diff --git a/.expeditor/release.omnibus.yml b/.expeditor/release.omnibus.yml index b025e0307..b6af4b9ba 100644 --- a/.expeditor/release.omnibus.yml +++ b/.expeditor/release.omnibus.yml @@ -16,8 +16,6 @@ builder-to-testers-map: sles-12-x86_64: - sles-12-x86_64 - sles-15-x86_64 - ubuntu-16.04-x86_64: - - ubuntu-16.04-x86_64 ubuntu-18.04-x86_64: - ubuntu-18.04-x86_64 - ubuntu-20.04-x86_64 diff --git a/.github/workflows/brakeman-analysis.yml b/.github/workflows/brakeman-analysis.yml deleted file mode 100644 index dd4267599..000000000 --- a/.github/workflows/brakeman-analysis.yml +++ /dev/null @@ -1,47 +0,0 @@ -# This workflow integrates Brakeman with GitHub's Code Scanning feature -# Brakeman is a static analysis security vulnerability scanner for Ruby on Rails applications - -name: Brakeman Scan - -on: - push: - branches: [ main ] - paths-ignore: 'docs-chef-io' - pull_request: - # The branches below must be a subset of the branches above - branches: [ main ] - schedule: - - cron: '36 0 * * 6' - -jobs: - brakeman-scan: - name: Brakeman Scan - runs-on: ubuntu-latest - steps: - # Checkout the repository to the GitHub Actions runner - - name: Checkout - uses: actions/checkout@v3 - - # Customize the ruby version depending on your needs - - name: Setup Ruby - uses: ruby/setup-ruby@v1 - with: - ruby-version: '3.1.5' - - - name: Setup Brakeman - env: - BRAKEMAN_VERSION: '5.0.4' # SARIF support is provided in Brakeman version 4.10+ - run: | - gem install brakeman --version $BRAKEMAN_VERSION - - # Execute Brakeman CLI and generate a SARIF output with the security issues identified during the analysis - - name: Scan - continue-on-error: true - run: | - brakeman src/supermarket -f sarif -o output.sarif.json - - # Upload the SARIF file generated in the previous step - - name: Upload SARIF - uses: github/codeql-action/upload-sarif@v1 - with: - sarif_file: output.sarif.json diff --git a/src/supermarket/Gemfile b/src/supermarket/Gemfile index a3665c11f..6c5e3b58c 100644 --- a/src/supermarket/Gemfile +++ b/src/supermarket/Gemfile @@ -74,7 +74,6 @@ group :development do gem "license_finder" gem "spring" gem "spring-commands-rspec" - gem "brakeman" gem "ruby-lsp", require: false gem "debug", require: false gem "solargraph", require: false diff --git a/src/supermarket/Gemfile.lock b/src/supermarket/Gemfile.lock index 1736bd706..2081b0815 100644 --- a/src/supermarket/Gemfile.lock +++ b/src/supermarket/Gemfile.lock @@ -119,7 +119,6 @@ GEM base64 (0.3.0) benchmark (0.4.1) bigdecimal (3.2.3) - brakeman (5.4.1) builder (3.3.0) byebug (11.1.3) capybara (3.38.0) @@ -930,7 +929,6 @@ DEPENDENCIES and_feathers (>= 1.0.0.pre) and_feathers-gzipped_tarball (>= 1.0.0.pre) aws-sdk-s3 - brakeman capybara capybara-screenshot chef (~> 18.2) diff --git a/src/supermarket/config/brakeman.ignore b/src/supermarket/config/brakeman.ignore deleted file mode 100644 index 6b5f4859f..000000000 --- a/src/supermarket/config/brakeman.ignore +++ /dev/null @@ -1,116 +0,0 @@ -{ - "ignored_warnings": [ - { - "warning_type": "Cross-Site Scripting", - "warning_code": 4, - "fingerprint": "11a6322283bc54ef48d681d41a4dcd60c59cd3cce38e48d3d8ad28a27c19e242", - "check_name": "LinkToHref", - "message": "Potentially unsafe model attribute in `link_to` href", - "file": "app/views/tools/_tool.html.erb", - "line": 28, - "link": "https://brakemanscanner.org/docs/warning_types/link_to_href", - "code": "link_to(\"View Source\", (Unresolved Model).new.source_url, :class => \"button tiny radius secondary\", :target => \"_blank\", :rel => \"noopener\", :itemprop => \"codeRepository\")", - "render_path": [ - { - "type": "template", - "name": "users/tools", - "line": 15, - "file": "app/views/users/tools.html.erb", - "rendered": { - "name": "tools/_tool", - "file": "app/views/tools/_tool.html.erb" - } - } - ], - "location": { - "type": "template", - "template": "tools/_tool" - }, - "user_input": "(Unresolved Model).new.source_url", - "confidence": "Weak", - "note": "" - }, - { - "warning_type": "Redirect", - "warning_code": 18, - "fingerprint": "5151f802b89ff8ddb6226eddcff9095c7ca2a3564f37f3eb881e9531d1bca4c1", - "check_name": "Redirect", - "message": "Possible unprotected redirect", - "file": "app/controllers/irc_logs_controller.rb", - "line": 44, - "link": "https://brakemanscanner.org/docs/warning_types/redirect/", - "code": "redirect_to((((\"https://botbot.me/freenode/\" + params[:channel]) + \"/\") + params.fetch(:date, nil)))", - "render_path": null, - "location": { - "type": "method", - "class": "IrcLogsController", - "method": "show" - }, - "user_input": "params.fetch(:date, nil)", - "confidence": "Weak", - "note": "" - }, - { - "warning_type": "Redirect", - "warning_code": 18, - "fingerprint": "6ca20351e1a6bb8a70147de1124661cf42e7d0de7c3fe421affb5b193f30dc32", - "check_name": "Redirect", - "message": "Possible unprotected redirect", - "file": "app/controllers/api/v1/cookbook_versions_controller.rb", - "line": 32, - "link": "https://brakemanscanner.org/docs/warning_types/redirect/", - "code": "redirect_to(Cookbook.with_name(params[:cookbook]).first!.get_version!(params[:version]).cookbook_artifact_url)", - "render_path": null, - "location": { - "type": "method", - "class": "Api::V1::CookbookVersionsController", - "method": "download" - }, - "user_input": "Cookbook.with_name(params[:cookbook]).first!.get_version!(params[:version]).cookbook_artifact_url", - "confidence": "High", - "note": "" - }, - { - "warning_type": "Redirect", - "warning_code": 18, - "fingerprint": "8bd00293b526f062a8591f1f50f1af66e1acfb8522bf5734b0377fcc8eba8146", - "check_name": "Redirect", - "message": "Possible unprotected redirect", - "file": "app/controllers/irc_logs_controller.rb", - "line": 42, - "link": "https://brakemanscanner.org/docs/warning_types/redirect/", - "code": "redirect_to((\"https://botbot.me/freenode/\" + params[:channel]))", - "render_path": null, - "location": { - "type": "method", - "class": "IrcLogsController", - "method": "show" - }, - "user_input": "params[:channel]", - "confidence": "Weak", - "note": "" - }, - { - "warning_type": "Redirect", - "warning_code": 18, - "fingerprint": "ace2d27e7a1866cead6fabfebcf7eaa0202456a5b848a736d4e47b7d79707a93", - "check_name": "Redirect", - "message": "Possible unprotected redirect", - "file": "app/controllers/cookbook_versions_controller.rb", - "line": 16, - "link": "https://brakemanscanner.org/docs/warning_types/redirect/", - "code": "redirect_to(Cookbook.with_name(params[:cookbook_id]).first!.get_version!(params[:version]).cookbook_artifact_url)", - "render_path": null, - "location": { - "type": "method", - "class": "CookbookVersionsController", - "method": "download" - }, - "user_input": "Cookbook.with_name(params[:cookbook_id]).first!.get_version!(params[:version]).cookbook_artifact_url", - "confidence": "High", - "note": "" - } - ], - "updated": "2021-08-09 12:47:05 +0530", - "brakeman_version": "5.1.1" -}