bundler 1.17.3 → 2.6.3

data/lib/bundler/vendor/pub_grub/lib/pub_grub/version_union.rb

@@ -0,0 +1,178 @@
+# frozen_string_literal: true
+
+module Bundler::PubGrub
+  class VersionUnion
+    attr_reader :ranges
+
+    def self.normalize_ranges(ranges)
+      ranges = ranges.flat_map do |range|
+        range.ranges
+      end
+
+      ranges.reject!(&:empty?)
+
+      return [] if ranges.empty?
+
+      mins, ranges = ranges.partition { |r| !r.min }
+      original_ranges = mins + ranges.sort_by { |r| [r.min, r.include_min ? 0 : 1] }
+      ranges = [original_ranges.shift]
+      original_ranges.each do |range|
+        if ranges.last.contiguous_to?(range)
+          ranges << ranges.pop.span(range)
+        else
+          ranges << range
+        end
+      end
+
+      ranges
+    end
+
+    def self.union(ranges, normalize: true)
+      ranges = normalize_ranges(ranges) if normalize
+
+      if ranges.size == 0
+        VersionRange.empty
+      elsif ranges.size == 1
+        ranges[0]
+      else
+        new(ranges)
+      end
+    end
+
+    def initialize(ranges)
+      raise ArgumentError unless ranges.all? { |r| r.instance_of?(VersionRange) }
+      @ranges = ranges
+    end
+
+    def hash
+      ranges.hash
+    end
+
+    def eql?(other)
+      ranges.eql?(other.ranges)
+    end
+
+    def include?(version)
+      !!ranges.bsearch {|r| r.compare_version(version) }
+    end
+
+    def select_versions(all_versions)
+      versions = []
+      ranges.inject(all_versions) do |acc, range|
+        _, matching, higher = range.partition_versions(acc)
+        versions.concat matching
+        higher
+      end
+      versions
+    end
+
+    def intersects?(other)
+      my_ranges = ranges.dup
+      other_ranges = other.ranges.dup
+
+      my_range = my_ranges.shift
+      other_range = other_ranges.shift
+      while my_range && other_range
+        if my_range.intersects?(other_range)
+          return true
+        end
+
+        if !my_range.max || other_range.empty? || (other_range.max && other_range.max < my_range.max)
+          other_range = other_ranges.shift
+        else
+          my_range = my_ranges.shift
+        end
+      end
+    end
+    alias_method :allows_any?, :intersects?
+
+    def allows_all?(other)
+      my_ranges = ranges.dup
+
+      my_range = my_ranges.shift
+
+      other.ranges.all? do |other_range|
+        while my_range
+          break if my_range.allows_all?(other_range)
+          my_range = my_ranges.shift
+        end
+
+        !!my_range
+      end
+    end
+
+    def empty?
+      false
+    end
+
+    def any?
+      false
+    end
+
+    def intersect(other)
+      my_ranges = ranges.dup
+      other_ranges = other.ranges.dup
+      new_ranges = []
+
+      my_range = my_ranges.shift
+      other_range = other_ranges.shift
+      while my_range && other_range
+        new_ranges << my_range.intersect(other_range)
+
+        if !my_range.max || other_range.empty? || (other_range.max && other_range.max < my_range.max)
+          other_range = other_ranges.shift
+        else
+          my_range = my_ranges.shift
+        end
+      end
+      new_ranges.reject!(&:empty?)
+      VersionUnion.union(new_ranges, normalize: false)
+    end
+
+    def upper_invert
+      ranges.last.upper_invert
+    end
+
+    def invert
+      ranges.map(&:invert).inject(:intersect)
+    end
+
+    def union(other)
+      VersionUnion.union([self, other])
+    end
+
+    def to_s
+      output = []
+
+      ranges = self.ranges.dup
+      while !ranges.empty?
+        ne = []
+        range = ranges.shift
+        while !ranges.empty? && ranges[0].min.to_s == range.max.to_s
+          ne << range.max
+          range = range.span(ranges.shift)
+        end
+
+        ne.map! {|x| "!= #{x}" }
+        if ne.empty?
+          output << range.to_s
+        elsif range.any?
+          output << ne.join(', ')
+        else
+          output << "#{range}, #{ne.join(', ')}"
+        end
+      end
+
+      output.join(" OR ")
+    end
+
+    def inspect
+      "#<#{self.class} #{to_s}>"
+    end
+
+    def ==(other)
+      self.class == other.class &&
+        self.ranges == other.ranges
+    end
+  end
+end

data/lib/bundler/vendor/pub_grub/lib/pub_grub.rb

@@ -0,0 +1,31 @@
+require_relative "pub_grub/package"
+require_relative "pub_grub/static_package_source"
+require_relative "pub_grub/term"
+require_relative "pub_grub/version_range"
+require_relative "pub_grub/version_constraint"
+require_relative "pub_grub/version_union"
+require_relative "pub_grub/version_solver"
+require_relative "pub_grub/incompatibility"
+require_relative 'pub_grub/solve_failure'
+require_relative 'pub_grub/failure_writer'
+require_relative 'pub_grub/version'
+
+module Bundler::PubGrub
+  class << self
+    attr_writer :logger
+
+    def logger
+      @logger || default_logger
+    end
+
+    private
+
+    def default_logger
+      require "logger"
+
+      logger = ::Logger.new(STDERR)
+      logger.level = $DEBUG ? ::Logger::DEBUG : ::Logger::WARN
+      @logger = logger
+    end
+  end
+end

data/lib/bundler/vendor/securerandom/.document

@@ -0,0 +1 @@
+# Vendored files do not need to be documented

data/lib/bundler/vendor/securerandom/COPYING

@@ -0,0 +1,56 @@
+Ruby is copyrighted free software by Yukihiro Matsumoto <matz@netlab.jp>.
+You can redistribute it and/or modify it under either the terms of the
+2-clause BSDL (see the file BSDL), or the conditions below:
+
+1. You may make and give away verbatim copies of the source form of the
+   software without restriction, provided that you duplicate all of the
+   original copyright notices and associated disclaimers.
+
+2. You may modify your copy of the software in any way, provided that
+   you do at least ONE of the following:
+
+   a. place your modifications in the Public Domain or otherwise
+      make them Freely Available, such as by posting said
+      modifications to Usenet or an equivalent medium, or by allowing
+      the author to include your modifications in the software.
+
+   b. use the modified software only within your corporation or
+      organization.
+
+   c. give non-standard binaries non-standard names, with
+      instructions on where to get the original software distribution.
+
+   d. make other distribution arrangements with the author.
+
+3. You may distribute the software in object code or binary form,
+   provided that you do at least ONE of the following:
+
+   a. distribute the binaries and library files of the software,
+      together with instructions (in the manual page or equivalent)
+      on where to get the original distribution.
+
+   b. accompany the distribution with the machine-readable source of
+      the software.
+
+   c. give non-standard binaries non-standard names, with
+      instructions on where to get the original software distribution.
+
+   d. make other distribution arrangements with the author.
+
+4. You may modify and include the part of the software into any other
+   software (possibly commercial).  But some files in the distribution
+   are not written by the author, so that they are not under these terms.
+
+   For the list of those files and their copying conditions, see the
+   file LEGAL.
+
+5. The scripts and library files supplied as input to or produced as
+   output from the software do not automatically fall under the
+   copyright of the software, but belong to whomever generated them,
+   and may be sold commercially, and may be aggregated with this
+   software.
+
+6. THIS SOFTWARE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
+   IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+   WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+   PURPOSE.

data/lib/bundler/vendor/securerandom/lib/securerandom.rb

@@ -0,0 +1,102 @@
+# -*- coding: us-ascii -*-
+# frozen_string_literal: true
+
+require 'random/formatter'
+
+# == Secure random number generator interface.
+#
+# This library is an interface to secure random number generators which are
+# suitable for generating session keys in HTTP cookies, etc.
+#
+# You can use this library in your application by requiring it:
+#
+#   require 'bundler/vendor/securerandom/lib/securerandom'
+#
+# It supports the following secure random number generators:
+#
+# * openssl
+# * /dev/urandom
+# * Win32
+#
+# Bundler::SecureRandom is extended by the Random::Formatter module which
+# defines the following methods:
+#
+# * alphanumeric
+# * base64
+# * choose
+# * gen_random
+# * hex
+# * rand
+# * random_bytes
+# * random_number
+# * urlsafe_base64
+# * uuid
+#
+# These methods are usable as class methods of Bundler::SecureRandom such as
+# +Bundler::SecureRandom.hex+.
+#
+# If a secure random number generator is not available,
+# +NotImplementedError+ is raised.
+
+module Bundler::SecureRandom
+
+  # The version
+  VERSION = "0.4.1"
+
+  class << self
+    # Returns a random binary string containing +size+ bytes.
+    #
+    # See Random.bytes
+    def bytes(n)
+      return gen_random(n)
+    end
+
+    # Compatibility methods for Ruby 3.2, we can remove this after dropping to support Ruby 3.2
+    def alphanumeric(n = nil, chars: ALPHANUMERIC)
+      n = 16 if n.nil?
+      choose(chars, n)
+    end if RUBY_VERSION < '3.3'
+
+    private
+
+    # :stopdoc:
+
+    # Implementation using OpenSSL
+    def gen_random_openssl(n)
+      return OpenSSL::Random.random_bytes(n)
+    end
+
+    # Implementation using system random device
+    def gen_random_urandom(n)
+      ret = Random.urandom(n)
+      unless ret
+        raise NotImplementedError, "No random device"
+      end
+      unless ret.length == n
+        raise NotImplementedError, "Unexpected partial read from random device: only #{ret.length} for #{n} bytes"
+      end
+      ret
+    end
+
+    begin
+      # Check if Random.urandom is available
+      Random.urandom(1)
+      alias gen_random gen_random_urandom
+    rescue RuntimeError
+      begin
+        require 'openssl'
+      rescue NoMethodError
+        raise NotImplementedError, "No random device"
+      else
+        alias gen_random gen_random_openssl
+      end
+    end
+
+    # :startdoc:
+
+    # Generate random data bytes for Random::Formatter
+    public :gen_random
+  end
+end
+
+Bundler::SecureRandom.extend(Random::Formatter)

data/lib/bundler/vendor/thor/.document

@@ -0,0 +1 @@
+# Vendored files do not need to be documented

data/lib/bundler/vendor/thor/LICENSE.md

@@ -0,0 +1,20 @@
+Copyright (c) 2008 Yehuda Katz, Eric Hodel, et al.
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/lib/bundler/vendor/thor/lib/thor/actions/create_file.rb

@@ -1,4 +1,4 @@
-require "bundler/vendor/thor/lib/thor/actions/empty_directory"
+require_relative "empty_directory"
 
 class Bundler::Thor
   module Actions
@@ -43,7 +43,8 @@ class Bundler::Thor
       # Boolean:: true if it is identical, false otherwise.
       #
       def identical?
-        exists? && File.binread(destination) == render
+        # binread uses ASCII-8BIT, so to avoid false negatives, the string must use the same
+        exists? && File.binread(destination) == String.new(render).force_encoding("ASCII-8BIT")
       end
 
       # Holds the content to be added to the file.
@@ -60,7 +61,7 @@ class Bundler::Thor
         invoke_with_conflict_check do
           require "fileutils"
           FileUtils.mkdir_p(File.dirname(destination))
-          File.open(destination, "wb") { |f| f.write render }
+          File.open(destination, "wb", config[:perm]) { |f| f.write render }
         end
         given_destination
       end

data/lib/bundler/vendor/thor/lib/thor/actions/create_link.rb

@@ -1,4 +1,4 @@
-require "bundler/vendor/thor/lib/thor/actions/create_file"
+require_relative "create_file"
 
 class Bundler::Thor
   module Actions
@@ -33,7 +33,8 @@ class Bundler::Thor
       # Boolean:: true if it is identical, false otherwise.
       #
       def identical?
-        exists? && File.identical?(render, destination)
+        source = File.expand_path(render, File.dirname(destination))
+        exists? && File.identical?(source, destination)
       end
 
       def invoke!

data/lib/bundler/vendor/thor/lib/thor/actions/directory.rb

@@ -1,4 +1,4 @@
-require "bundler/vendor/thor/lib/thor/actions/empty_directory"
+require_relative "empty_directory"
 
 class Bundler::Thor
   module Actions
@@ -56,9 +56,9 @@ class Bundler::Thor
       attr_reader :source
 
       def initialize(base, source, destination = nil, config = {}, &block)
-        @source = File.expand_path(base.find_in_source_paths(source.to_s))
+        @source = File.expand_path(Dir[Util.escape_globs(base.find_in_source_paths(source.to_s))].first)
         @block  = block
-        super(base, destination, {:recursive => true}.merge(config))
+        super(base, destination, {recursive: true}.merge(config))
       end
 
       def invoke!
@@ -96,22 +96,12 @@ class Bundler::Thor
         end
       end
 
-      if RUBY_VERSION < "2.0"
-        def file_level_lookup(previous_lookup)
-          File.join(previous_lookup, "{*,.[a-z]*}")
-        end
-
-        def files(lookup)
-          Dir[lookup]
-        end
-      else
-        def file_level_lookup(previous_lookup)
-          File.join(previous_lookup, "*")
-        end
+      def file_level_lookup(previous_lookup)
+        File.join(previous_lookup, "*")
+      end
 
-        def files(lookup)
-          Dir.glob(lookup, File::FNM_DOTMATCH)
-        end
+      def files(lookup)
+        Dir.glob(lookup, File::FNM_DOTMATCH)
       end
     end
   end

data/lib/bundler/vendor/thor/lib/thor/actions/empty_directory.rb

@@ -33,7 +33,7 @@ class Bundler::Thor
       #
       def initialize(base, destination, config = {})
         @base = base
-        @config = {:verbose => true}.merge(config)
+        @config = {verbose: true}.merge(config)
         self.destination = destination
       end
 

data/lib/bundler/vendor/thor/lib/thor/actions/file_manipulation.rb

@@ -10,7 +10,6 @@ class Bundler::Thor
     # destination<String>:: the relative path to the destination root.
     # config<Hash>:: give :verbose => false to not log the status, and
     #                :mode => :preserve, to preserve the file mode from the source.
-
     #
     # ==== Examples
     #
@@ -23,14 +22,14 @@ class Bundler::Thor
       destination = args.first || source
       source = File.expand_path(find_in_source_paths(source.to_s))
 
-      create_file destination, nil, config do
+      resulting_destination = create_file destination, nil, config do
         content = File.binread(source)
         content = yield(content) if block
         content
       end
       if config[:mode] == :preserve
         mode = File.stat(source).mode
-        chmod(destination, mode, config)
+        chmod(resulting_destination, mode, config)
       end
     end
 
@@ -60,15 +59,21 @@ class Bundler::Thor
     # destination. If a block is given instead of destination, the content of
     # the url is yielded and used as location.
     #
+    # +get+ relies on open-uri, so passing application user input would provide
+    # a command injection attack vector.
+    #
     # ==== Parameters
     # source<String>:: the address of the given content.
     # destination<String>:: the relative path to the destination root.
-    # config<Hash>:: give :verbose => false to not log the status.
+    # config<Hash>:: give :verbose => false to not log the status, and
+    #                :http_headers => <Hash> to add headers to an http request.
     #
     # ==== Examples
     #
     #   get "http://gist.github.com/103208", "doc/README"
     #
+    #   get "http://gist.github.com/103208", "doc/README", :http_headers => {"Content-Type" => "application/json"}
+    #
     #   get "http://gist.github.com/103208" do |content|
     #     content.split("\n").first
     #   end
@@ -77,14 +82,14 @@ class Bundler::Thor
       config = args.last.is_a?(Hash) ? args.pop : {}
       destination = args.first
 
-      if source =~ %r{^https?\://}
+      render = if source =~ %r{^https?\://}
         require "open-uri"
+        URI.send(:open, source, config.fetch(:http_headers, {})) { |input| input.binmode.read }
       else
         source = File.expand_path(find_in_source_paths(source.to_s))
+        File.open(source) { |input| input.binmode.read }
       end
 
-      render = open(source) { |input| input.binmode.read }
-
       destination ||= if block_given?
         block.arity == 1 ? yield(render) : yield
       else
@@ -117,7 +122,8 @@ class Bundler::Thor
       context = config.delete(:context) || instance_eval("binding")
 
       create_file destination, nil, config do
-        content = CapturableERB.new(::File.binread(source), nil, "-", "@output_buffer").tap do |erb|
+        capturable_erb = CapturableERB.new(::File.binread(source), trim_mode: "-", eoutvar: "@output_buffer")
+        content = capturable_erb.tap do |erb|
           erb.filename = source
         end.result(context)
         content = yield(content) if block
@@ -201,9 +207,9 @@ class Bundler::Thor
     #
     # ==== Examples
     #
-    #   inject_into_class "app/controllers/application_controller.rb", ApplicationController, "  filter_parameter :password\n"
+    #   inject_into_class "app/controllers/application_controller.rb", "ApplicationController", "  filter_parameter :password\n"
     #
-    #   inject_into_class "app/controllers/application_controller.rb", ApplicationController do
+    #   inject_into_class "app/controllers/application_controller.rb", "ApplicationController" do
     #     "  filter_parameter :password\n"
     #   end
     #
@@ -224,9 +230,9 @@ class Bundler::Thor
     #
     # ==== Examples
     #
-    #   inject_into_module "app/helpers/application_helper.rb", ApplicationHelper, "  def help; 'help'; end\n"
+    #   inject_into_module "app/helpers/application_helper.rb", "ApplicationHelper", "  def help; 'help'; end\n"
     #
-    #   inject_into_module "app/helpers/application_helper.rb", ApplicationHelper do
+    #   inject_into_module "app/helpers/application_helper.rb", "ApplicationHelper" do
     #     "  def help; 'help'; end\n"
     #   end
     #
@@ -242,7 +248,8 @@ class Bundler::Thor
     # path<String>:: path of the file to be changed
     # flag<Regexp|String>:: the regexp or string to be replaced
     # replacement<String>:: the replacement, can be also given as a block
-    # config<Hash>:: give :verbose => false to not log the status.
+    # config<Hash>:: give :verbose => false to not log the status, and
+    #                :force => true, to force the replacement regardless of runner behavior.
     #
     # ==== Example
     #
@@ -253,9 +260,10 @@ class Bundler::Thor
     #   end
     #
     def gsub_file(path, flag, *args, &block)
-      return unless behavior == :invoke
       config = args.last.is_a?(Hash) ? args.pop : {}
 
+      return unless behavior == :invoke || config.fetch(:force, false)
+
       path = File.expand_path(path, destination_root)
       say_status :gsub, relative_to_original_destination_root(path), config.fetch(:verbose, true)
 
@@ -266,9 +274,8 @@ class Bundler::Thor
       end
     end
 
-    # Uncomment all lines matching a given regex.  It will leave the space
-    # which existed before the comment hash in tact but will remove any spacing
-    # between the comment hash and the beginning of the line.
+    # Uncomment all lines matching a given regex. Preserves indentation before
+    # the comment hash and removes the hash and any immediate following space.
     #
     # ==== Parameters
     # path<String>:: path of the file to be changed
@@ -282,7 +289,7 @@ class Bundler::Thor
     def uncomment_lines(path, flag, *args)
       flag = flag.respond_to?(:source) ? flag.source : flag
 
-      gsub_file(path, /^(\s*)#[[:blank:]]*(.*#{flag})/, '\1\2', *args)
+      gsub_file(path, /^(\s*)#[[:blank:]]?(.*#{flag})/, '\1\2', *args)
     end
 
     # Comment all lines matching a given regex.  It will leave the space
@@ -301,7 +308,7 @@ class Bundler::Thor
     def comment_lines(path, flag, *args)
       flag = flag.respond_to?(:source) ? flag.source : flag
 
-      gsub_file(path, /^(\s*)([^#|\n]*#{flag})/, '\1# \2', *args)
+      gsub_file(path, /^(\s*)([^#\n]*#{flag})/, '\1# \2', *args)
     end
 
     # Removes a file at the given location.
@@ -320,7 +327,7 @@ class Bundler::Thor
       path = File.expand_path(path, destination_root)
 
       say_status :remove, relative_to_original_destination_root(path), config.fetch(:verbose, true)
-      if !options[:pretend] && File.exist?(path)
+      if !options[:pretend] && (File.exist?(path) || File.symlink?(path))
         require "fileutils"
         ::FileUtils.rm_rf(path)
       end