Skip to content
Snippets Groups Projects

Report vulnerable dependency paths for Bundler (Ruby)

    • Closed Issue created by Fabien Catteau @fcatteau

    Problem to solve

    Dependency Scanning should report the dependency paths for vulnerable dependencies found in Ruby projects using Bundler, so that these paths can be shown in the UI, including in the dependency list. See #227620 (closed)

    Proposal

    Update the lock file parser specific to this package manager, and make it able to build the dependency graph.

    Implementation plan

    This depends on Migrate existing lock file parsers to new Depen... (#474314 - closed)

    Permissions and Security

    N/A

    Documentation

    Dependency Path support for this particular package manager should be documented in Dependency Scanning documentation.

    Availability & Testing

    To be tested doing automatically when doing QA for the analyzer project and checking the generated report.

    What does success look like, and how can we measure that?

    The analyzer reports the dependency paths of the vulnerable dependencies for projects using this package manager.

    What is the type of buyer?

    GitLab Ultimate

    Links / references

    How To extract Dependency tree for Gemfile

    Parsing the Gemfile with the following steps:

    1. Find the Main Dependencies
      We look for the DEPENDENCIES section. This is the list of libraries your project directly depends on.

    2. Find Sub-Dependencies

      In the GEM section, each library and its sub-dependencies are shown with indentation.

      • 4 spaces indicate the start of a "main dependency".
      • 6 spaces indicate a "sub-dependency" of the main dependency.

      Example from Gemfile.lock:

      GEM
  rails (7.0.0)
    actionpack (7.0.0)
    activerecord (7.0.0)
  nokogiri (1.13.0)
    libxml2 (2.9.10)

    3. Get the "Real"(installed) Version of Sub-Dependencies:

      We scan the entire GEM section to find the actual installed version of a sub-dependency.

    4. Build the Tree
      We connect the relationships, showing which libraries depend on which. We store this data in a list where each "parent" library points to its "child" dependencies.

    0 of 3 checklist items completed · Edited by Joey Khabie

    Designs

      Child items ...

      2. Activity

      Please register or sign in to reply