Description

Detects Ruby projects that have declared dependencies (gems) but are missing a lock file (Gemfile.lock or gems.locked). Missing lock files can lead to supply chain vulnerabilities since dependency versions aren't explicitly pinned, potentially allowing malicious package versions to be installed.

Detection Strategy

• Checks if the file contains gem declarations indicating Ruby dependencies

• Verifies if either 'Gemfile.lock' or 'gems.locked' exists in the same directory as the Gemfile

• Reports a vulnerability if gem dependencies are declared but no lock file is present