search

appfolio / gemsurance

Gem vulnerability checker using rubysec/ruby-advisory-db
MIT License
213 stars 24 forks source link

Add config file to specify manually patched gems #21

Closed firemind closed 7 years ago

firemind commented 9 years ago

This adds the ability to specify gems that were patched manually because upgrading wasn't possible.

Take the latest ActiveSupport Vulnerability CVE 2015-3226 for example. Since rails 3.2 is officially no longer supported we had to patch this manually. To ensure the gemsurance test is happy we implemented the feature that was already requested in #11

Here is how the config file (.gemsurance.yml by default) can look like:

manually_patched_versions:
  activesupport:
    2015-3226:
      - 3.2.22
jonkessler commented 9 years ago

Thanks. This needs some tests.

jonkessler commented 7 years ago

Superseded by #26