rubysec / ruby-advisory-db

A database of vulnerable Ruby Gems

Home Page:https://rubysec.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

bundle-audit throwing Encoding::UndefinedConversionError

sfatsd opened this issue · comments

commented

bundle-audit check start throwing Encoding::UndefinedConversionError after latest commit.

RuntimeError: error running bundle-audit-check: /etc/apollo/goodreads-www/gems/ruby/2.7.0/gems/thor-1.1.0/lib/thor/shell/basic.rb:102:in write': U+2192 from UTF-8 to US-ASCII (Encoding::UndefinedConversionError)

It is caused by character on line 7. It only happens when I run bundle-audit check in rake test suite. I am looking for a way to force the encoding but haven't got it through yet.

What is your $LANG variable set to? I cannot seem to reproduce this bug with the following Gemfile:

source 'https://rubygems.org/'

gem 'bundler-audit', '0.9.0.1'
gem 'nokogiri', '1.13.1'
Name: nokogiri
Version: 1.13.1
CVE: CVE-2021-30560
GHSA: GHSA-fq42-c5rg-92c2
Criticality: High
URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
Title: Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)
Solution: upgrade to >= 1.13.2

Name: nokogiri
Version: 1.13.1
CVE: CVE-2021-30560
GHSA: GHSA-fq42-c5rg-92c2
Criticality: High
URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-fq42-c5rg-92c2
Title: Update packaged libxml2 (2.9.12 → 2.9.13) and libxslt (1.1.34 → 1.1.35)
Solution: upgrade to >= 1.13.2

Vulnerabilities found!
commented

$LANG is set to en_US.UTF-8 in locale.

I only get error when we run bundle-audit check in test suite through Open3.capture3. However, $LANG is empty in test suite environment. Problem solved after setting $LANG when running Open3.capture3 like Open3.capture3({"LANG" => "en_US.UTF-8"}, 'bundle-audit check')
Thanks