cocoapods-whitelist 0.5.3 → 0.5.5

Sign up to get free protection for your applications and to get access to all the features.
Files changed (18) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +8 -0
  3. data/Gemfile.lock +2 -1
  4. data/lib/cocoapods-whitelist/command/whitelist.rb +1 -3
  5. data/lib/cocoapods-whitelist/gem_version.rb +1 -1
  6. data/lib/cocoapods-whitelist/model/sources.rb +1 -1
  7. data/spec/mocks/allowed_with_granular.podspec +1 -0
  8. data/spec/mocks/not_allowed_with_granular_v2.podspec +13 -0
  9. data/spec/mocks/whitelist.json +23 -0
  10. data/spec/mocks/with_allowed_subspec_v2.podspec +14 -0
  11. data/spec/mocks/with_not_allowed_subspec_v2.podspec +14 -0
  12. data/spec/source_validator_spec.rb +6 -0
  13. data/spec/whitelist_resolver_spec.rb +1 -1
  14. data/spec/whitelist_spec.rb +34 -11
  15. metadata +15 -9
  16. /data/spec/mocks/{not_allowed_with_granular.podspec → not_allowed_with_granular_v1.podspec} +0 -0
  17. /data/spec/mocks/{with_allowed_subspec.podspec → with_allowed_subspec_v1.podspec} +0 -0
  18. /data/spec/mocks/{with_not_allowed_subspec.podspec → with_not_allowed_subspec_v1.podspec} +0 -0
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: df9811a2f73baf94fbffa4b66502c4b2d53235a661f29096662f5d3658584400
4
- data.tar.gz: b8e55e5ea04eec1f3760ac15b0809d272ce723e18365bdc728abb01c01d1b206
3
+ metadata.gz: be3cc02cfe363851d3557978df76db710357563f06ccc737d92f1fb459551690
4
+ data.tar.gz: 7a4126cc964d3bfff3f72b021595158fd7c773cda14816921c6b98a81d09dc52
5
5
  SHA512:
6
- metadata.gz: ef87c35379e76239424379d9225cd8646e90ad91b3963ad6d3ae8b0fbc5e435f648bd03d5107709f61be6ccf18f700b381dc837a03e0abddfc920d50d17e1766
7
- data.tar.gz: 218f8ab7fc4d67148255629f519302f8c90716664f0fabe2f62e20bdd628ed2a056bc388c82052545ef8a378760e352d9d9d6ccf2e006fb2ab6a245e63acf81c
6
+ metadata.gz: '04942cc1897281a5faaf62cb7c4ca472adc3fc9062e1c4584eb2947b94baa64c1d4b638831b3856cdc278a6cc5c716c9a49a9bc9ca77a5f1eb9c930231f6e452'
7
+ data.tar.gz: cd8c782f138e868610fe79f7ef9f009a8e478a14b08e90b6979e992c41f3c3227deaa65f99528adb8e04e8571b627f1c0fed45913eb66076c94d4cc4ccbe7771
data/CHANGELOG.md CHANGED
@@ -1,3 +1,11 @@
1
+ ## 0.5.5
2
+ ### Fixed
3
+ - Update private source spec repo URL to prioritize private sources over public sources in order to address potential Dependency Confusion vulnerability.
4
+
5
+ ## 0.5.4
6
+ ### Fixed
7
+ - Changed the way dependencies are comparing by name: using regex instead of compare against the beginning of name
8
+
1
9
  ## 0.5.3
2
10
  ### Changed
3
11
  - Get podspec specification functions changed to support KMP podspec path.
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- cocoapods-whitelist (0.5.1)
4
+ cocoapods-whitelist (0.5.5)
5
5
 
6
6
  GEM
7
7
  remote: https://rubygems.org/
@@ -102,6 +102,7 @@ GEM
102
102
  zeitwerk (2.6.12)
103
103
 
104
104
  PLATFORMS
105
+ ruby
105
106
  universal-darwin-22
106
107
 
107
108
  DEPENDENCIES
data/lib/cocoapods-whitelist/command/whitelist.rb CHANGED
@@ -3,8 +3,6 @@ require 'json'
3
3
  require_relative '../client/whitelist_resolver'
4
4
  require_relative '../model/validation_excluded'
5
5
 
6
- POD_NAME_REGEX = /^([^\/]+)(?:\/.*)*$/
7
- POD_BASE_REGEX_POSITION = 0
8
6
  DEFAULT_WHITELIST_URL = "https://raw.githubusercontent.com/mercadolibre/mobile-dependencies_whitelist/master/ios-whitelist.json"
9
7
 
10
8
  module Pod
@@ -90,7 +88,7 @@ module Pod
90
88
  end
91
89
 
92
90
  allowedDependency = whitelist.select { |item|
93
- name.start_with?(item.name.match(POD_NAME_REGEX).captures[POD_BASE_REGEX_POSITION]) && (!item.version || versions.grep(/#{item.version}/).any?) && (item.target == 'production')
91
+ (/^#{item.name}/ =~ name) && (!item.version || versions.grep(/#{item.version}/).any?) && (item.target == 'production')
94
92
  }
95
93
 
96
94
  allowedDependency.each { |dependency|
data/lib/cocoapods-whitelist/gem_version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module CocoapodsWhitelist
2
- VERSION = "0.5.3"
2
+ VERSION = "0.5.5"
3
3
  end
data/lib/cocoapods-whitelist/model/sources.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  def get_private_sources
2
- [ "git@github.com:mercadolibre/mobile-ios_specs.git" ]
2
+ [ "git@github.com:melisource/mobile-ios_specs.git" ]
3
3
  end
data/spec/mocks/allowed_with_granular.podspec CHANGED
@@ -9,5 +9,6 @@ Pod::Spec.new do |s|
9
9
  s.source = { :git => "git@github.com:mercadolibre/search-ios.git", :tag => s.version.to_s }
10
10
  s.requires_arc = true
11
11
  s.dependency 'Analytics', '~>5.1'
12
+ s.dependency 'AndesUI/SwiftUI', '~>5.1'
12
13
 
13
14
  end
data/spec/mocks/not_allowed_with_granular_v2.podspec ADDED
@@ -0,0 +1,13 @@
1
+ Pod::Spec.new do |s|
2
+ s.name = "MLCommons"
3
+ s.version = "3.17.0"
4
+ s.summary = "Componente de search"
5
+ s.homepage = "http://www.mercadolibre.com.ar"
6
+ s.license = "none"
7
+ s.author = { "Mobile team" => "mobile@mercadolibre.com" }
8
+ s.platform = :ios, "7.0"
9
+ s.source = { :git => "git@github.com:mercadolibre/search-ios.git", :tag => s.version.to_s }
10
+ s.requires_arc = true
11
+ s.dependency 'AndesUI/SwiftUI', '~>5.1'
12
+
13
+ end
data/spec/mocks/whitelist.json CHANGED
@@ -41,6 +41,29 @@
41
41
  "allows_granular_projects": [
42
42
  "MLSearch"
43
43
  ]
44
+ },
45
+ {
46
+ "name": "MercadoPagoSDKV4",
47
+ "version": null,
48
+ "target": "production"
49
+ },
50
+ {
51
+ "name": "AndesUI$",
52
+ "version": "^~>5.[0-9]+$",
53
+ "target": "production"
54
+ },
55
+ {
56
+ "name": "AndesUI/(Core|AndesCoachmark|AndesBottomSheet|AndesDropdown|AndesTimePicker)",
57
+ "version": "^~>5.[0-9]+$",
58
+ "target": "production"
59
+ },
60
+ {
61
+ "name": "AndesUI/SwiftUI",
62
+ "version": "^~>5.[0-9]+$",
63
+ "target": "production",
64
+ "allows_granular_projects": [
65
+ "MLSearch"
66
+ ]
44
67
  }
45
68
  ]
46
69
  }
data/spec/mocks/with_allowed_subspec_v2.podspec ADDED
@@ -0,0 +1,14 @@
1
+
2
+ Pod::Spec.new do |s|
3
+ s.name = "MLSearch"
4
+ s.version = "3.17.0"
5
+ s.summary = "Componente de search"
6
+ s.homepage = "http://www.mercadolibre.com.ar"
7
+ s.license = "none"
8
+ s.author = { "Mobile team" => "mobile@mercadolibre.com" }
9
+ s.platform = :ios, "7.0"
10
+ s.source = { :git => "git@github.com:mercadolibre/search-ios.git", :tag => s.version.to_s }
11
+ s.requires_arc = true
12
+ s.dependency 'AndesUI/Core', '~>5.0'
13
+
14
+ end
data/spec/mocks/with_not_allowed_subspec_v2.podspec ADDED
@@ -0,0 +1,14 @@
1
+
2
+ Pod::Spec.new do |s|
3
+ s.name = "MLSearch"
4
+ s.version = "3.17.0"
5
+ s.summary = "Componente de search"
6
+ s.homepage = "http://www.mercadolibre.com.ar"
7
+ s.license = "none"
8
+ s.author = { "Mobile team" => "mobile@mercadolibre.com" }
9
+ s.platform = :ios, "7.0"
10
+ s.source = { :git => "git@github.com:mercadolibre/search-ios.git", :tag => s.version.to_s }
11
+ s.requires_arc = true
12
+ s.dependency 'AndesUI/Icons', '~>5.0'
13
+
14
+ end
data/spec/source_validator_spec.rb CHANGED
@@ -68,5 +68,11 @@ describe SourceValidator do
68
68
 
69
69
  filtered.size.should.equal 1
70
70
  end
71
+
72
+
73
+ it 'private source repo should be valid' do
74
+ expected_sources = ["git@github.com:melisource/mobile-ios_specs.git"]
75
+ get_private_sources().should.equal expected_sources
76
+ end
71
77
  end
72
78
  end
data/spec/whitelist_resolver_spec.rb CHANGED
@@ -6,7 +6,7 @@ describe WhitelistResolver do
6
6
  describe 'functionality' do
7
7
  it 'whitelist should be loaded from an specific url' do
8
8
  whitelist = WhitelistResolver.instance.get_whitelist(WHITELIST_PATH)
9
- whitelist.size.should.equal 7
9
+ whitelist.size.should.equal 11
10
10
  end
11
11
 
12
12
  it 'if not URL is specified, whitelist comes from default URL' do
data/spec/whitelist_spec.rb CHANGED
@@ -27,13 +27,13 @@ module Pod
27
27
  lambda { command.run }.should.not.raise
28
28
  end
29
29
 
30
- # it 'dependency with incorrect name should not be valid' do
31
- # # Whitelist: ('MeliSDK', '~>5.*') | Podspec: ('Meli', '~>5.0')
32
- # command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
33
- # specification = Pod::Specification.from_file('./spec/mocks/bad_name.podspec')
34
- # command.expects(:get_podspec_specifications).returns([specification])
35
- # lambda { command.run }.should.raise Informative
36
- # end
30
+ it 'dependency with incorrect name should not be valid' do
31
+ # Whitelist: ('MeliSDK', '~>5.*') | Podspec: ('Meli', '~>5.0')
32
+ command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
33
+ specification = Pod::Specification.from_file('./spec/mocks/bad_name.podspec')
34
+ command.expects(:get_podspec_specifications).returns([specification])
35
+ lambda { command.run }.should.raise Informative
36
+ end
37
37
 
38
38
  it 'not allowed dependency should not be valid' do
39
39
  command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
@@ -100,15 +100,15 @@ module Pod
100
100
  it 'subspec dependency allowed in the whitelist should be valid' do
101
101
  # Whitelist: ('MeliSDK', '~>5.*') | Podspec: ('MeliSDK/Error')
102
102
  command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
103
- specification = Pod::Specification.from_file('./spec/mocks/with_allowed_subspec.podspec')
103
+ specification = Pod::Specification.from_file('./spec/mocks/with_allowed_subspec_v1.podspec')
104
104
  command.expects(:get_podspec_specifications).returns([specification])
105
105
  lambda { command.run }.should.not.raise
106
106
  end
107
107
 
108
- it 'subspec dependency not allowed in the whitelist should not be valid' do
108
+ it 'dependency not allowed in the whitelist should not be valid' do
109
109
  # Whitelist: ('MeliSDK', '~>5.*') | Podspec: ('MyMeliSDK/Error')
110
110
  command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
111
- specification = Pod::Specification.from_file('./spec/mocks/with_not_allowed_subspec.podspec')
111
+ specification = Pod::Specification.from_file('./spec/mocks/with_not_allowed_subspec_v1.podspec')
112
112
  command.expects(:get_podspec_specifications).returns([specification])
113
113
  lambda { command.run }.should.raise Informative
114
114
  end
@@ -181,7 +181,30 @@ module Pod
181
181
 
182
182
  it 'not allowed granular dependency should not be valid' do
183
183
  command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
184
- specification = Pod::Specification.from_file('./spec/mocks/not_allowed_with_granular.podspec')
184
+ specification = Pod::Specification.from_file('./spec/mocks/not_allowed_with_granular_v1.podspec')
185
+ command.expects(:get_podspec_specifications).returns([specification])
186
+ lambda { command.run }.should.raise Informative
187
+ end
188
+
189
+ it 'not allowed granular subspec dependency should not be valid' do
190
+ command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
191
+ specification = Pod::Specification.from_file('./spec/mocks/not_allowed_with_granular_v2.podspec')
192
+ command.expects(:get_podspec_specifications).returns([specification])
193
+ lambda { command.run }.should.raise Informative
194
+ end
195
+
196
+ it 'subspec dependency allowed in the whitelist should be valid' do
197
+ # Whitelist: ('AndesUI/Core') | Podspec: ('AndesUI/Core')
198
+ command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
199
+ specification = Pod::Specification.from_file('./spec/mocks/with_allowed_subspec_v2.podspec')
200
+ command.expects(:get_podspec_specifications).returns([specification])
201
+ lambda { command.run }.should.not.raise
202
+ end
203
+
204
+ it 'subspec dependency not allowed in the whitelist should not be valid' do
205
+ # Whitelist: ('AndesUI/Core') | Podspec: ('AndesUI/Icons')
206
+ command = Command.parse(['whitelist', "--config=#{WHITELIST_FILE}", "--fail-on-error"])
207
+ specification = Pod::Specification.from_file('./spec/mocks/with_not_allowed_subspec_v2.podspec')
185
208
  command.expects(:get_podspec_specifications).returns([specification])
186
209
  lambda { command.run }.should.raise Informative
187
210
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: cocoapods-whitelist
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.5.3
4
+ version: 0.5.5
5
5
  platform: ruby
6
6
  authors:
7
7
  - Mobile Team
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2024-01-16 00:00:00.000000000 Z
11
+ date: 2024-04-23 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: bundler
@@ -75,17 +75,20 @@ files:
75
75
  - spec/mocks/free_version.podspec
76
76
  - spec/mocks/major_version_fixed.podspec
77
77
  - spec/mocks/not_allowed.podspec
78
- - spec/mocks/not_allowed_with_granular.podspec
78
+ - spec/mocks/not_allowed_with_granular_v1.podspec
79
+ - spec/mocks/not_allowed_with_granular_v2.podspec
79
80
  - spec/mocks/whitelist.json
80
81
  - spec/mocks/whitelist_with_expired_dependencies.json
81
82
  - spec/mocks/whitelisted_podname.podspec
82
83
  - spec/mocks/with_allowed_in_subspec.podspec
83
- - spec/mocks/with_allowed_subspec.podspec
84
+ - spec/mocks/with_allowed_subspec_v1.podspec
85
+ - spec/mocks/with_allowed_subspec_v2.podspec
84
86
  - spec/mocks/with_expired_dependencies.podspec
85
87
  - spec/mocks/with_fixed_version.podspec
86
88
  - spec/mocks/with_more_than_one_version_in_subspec.podspec
87
89
  - spec/mocks/with_not_allowed_in_subspec.podspec
88
- - spec/mocks/with_not_allowed_subspec.podspec
90
+ - spec/mocks/with_not_allowed_subspec_v1.podspec
91
+ - spec/mocks/with_not_allowed_subspec_v2.podspec
89
92
  - spec/mocks/with_not_yet_expired_dependencies.podspec
90
93
  - spec/mocks/with_similar_name_not_allowed.podspec
91
94
  - spec/mocks/with_two_requirement.podspec
@@ -118,7 +121,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
118
121
  - !ruby/object:Gem::Version
119
122
  version: '0'
120
123
  requirements: []
121
- rubygems_version: 3.0.9
124
+ rubygems_version: 3.3.26
122
125
  signing_key:
123
126
  specification_version: 4
124
127
  summary: A longer description of cocoapods-whitelist.
@@ -128,17 +131,20 @@ test_files:
128
131
  - spec/mocks/free_version.podspec
129
132
  - spec/mocks/major_version_fixed.podspec
130
133
  - spec/mocks/not_allowed.podspec
131
- - spec/mocks/not_allowed_with_granular.podspec
134
+ - spec/mocks/not_allowed_with_granular_v1.podspec
135
+ - spec/mocks/not_allowed_with_granular_v2.podspec
132
136
  - spec/mocks/whitelist.json
133
137
  - spec/mocks/whitelist_with_expired_dependencies.json
134
138
  - spec/mocks/whitelisted_podname.podspec
135
139
  - spec/mocks/with_allowed_in_subspec.podspec
136
- - spec/mocks/with_allowed_subspec.podspec
140
+ - spec/mocks/with_allowed_subspec_v1.podspec
141
+ - spec/mocks/with_allowed_subspec_v2.podspec
137
142
  - spec/mocks/with_expired_dependencies.podspec
138
143
  - spec/mocks/with_fixed_version.podspec
139
144
  - spec/mocks/with_more_than_one_version_in_subspec.podspec
140
145
  - spec/mocks/with_not_allowed_in_subspec.podspec
141
- - spec/mocks/with_not_allowed_subspec.podspec
146
+ - spec/mocks/with_not_allowed_subspec_v1.podspec
147
+ - spec/mocks/with_not_allowed_subspec_v2.podspec
142
148
  - spec/mocks/with_not_yet_expired_dependencies.podspec
143
149
  - spec/mocks/with_similar_name_not_allowed.podspec
144
150
  - spec/mocks/with_two_requirement.podspec