68 lines
2.8 KiB
Makefile
68 lines
2.8 KiB
Makefile
# ©AngelaMos | 2026
|
|
# justfile
|
|
|
|
set shell := ["bash", "-uc"]
|
|
|
|
image := "ruby:4.0-slim"
|
|
vuln_image := "ruby:4.0.2-slim"
|
|
run := "docker run --rm --network none -v $PWD:/app -w /app " + image
|
|
run_ro := "docker run --rm --network none -v $PWD:/app:ro -w /app " + image
|
|
lint_run := "docker run --rm -v $PWD:/app -w /app " + image
|
|
|
|
default:
|
|
@just --list
|
|
|
|
test:
|
|
{{run_ro}} ruby -Ilib -Itest test/marshal/parser_test.rb
|
|
{{run_ro}} ruby -Ilib -Itest test/scanner_test.rb
|
|
{{run_ro}} ruby -Ilib -Itest test/chains_test.rb
|
|
{{run_ro}} ruby -Ilib -Itest test/marshal/boundary_detector_test.rb
|
|
{{run_ro}} ruby -Ilib -Itest test/corpus_test.rb
|
|
|
|
corpus:
|
|
{{run_ro}} ruby -Ilib -Itest -e 'require "rube"; require "support/adversarial_corpus"; Rube::AdversarialCorpus::CASES.each { |k| d = Rube::Marshal::BoundaryDetector.new(allowed_class_names: k[:allowed]); dec = d.inspect_stream(k[:bytes]); puts format(" %-38s %-6s %-10s %s", k[:name], dec.proceed? ? "accept" : "reject", k[:allowed].join(","), dec.reason.to_s[0, 52]) }'
|
|
|
|
scan namespace="":
|
|
{{run_ro}} ruby -Ilib -e 'require "rube"; ns = "{{namespace}}"; r = Rube::Scanner.new(namespace: ns.empty? ? nil : ns).scan; puts "modules=#{r.scanned_modules} candidates=#{r.candidates.length} gated=#{r.gated.length} reachable=#{r.reachable.length} suppressed=#{r.suppressed_count} candidates_lost=#{r.candidates_lost?}"; puts "analysed=#{r.candidates.count(&:state_known?)} unanalysable=#{r.unanalysable.length} unreadable=#{r.candidates.count(&:unreadable_source?)}"; puts; r.reachable.each { |c| puts format(" %-10s %-46s %s", c.gate, c.to_s, c.source_location) }; unless r.complete?; puts; puts "suppressed errors (this scan under-reports):"; r.suppressions_by_site.each { |site, n| puts format(" %-16s %d", site, n) }; end; unless r.fully_analysed?; puts; puts "#{r.unanalysable.length} candidates have no Ruby source and were never analysed; the reachability filter does not cover them"; end'
|
|
|
|
control:
|
|
{{run_ro}} ruby -Ilib -Itest test/control_check.rb
|
|
|
|
lint:
|
|
{{lint_run}} sh -c "set -e; gem install --no-document rubocop rubocop-minitest rubocop-performance rubocop-rake >/dev/null; rubocop --force-exclusion"
|
|
|
|
check: test control
|
|
|
|
probe:
|
|
{{run_ro}} ruby /app/test/support/matrix_probe.rb
|
|
|
|
matrix:
|
|
@bash scripts/version-matrix.sh
|
|
|
|
exploit:
|
|
@bash scripts/exploit-gate.sh
|
|
|
|
target:
|
|
@bash scripts/target-gate.sh
|
|
|
|
detector:
|
|
@bash scripts/detector-gate.sh
|
|
|
|
gate: check matrix exploit detector target
|
|
|
|
build:
|
|
{{run}} sh -c "gem build --strict rube.gemspec"
|
|
|
|
manifest:
|
|
{{run_ro}} ruby -e 'spec = Gem::Specification.load("rube.gemspec"); puts spec.files.sort; puts; puts "#{spec.files.length} files"'
|
|
|
|
shell:
|
|
docker run --rm -it --network none -v $PWD:/app -w /app {{image}} bash
|
|
|
|
pull:
|
|
docker pull {{image}}
|
|
docker pull {{vuln_image}}
|
|
|
|
clean:
|
|
rm -f *.gem
|