18F / confidential-survey

A Rails app for conducting confidential surveys without violating user privacy
Other
28 stars 6 forks source link

Add hakiri analysis #15

Closed harrisj closed 8 years ago

harrisj commented 8 years ago

Add a spec that calls two Hakiri scans in 81185f8dc315d10ee34b9064f28f414f5c7c3b20

harrisj commented 8 years ago

Here is the result of a system:scan

confidential-survey ➤ bundle exec hakiri system:scan -m hakiri_manifest.json                                                                                                                 git:develop*
-----> Scanning system for software versions...
       Found Linux Kernel 15.3.0
       Found Postgres 9.5.0
       Found Ruby 2.3.0.0
       Found Ruby on Rails 4.2.5
       Found Unicorn 5.0.1
-----> Searching for vulnerabilities...
       No vulnerabilities found. Keep it up!
harrisj commented 8 years ago

Here is the result of a gemfile scan

confidential-survey ➤ bundle exec hakiri gemfile:scan                                                                                                                                        
       Found us_web_design_standards 0.0.2
       Found actionmailer 4.2.5.1
       Found actionpack 4.2.5.1
       Found actionview 4.2.5.1
       Found activejob 4.2.5.1
       Found activemodel 4.2.5.1
       Found activerecord 4.2.5.1
       Found activesupport 4.2.5.1
       Found addressable 2.4.0
       Found arel 6.0.3
       Found ast 2.2.0
       Found awesome_print 1.6.1
       Found bourbon 4.2.6
       Found brakeman 3.1.5
       Found builder 3.2.2
       Found bundler-audit 0.4.0
       Found byebug 8.2.1
       Found capybara 2.6.2
       Found capybara-webkit 1.8.0
       Found coderay 1.1.0
       Found coffee-rails 4.1.1
       Found coffee-script 2.4.1
       Found coffee-script-source 1.10.0
       Found commander 4.3.7
       Found concurrent-ruby 1.0.0
       Found crack 0.4.3
       Found database_cleaner 1.5.1
       Found debug_inspector 0.0.2
       Found diff-lcs 1.2.5
       Found docile 1.1.5
       Found domain_name 0.5.25
       Found dotenv 2.1.0
       Found dotenv-rails 2.1.0
       Found easy_translate 0.5.0
       Found erubis 2.7.0
       Found execjs 2.6.0
       Found factory_girl 4.5.0
       Found factory_girl_rails 4.5.0
       Found fastercsv 1.5.5
       Found flutie 2.0.0
       Found formulaic 0.3.0
       Found globalid 0.3.6
       Found hakiri 0.7.2
       Found haml 4.0.7
       Found hashdiff 0.2.3
       Found high_voltage 2.4.0
       Found highline 1.7.8
       Found http-cookie 1.0.2
       Found i18n 0.7.0
       Found i18n-tasks 0.9.2
       Found ice_nine 0.11.1
       Found jbuilder 2.4.0
       Found jquery-rails 4.1.0
       Found json 1.8.3
       Found kgio 2.10.0
       Found launchy 2.4.3
       Found loofah 2.0.3
       Found mail 2.6.3
       Found memoist 0.14.0
       Found method_source 0.8.2
       Found mime-types 2.99
       Found mini_portile2 2.0.0
       Found minitest 5.8.4
       Found multi_json 1.11.2
       Found neat 1.7.2
       Found netrc 0.11.0
       Found nokogiri 1.6.7.2
       Found normalize-rails 3.0.3
       Found parser 2.3.0.2
       Found pg 0.18.4
       Found pry 0.10.3
       Found pry-rails 0.3.4
       Found rack 1.6.4
       Found rack-test 0.6.3
       Found rack-timeout 0.3.2
       Found rails 4.2.5.1
       Found rails-deprecated_sanitizer 1.0.3
       Found rails-dom-testing 1.0.7
       Found rails-html-sanitizer 1.0.3
       Found rails_12factor 0.0.3
       Found rails_serve_static_assets 0.0.4
       Found rails_stdout_logging 0.0.4
       Found railties 4.2.5.1
       Found raindrops 0.15.0
       Found rake 10.5.0
       Found rdoc 4.2.1
       Found redcarpet 3.3.4
       Found refills 0.1.0
       Found rest-client 1.8.0
       Found rspec-core 3.3.2
       Found rspec-expectations 3.3.1
       Found rspec-mocks 3.3.2
       Found rspec-rails 3.3.3
       Found rspec-support 3.3.0
       Found ruby2ruby 2.2.0
       Found ruby_parser 3.7.3
       Found safe_yaml 1.0.4
       Found sass 3.4.21
       Found sass-rails 5.0.4
       Found sdoc 0.4.1
       Found sexp_processor 4.6.1
       Found shoulda-matchers 3.1.1
       Found silencer 0.6.0
       Found simple_form 3.2.1
       Found simplecov 0.11.1
       Found simplecov-html 0.10.0
       Found slim 3.0.6
       Found slop 3.6.0
       Found spring 1.6.2
       Found spring-commands-rspec 1.0.4
       Found sprockets 3.5.2
       Found sprockets-rails 3.0.1
       Found sqlite3 1.3.11
       Found temple 0.7.6
       Found term-ansicolor 1.3.2
       Found terminal-table 1.5.2
       Found therubyrhino 2.0.4
       Found therubyrhino_jar 1.7.6
       Found thor 0.19.1
       Found thread 0.2.2
       Found thread_safe 0.3.5
       Found tilt 2.0.2
       Found timecop 0.8.0
       Found tins 1.8.2
       Found title 0.0.5
       Found tzinfo 1.2.2
       Found uglifier 2.7.2
       Found unf 0.1.4
       Found unf_ext 0.0.7.1
       Found unicorn 5.0.1
       Found web-console 3.1.1
       Found webmock 1.22.6
       Found xpath 2.0.0
-----> Searching for vulnerabilities...
       No vulnerabilities found. Keep it up!
harrisj commented 8 years ago

Security spec runs both of these scans as part of testing suite. This issue is closed