thesp0nge / dawnscanner

Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.
MIT License
735 stars 88 forks source link

Ruby 2.3 compatibilty #218

Closed exadeci closed 5 years ago

exadeci commented 7 years ago

Json 1.6 required by data_mapper, dm-serializer doesn't work with ruby 2.3

dm-serializer/master is a beta that doesn't seems to require json 1.6 so forking data_mapper and creating a new version of dm-serializer might work.

I decided to use ruby 2.2.5 instead

thesp0nge commented 7 years ago

@exadeci can you please tell me if this is actually an issue?

exadeci commented 7 years ago

That's what happen with Json 1.6.8 on Ruby 2.3

Building native extensions.  This could take a while...
ERROR:  Error installing json:
    ERROR: Failed to build gem native extension.

    current directory: /Users/exadeci/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/json-1.6.8/ext/json/ext/generator
/Users/exadeci/.rbenv/versions/2.3.1/bin/ruby -r ./siteconf20161013-4268-i38lek.rb extconf.rb
creating Makefile

current directory: /Users/exadeci/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/json-1.6.8/ext/json/ext/generator
make "DESTDIR=" clean

current directory: /Users/exadeci/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/json-1.6.8/ext/json/ext/generator
make "DESTDIR="
compiling generator.c
In file included from generator.c:1:
./../fbuffer/fbuffer.h:151:47: error: too few arguments provided to function-like macro invocation
    VALUE result = rb_str_new(FBUFFER_PAIR(fb));
                                              ^
/Users/exadeci/.rbenv/versions/2.3.1/include/ruby-2.3.0/ruby/intern.h:797:9: note: macro 'rb_str_new' defined here
#define rb_str_new(str, len) __extension__ (    \
        ^
In file included from generator.c:1:
./../fbuffer/fbuffer.h:151:11: warning: incompatible pointer to integer conversion initializing 'VALUE' (aka 'unsigned long') with an expression of type 'VALUE (const char *, long)' (aka 'unsigned long (const char *, long)') [-Wint-conversion]
    VALUE result = rb_str_new(FBUFFER_PAIR(fb));
          ^        ~~~~~~~~~~
generator.c:867:22: warning: '&&' within '||' [-Wlogical-op-parentheses]
    return *p == '[' && *q == ']' || *p == '{' && *q == '}';
           ~~~~~~~~~~^~~~~~~~~~~~ ~~
generator.c:867:22: note: place parentheses around the '&&' expression to silence this warning
    return *p == '[' && *q == ']' || *p == '{' && *q == '}';
                     ^
           (                     )
generator.c:867:48: warning: '&&' within '||' [-Wlogical-op-parentheses]
    return *p == '[' && *q == ']' || *p == '{' && *q == '}';
                                  ~~ ~~~~~~~~~~^~~~~~~~~~~~
generator.c:867:48: note: place parentheses around the '&&' expression to silence this warning
    return *p == '[' && *q == ']' || *p == '{' && *q == '}';
                                               ^
                                     (                     )
3 warnings and 1 error generated.
make: *** [generator.o] Error 1

make failed, exit code 2

Gem files will remain installed in /Users/exadeci/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/gems/json-1.6.8 for inspection.
Results logged to /Users/exadeci/.rbenv/versions/2.3.1/lib/ruby/gems/2.3.0/extensions/x86_64-darwin-15/2.3.0-static/json-1.6.8/gem_make.out

It's not an issue as long as Ruby 2.3 is not used but it will be at some point.

vp993 commented 7 years ago

Hey @thesp0nge,

data_mapper seems completely outdated, what do you think of migrating to another one adapter, such as Rom or Sequel?

bewatts commented 7 years ago

+1 that this is still a problem. Our Security partner asked us to install Dawnscanner, but we are on Ruby 2.3.3. So we are blocked on using this gem until this issue is fixed :/

$ dawn
.../.rbenv/versions/2.3.3/lib/ruby/2.3.0/rubygems/specification.rb:2285:in `raise_if_conflicts': Unable to activate dm-serializer-1.2.2, because json-2.0.3 conflicts with json (~> 1.6) (Gem::ConflictError)
thesp0nge commented 5 years ago

Sorry for this huge delay. I removed all datamapper dependencies.