Add "double reported" advisory check

Author: jasnow

gems/yard/CVE-2026-41493.yml

@@ -2,7 +2,7 @@
 gem: yard
 cve: 2026-41493
 ghsa: 3jfp-46x4-xgfj
-url: https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj
+url: https://nvd.nist.gov/vuln/detail/CVE-2026-41493
 title: Possible arbitrary path traversal and file access via yard server
 date: 2026-04-17
 description: |
@@ -37,6 +37,7 @@ related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2026-41493
     - https://github.com/lsegal/yard/releases/tag/v0.9.42
+    - https://my.diffend.io/gems/yard/0.9.41/0.9.42
     - https://github.com/lsegal/yard/security/advisories/GHSA-3jfp-46x4-xgfj
     - https://github.com/lsegal/yard/security/advisories/GHSA-xfhh-rx56-rxcr
     - https://github.com/advisories/GHSA-3jfp-46x4-xgfj

gems/yard/GHSA-3jfp-46x4-xgfj.yml

@@ -1,12 +1,17 @@
 require 'spec_helper'
 require 'gem_advisory_example'
 require 'ruby_advisory_example'
+require 'advisory_dir_example'
 
 describe "gems" do
   Dir.glob(File.join(ROOT,'gems/*/*')) do |path|
     include_examples 'Gem Advisory', path
   end
 
+  Dir.glob(File.join(File.dirname(__FILE__), '../gems/*')) do |dir|
+    include_examples 'Advisory Directory', dir
+  end
+
   let(:dir)           { File.join(ROOT,'gems') }
   let(:advisory_dirs) { Dir.glob('*', base: dir) }
 
@@ -31,4 +36,8 @@
   Dir.glob(File.join(ROOT, 'rubies/*/*')) do |path|
     include_examples 'Rubies Advisory', path
   end
+
+  Dir.glob(File.join(File.dirname(__FILE__), '../rubies/*')) do |dir|
+    include_examples 'Advisory Directory', dir
+  end
 end

spec/advisories_spec.rb

@@ -0,0 +1,27 @@
+require 'rspec'
+require 'date'
+
+shared_examples_for "Advisory Directory" do |dir|
+  describe dir do
+    let(:advisory_paths) { Dir.glob(File.join(dir,'*.yml')) }
+    let(:advisories) do
+      advisory_paths.map do |path|
+        YAML.safe_load_file(path, permitted_classes: [Date])
+      end
+    end
+
+    it "must not contain duplicate CVE IDs" do
+      cve_ids = advisories.map { |advisory| advisory['cve'] }
+      cve_ids.compact!
+
+      expect(cve_ids).to eq(cve_ids.uniq)
+    end
+
+    it "must not contain duplicate GHSA IDs" do
+      ghsa_ids = advisories.map { |advisory| advisory['ghsa'] }.compact
+      ghsa_ids.compact!
+
+      expect(ghsa_ids).to eq(ghsa_ids.uniq)
+    end
+  end
+end