jsuder/holepicker — pull request #14 by cbeer (2013-08-16 23:48:11+00:00)
Title: support Ruby advisory database as a source

(This includes the commit in #13 as well. If and when that is merged, I'll rebase this pull request.)

This patch adds a database provider for the [Ruby Advisory DB](https://github.com/rubysec/ruby-advisory-db). There's plenty more work to do on it (for instance, figure out how to actually handle pulling down the advisories), but figured it's worth getting out there early and often.

Output from a scan using the advisory DB look something like (truncated):

```
Gemfile.lock: 2 vulnerable gems found!
- actionpack (2.3.10) [CVE-2012-1099]
- activerecord (2.3.10) [CVE-2012-2660]

2 vulnerable gems found in 1 gemfile!

[CVE-2012-1099] 2012-03-01: http://www.osvdb.org/show/osvdb/79727
[CVE-2012-2660] 2012-05-31: http://www.osvdb.org/show/osvdb/82610

[CVE-2012-1099] Ruby on Rails actionpack/lib/action_view/helpers/form_options_helper.rb Manually Generated Select Tag Options XSS
http://www.osvdb.org/show/osvdb/79727
Ruby on Rails contains a flaw that allows a remote cross-site scripting (XSS)
attack. This flaw exists because the application does not validate manually
generated 'select tag options' upon submission to
actionpack/lib/action_view/helpers/form_options_helper.rb. This may allow a
user to create a specially crafted request that would execute arbitrary
script code in a user's browser within the trust relationship between their
browser and the server.

[CVE-2012-2660] Ruby on Rails ActiveRecord Class Rack Query Parameter Parsing SQL Query Arbitrary IS NULL Clause Injection
http://www.osvdb.org/show/osvdb/82610
Ruby on Rails contains a flaw related to the way ActiveRecord handles
parameters in conjunction with the way Rack parses query parameters.
This issue may allow an attacker to inject arbitrary 'IS NULL' clauses in
to application SQL queries. This may also allow an attacker to have the
SQL query check for NULL in arbitrary places.
```