Skip to content

New rake check - compare root url: to filename (without suffix)#1069

Open
jasnow wants to merge 6 commits into
rubysec:masterfrom
jasnow:url-filename-check
Open

New rake check - compare root url: to filename (without suffix)#1069
jasnow wants to merge 6 commits into
rubysec:masterfrom
jasnow:url-filename-check

Conversation

@jasnow
Copy link
Copy Markdown
Contributor

@jasnow jasnow commented May 24, 2026

Based on @simi's feedback during the past week or two, I tried to create a new "rake" lint check (rule) for root url: == basename(filenname).

  • First, since this is a new rule and the large number of failed checks on existing advisories, I decided to pick a start date to start applying it. I found that advisories with date: > "2026-05-09" all passed. I know this is a compromise but I hope the team agree that the new check is worth the compromise.

  • Second, I skipped the OSVDB advisories because they are very old and that database was removed from the web and internet archive.

@jasnow
Copy link
Copy Markdown
Contributor Author

jasnow commented May 24, 2026

Hint: If you want to see all the failed check, change the start date to 2000 and you will see all of them.

Comment thread spec/advisory_example.rb Outdated
Comment thread spec/advisory_example.rb Outdated
Comment thread spec/advisory_example.rb
@jasnow
Copy link
Copy Markdown
Contributor Author

jasnow commented May 27, 2026

working on failed GHA CI for 2 advisory from yesterday

@jasnow
Copy link
Copy Markdown
Contributor Author

jasnow commented May 27, 2026

@flavorjones - Now it is ready for re-review.

Comment thread spec/advisory_example.rb
# Skip advisories older than start_date and old OSVDB advisories.
if advisory["date"] >= start_date and !filename_root.start_with?("OSVDB")
expect(url).to include(filename_root),
"Expected base filename DOES NOT include URL"
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The "Expected base filename ..." string doesn't do anything here, and should be dropped.

Comment thread spec/advisory_example.rb
it "has a filename that matches the root of the url field" do
url = advisory["url"]

# Extract filename without extension
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment is probably not necessary, the code is pretty clear.

Comment thread spec/advisory_example.rb

# 5/24/2026: May 9, 2026 is earliest start date with no failed checks.
start_date = Date.new(2026, 5, 9)
# Skip advisories older than start_date and old OSVDB advisories.
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment is also probably unnecessary, the code reads well.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants