cocoapods-protected-dependencies 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 8c700906e21cff422cbddf28322ad9dfd4a51ba51b8245d109c4ef4a267fc4bb
+  data.tar.gz: 86e9639391ba85e57a8f5f360eea5e2524b848ac59c629f162e79d0e71ae2e1d
+SHA512:
+  metadata.gz: 3bc397653697bc5df3c398ada0a43ec1422baff3480313ac4e85596fafbddf33a1d05446a13d6135ff33b9eaf3062964600077c5d066a8aee4560a1bfe7242f3
+  data.tar.gz: 8a76d1d2706b375720ea844805590b92b180d563ea341270b14b1db797a1f5cdc3bd68f96ddfc102a7a10e8287230158339663ce15208e6191014857a8a06444

data/lib/cocoapods-protected-dependencies.rb

@@ -0,0 +1 @@
+require 'cocoapods-protected-dependencies/gem_version'

data/lib/cocoapods-protected-dependencies/config.rb

@@ -0,0 +1,47 @@
+require 'singleton'
+require 'yaml'
+
+module CocoapodsProtectedPrivate
+    class Configuration
+        include Singleton
+        attr_accessor :config
+
+        def config
+            @config ||= []
+        end
+
+        def initialize()
+            load_configuration()
+        end
+
+        def load_configuration
+            unless File.file?('protected-specs.yml')
+                Pod::UI.puts "No 'protected-specs.yml' file, make sure you have created one".red
+                return
+            end
+
+            @config = YAML.load(File.read('protected-specs.yml'))
+        end
+
+        def filter_dependency(pod, specifications)
+            filtered = specifications.select { |spec| spec_is_valid(pod, spec) }
+
+            Pod::UI.puts "Dependency #{pod} is not allowed".red if filtered.empty?
+
+            return filtered
+        end
+
+        def spec_is_valid(pod, spec)
+            # Allow external dependencies (using :git or :path), which create a local podspec
+            return true if !spec.defined_in_file.nil? && spec.defined_in_file.to_s.include?('/Pods/Local Podspecs')
+
+            config.each { |repo|
+                next unless repo['source'] == spec.spec_source.url
+                
+                return true if !repo['lib'].nil? && repo['lib'].include?(pod)
+                return true if !repo['regex'].nil? && pod.match(Regexp.new repo['regex'])
+            }
+            return false
+        end
+    end
+end

data/lib/cocoapods-protected-dependencies/gem_version.rb

@@ -0,0 +1,3 @@
+module CocoapodsProtectedPrivate
+  VERSION = "0.0.1"
+end

data/lib/cocoapods-protected-dependencies/hook.rb

@@ -0,0 +1 @@
+require 'cocoapods-protected-dependencies/hook/resolver'

data/lib/cocoapods-protected-dependencies/hook/resolver.rb

@@ -0,0 +1,22 @@
+require 'cocoapods-protected-dependencies/config'
+
+module Pod
+    class Resolver
+        attr_accessor :cached_specifications
+
+        def cached_specifications
+            @cached_specifications ||= {}
+        end
+
+        alias original_search_for search_for
+        ## Filter specifications
+        def search_for(dependency)
+            specifications = original_search_for(dependency)
+            
+            if cached_specifications[dependency.name].nil?
+                cached_specifications[dependency.name] = CocoapodsProtectedPrivate::Configuration.instance.filter_dependency(dependency.root_name, specifications)
+            end
+            cached_specifications[dependency.name]
+        end
+    end
+end

data/lib/cocoapods_plugin.rb

@@ -0,0 +1,6 @@
+require 'cocoapods'
+require 'cocoapods-core'
+require 'cocoapods-protected-dependencies/hook'
+
+module CocoapodsProtectedPrivate
+end    

metadata

@@ -0,0 +1,106 @@
+--- !ruby/object:Gem::Specification
+name: cocoapods-protected-dependencies
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- itay
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2021-02-16 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: cocoapods-core
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+- !ruby/object:Gem::Dependency
+  name: cocoapods
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.8'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+description: CocoaPods is vulnerable to duplicated Pods in Private and Public repos,
+  this plugin provides a way to prevent a dependency from using a different source
+email:
+- itay@itaysoft.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- lib/cocoapods-protected-dependencies.rb
+- lib/cocoapods-protected-dependencies/config.rb
+- lib/cocoapods-protected-dependencies/gem_version.rb
+- lib/cocoapods-protected-dependencies/hook.rb
+- lib/cocoapods-protected-dependencies/hook/resolver.rb
+- lib/cocoapods_plugin.rb
+homepage: https://github.com/itaybre/cocoapods-protected-dependencies
+licenses:
+- MIT
+metadata: {}
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.8
+signing_key:
+specification_version: 4
+summary: Protect your project from being vulnerable to Dependency Confusion
+test_files: []