Skip to main content
Ruby is a widely used open-source programming language. Endor Labs supports scanning and monitoring of Ruby projects. Using Endor Labs, application security engineers and developers can:
  • Scan their software for potential security issues and violations of organizational policy.
  • Prioritize vulnerabilities in the context of their applications.
  • Understand the relationships between software components in their applications.

​
Software prerequisites

Before you begin, verify the following prerequisites:
  • All applications monitored by Endor Labs must be on Ruby versions 2.6 or higher.
  • A Gemfile or a *.gemspec file must be present in your Ruby project.
  • Make sure your repository includes one or more files with .rb extension.

​
Prepare Ruby projects

You can prepare your Ruby project before running a scan to lock its dependency versions in a Gemfile.lock file. Ensure your repository has a Gemfile and run the following command to generate the Gemfile.lock file:
If the repository already contains a Gemfile.lock, endorctl uses it for dependency resolution and does not generate it again.

​
Configure private RubyGems package repositories

Endor Labs supports fetching and scanning dependencies from private RubyGems package registries. Endor Labs will fetch resources from authenticated endpoints and perform the scan, allowing you to view the resolved dependencies and findings. See RubyGems package manager integrations for more information on configuring private registries.

​
Run a scan

Perform a scan to get visibility into your software composition and resolve dependencies.
You can perform the scan from within the root directory of the Git project repository, and save the local results to a results.json file. The results and related analysis information are available on the Endor Labs user interface.
You can sign in to the Endor Labs user interface, click the Projects on the left sidebar, and find your project to review its results.
If you use Endor Labs with an EU tenant, use https://app.eu.endorlabs.com instead of https://app.endorlabs.com.

​
Understand the scan process

Endor Labs looks for Gemfile, *.gemspec, and Gemfile.lock files to find and monitor the dependency activity.
  • A Gemfile is a configuration file used in Ruby projects to specify the required RubyGems (libraries or packages) for the project’s dependencies.
  • A *.gemspec file is a RubyGems specification file used to define the metadata and dependencies for a RubyGem.
  • The Gemfile.lock file is automatically generated by Bundler. Refer to Bundler documentation for more information about getting started.
If the Gemfile.lock is not present in your project, Endor Labs generates this file and stores it in a temp directory. Endor Labs deletes the file after extracting dependency information. Endor Labs’ dependency resolution mechanism assesses multiple factors, including compatibility, stability, and availability, to determine the most suitable version for usage. Your Ruby project uses the resolved dependency version during build or execution. By utilizing the dependency graph, you can access significant information about the dependencies. This includes determining whether a dependency is direct or transitive, checking its reachability, verifying source availability, and more. The dependency graph provides a visual representation that allows you to examine the graphical details of these dependencies.

​
Call graphs

Endor Labs performs reachability analysis and generates call graphs for Ruby projects from the abstract syntax tree. You don’t have to build or install your project for Endor Labs to generate the call graph. Endor Labs also performs an inside-out analysis to determine the reachability of dependencies in your project. Set the following environment variable before running a scan to enable call graph generation.
See Environment variables that affect scan behavior for more information.

​
Known limitations

  • Ruby call graphs use best-effort resolution and do not resolve dynamic method calls, including method_missing, send, public_send, eval, and other metaprogramming patterns.
  • If a dependency cannot resolve in the Gemfile, the build for that specific package may not succeed. The package may no longer exist in the Gem package manager. Other packages in the workspace are scanned.

​
Troubleshoot errors

  • Unresolved dependency errors: The Gemfile is not buildable. Try running bundler install in the root project to debug this error.
  • Resolved dependency errors: A dependency version does not exist or cannot be found. The package may no longer exist in the repository.