulns/history.rb,
vulns/scanner.rb,
vulns/cpan_sec.rb,
vulns/identify.rb,
vulns/repology.rb,
vulns/osv_export.rb,
vulns/cached_feed.rb,
vulns/vulnerability.rb,
vulns/advisory_database.rb,
vulns/advisory_overrides.rb,
vulns/platform_independence.rb

Overview

This module is part of a private API. This module may only be used in the Homebrew/brew repository. Third parties should avoid using this module if possible, as it may be removed or changed without warning.

Checks formulae for known security vulnerabilities via OSV.dev. See Cmd::Vulns for the user-facing command.

Defined Under Namespace

Modules: CVSS, Identify, OSV, OsvExport, Output, PlatformIndependence Classes: AdvisoryDatabase, AdvisoryOverrides, CPANSec, CachedFeed, History, Match, Purl, Repology, Scanner, Vulnerability

Constant Summary collapse

SEVERITIES =

This constant is part of a private API. This constant may only be used in the Homebrew/brew repository. Third parties should avoid using this constant if possible, as it may be removed or changed without warning. 

%w[low medium high critical].freeze

Class Method Summary collapse

Class Method Details

.min_severity(severity) ⇒ Symbol?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

Raises:



18
19
20
21
22
23
24
25
 
# File 'vulns.rb', line 18

def self.min_severity(severity)
  return if severity.nil?

  severity = severity.downcase
  raise UsageError, "`--severity` must be one of: #{SEVERITIES.join(", ")}" unless SEVERITIES.include?(severity)

  severity.to_sym
end

.select_vulnerable(formulae, severity: nil) ⇒ Array<Formula>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Select upgrade candidates using the same installed-source evidence as brew vulns.

Parameters:

Returns:



29
30
31
32
33
34
35
36
37
38
39
 
# File 'vulns.rb', line 29

def self.select_vulnerable(formulae, severity: nil)
  results = Scanner.new(formulae, min_severity: min_severity(severity)).scan
  incomplete = results.skipped_formulae | results.outdated_without_sbom
  if incomplete.present?
    raise "Incomplete vulnerability scan for: #{incomplete.sort.join(", ")}.\n" \
          "Run `brew vulns --list-skipped` and review installed-source evidence before upgrading."
  end

  vulnerable = results.findings.select { |finding| finding.open.any? }.map(&:name)
  formulae.select { |formula| vulnerable.include?(formula.full_name) }
end