内容简介:AddThen runIf you do not wish to include
MixAudit provides a mix deps.audit task to scan Mix dependencies for security vulnerabilities.
It draw its inspiration from tools like npm audit and bundler-audit .
Installation
Project dependency
Add mix_audit to the deps function in your project’s mix.exs file:
defp deps do
[
{:mix_audit, "~> 0.1", only: [:dev, :test], runtime: false}
]
end
Then run mix do deps.get, deps.compile inside your project’s directory.
Local escript
If you do not wish to include mix_audit in your project dependencies, you can install it as global escript :
$ mix escript.install hex mix_audit … * creating …/.mix/escripts/mix_audit
The only difference is that instead of using the mix deps.audit task, you will have to use the created executable.
Usage
To generate a security report, you can use the deps.audit Mix task:
$ mix deps.audit
Options
| Option | Type | Default | Description |
|---|---|---|---|
--path |
String | Current directory | The root path of the project to audit |
--format |
String | "human" |
The format of the report to generate ( "json" or "human" ) |
--ignore-advisory-ids |
String | "" |
Comma-separated list of advisory IDs to ignore |
--ignore-package-names |
String | "" |
Comma-separated list of package names to ignore |
Example
How does it work?
MixAudit builds two lists when it’s executed in a project:
- A list of security advisories fetched from the community-maintained
elixir-security-advisoriesrepository - A list of Mix dependencies from the various
mix.lockfiles in the project
Then, it loops through each project dependency and tries to find security advisories that apply to it (through its package name) and that match its version specification (through the advisory patched and unaffected version policies).
If one is found, a vulnerability (the combination of a security advisory and a project dependency ) is then added to the report.
The task will exit with a 0 status only if the report passes (ie. it reports no vulnerabilities). Otherwise, it will exit with a 1 status.
License
MixAudit is © 2020 Mirego and may be freely distributed under the New BSD license . See the LICENSE.md file.
The detective hat logo is based on this lovely icon by Vectors Point , from The Noun Project. Used under a Creative Commons BY 3.0 license.
About Mirego
Mirego is a team of passionate people who believe that work is a place where you can innovate and have fun. We’re a team of talented people who imagine and build beautiful Web and mobile applications. We come together to share ideas and change the world .
We also love open-source software and we try to give back to the community as much as we can.
以上所述就是小编给大家介绍的《Scan your Elixir project's dependencies for known vulnerabilities》,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对 码农网 的支持!
猜你喜欢:本站部分资源来源于网络,本站转载出于传递更多信息之目的,版权归原作者或者来源机构所有,如转载稿涉及版权问题,请联系我们。
文明之光(第二册)
吴军 / 人民邮电出版社 / 2014-6 / 59.00元
【《文明之光》系列荣获由中宣部、中国图书评论学会和中央电视台联合推选的2014“中国好书”奖】 吴军博士从对人类文明产生了重大影响却在过去被忽略的历史故事里,选择了有意思的几十个片段特写,以人文和科技、经济结合的视角,有机地展现了一幅人类文明发展的宏大画卷。 《文明之光 》系列大致按照从地球诞生到近现代的顺序讲述了人类文明进程的各个阶段,每个章节相对独立,全景式地展现了人类文明发展历程......一起来看看 《文明之光(第二册)》 这本书的介绍吧!