diff --git a/README.md b/README.md index 52bb8da..af4be95 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ pairing with smart people at Hashrocket. For a steady stream of TILs, [sign up for my newsletter](https://crafty-builder-6996.ck.page/e169c61186). -_1183 TILs and counting..._ +_1184 TILs and counting..._ --- @@ -992,6 +992,7 @@ _1183 TILs and counting..._ - [Show Public Methods With Pry](ruby/show-public-methods-with-pry.md) - [Silence The Output Of A Ruby Statement In Pry](ruby/silence-the-output-of-a-ruby-statement-in-pry.md) - [Single And Double Quoted String Notation](ruby/single-and-double-quoted-string-notation.md) +- [Skip Specific CVEs When Auditing Your Bundle](ruby/skip-specific-cves-when-auditing-your-bundle.md) - [Squeeze Out The Extra Space](ruby/squeeze-out-the-extra-space.md) - [String Interpolation With Instance Variables](ruby/string-interpolation-with-instance-variables.md) - [Summing Collections](ruby/summing-collections.md) diff --git a/ruby/skip-specific-cves-when-auditing-your-bundle.md b/ruby/skip-specific-cves-when-auditing-your-bundle.md new file mode 100644 index 0000000..785a485 --- /dev/null +++ b/ruby/skip-specific-cves-when-auditing-your-bundle.md @@ -0,0 +1,33 @@ +# Skip Specific CVEs When Auditing Your Bundle + +The [`bundler-audit` gem](https://github.com/rubysec/bundler-audit) is a tool +that can check for CVEs (Common Vulnerabilities and Exposures) in the installed +versions of gems in your Ruby project. This is a great addition to a CI +pipeline to ensure you aren't deploying code with vulnerabilities. + +If you have a known CVE in one of your dependencies, I recommend installing a +patch as soon as possible. Of course, we have to apply some nuance to that +statement. + +It is possible that we need to temporarily ignore the CVE warning to continue +to ship code while we work on integrating the patch. Or it may be super +low-risk and we are comfortable putting it off for a while. + +Use the `--ignore` flag to prevent `bundler-audit` from flagging a specific +CVE. + +```bash +$ bundler-audit check --ignore CVE-2022-23837 +``` + +Or if you need to ignore multiple, list them one after another. + +```bash +$ bundler-audit check --ignore CVE-2022-23837 CVE-2021-41817 +``` + +If you do skip a CVE in your bundle audit, make sure you understand the risks +and have a plan for dealing with it in the future. + +See `bundler-audit --help` or [their +docs](https://github.com/rubysec/bundler-audit) for more details.