Add timeout for ruby bundle lock

RedHatProductSecurity · Nov 8, 2023 · b3e63e1 · b3e63e1
1 parent 6109f6c
commit b3e63e1
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 2 deletions.
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
@@ -26,7 +26,7 @@ jobs:
     - name: Set up Go 1.x
       uses: actions/setup-go@v2
       with:
-        go-version: 1.17
+        go-version: 1.19
     - run: bundle config --local path $PWD/vendor/bundle
 
     - name: Set up Node

diff --git a/deplist_test.go b/deplist_test.go
@@ -27,12 +27,15 @@ func BuildWant() []Dependency {
 		"internal/bytealg",
 		"internal/cpu",
 		"internal/fmtsort",
+		"internal/goarch",
 		"internal/goexperiment",
+		"internal/goos",
 		"internal/itoa",
 		"internal/oserror",
 		"internal/poll",
 		"internal/race",
 		"internal/reflectlite",
+		"internal/safefilepath",
 		"internal/syscall/execenv",
 		"internal/syscall/unix",
 		"internal/testlog",
@@ -48,6 +51,7 @@ func BuildWant() []Dependency {
 		"runtime/internal/atomic",
 		"runtime/internal/math",
 		"runtime/internal/sys",
+		"runtime/internal/syscall",
 		"sort",
 		"strconv",
 		"sync",

diff --git a/internal/scan/ruby.go b/internal/scan/ruby.go
@@ -1,12 +1,14 @@
 package scan
 
 import (
+	"context"
 	"embed"
 	"fmt"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 )
@@ -28,7 +30,9 @@ func GetRubyDeps(path string) (map[string]string, error) {
 		if os.IsNotExist(err) {
 			log.Debugf("Creating %s with `bundle lock`", lockPath)
 			// Create Gemfile.lock
-			cmd := exec.Command("env", fmt.Sprintf("--chdir=%s", baseDir), "bundle", "lock")
+			ctx, cancel := context.WithTimeout(context.Background(), time.Duration(300)*time.Second)
+			defer cancel()
+			cmd := exec.CommandContext(ctx, "env", fmt.Sprintf("--chdir=%s", baseDir), "bundle", "lock")
 			data, err := cmd.CombinedOutput()
 			if err != nil {
 				log.Errorf("couldn't create %s: %v", lockPath, err)
@@ -52,6 +56,7 @@ func runGemlockParser(lockPath string) (map[string]string, error) {
 		log.Errorf("Could not create ruby script %s: %s", scriptName, err)
 		return gathered, err
 	}
+	defer os.Remove(g.Name())
 	err = os.WriteFile(g.Name(), rubyScript, 0644)
 	if err != nil {
 		log.Errorf("Could not write ruby script to %s: %s", g.Name(), err)