rubysec / ruby-advisory-db

A database of vulnerable Ruby Gems

Home Page:https://rubysec.com

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add simplecov gem (branch coverage analysis) to repo

jasnow opened this issue · comments

If we want to add "simplecov" gem (branch coverage analysis) to this repo, I
have a script to add the code. My fork to too different for me to PR.

function addsection() {

if [ -f $1 ] ; then
    echo "Adding $1 section"
    cat << EOF > /tmp/$$_SECTION
require 'simplecov'
if ENV["COVERAGE"]
  SimpleCov.start do
    puts "Adding simplecov"
    enable_coverage :branch
    primary_coverage :branch
  end
end

EOF
    cat $1 >> /tmp/$$_SECTION

    mv /tmp/$$_SECTION $1
else
    echo "Unknown file: [$1]"
fi
}

######################################################################
# 1. Add 1 line to Gemfile.
(echo ; echo "gem 'simplecov', require: false, group: :test") >> Gemfile

# 2. Add 1 line to .gitignore file.
echo coverage >> .gitignore

# 2. Add "addsection" code to one of the helper.rb files.
if [ -f spec/rails_helper.rb ] ; then
    addsection spec/rails_helper.rb
else
    if [ -f test/test_helper.rb ] ; then
        addsection test/test_helper.rb
    else
        addsection spec/spec_helper.rb
    fi
fi

I'm not sure simplecov would work for ruby-advisory-db, since simplecov tracks test coverage of Ruby code and this repository primarily contains YAML, which our specs run against every .yml file.

Screenshot from 2023-03-13 14-26-41
Here's what you learn.

@jasnow that looks like simplecov is incorrectly saying spec/library_examples.rb isn't being used, even though it's used in spec/advisories_spec.rb. Probably because simplecov doesn't understand Rspec's shared_examples_for and include_examples.

Okay

Figured it out. The line below refers to "libraries" directory and it does not exist in the repo so the code is not used.

Dir.glob(File.join(File.dirname(__FILE__), '../libraries/*/*')) do |path|

@jasnow ah good catch. Looks like legacy cruft that got left behind. In 5a3640b libraries/rubygems got moved to gems/rubygems-update and libraries/ went away. Going to remove those lines of code and spec/library_example.rb.