dependabot-bundler 0.94.0

data/lib/dependabot/bundler/file_updater/requirement_replacer.rb

@@ -0,0 +1,221 @@
+# frozen_string_literal: true
+
+require "parser/current"
+require "dependabot/bundler/file_updater"
+
+module Dependabot
+  module Bundler
+    class FileUpdater
+      class RequirementReplacer
+        attr_reader :dependency, :file_type, :updated_requirement,
+                    :previous_requirement
+
+        def initialize(dependency:, file_type:, updated_requirement:,
+                       previous_requirement: nil, insert_if_bare: false)
+          @dependency           = dependency
+          @file_type            = file_type
+          @updated_requirement  = updated_requirement
+          @previous_requirement = previous_requirement
+          @insert_if_bare       = insert_if_bare
+        end
+
+        def rewrite(content)
+          buffer = Parser::Source::Buffer.new("(gemfile_content)")
+          buffer.source = content
+          ast = Parser::CurrentRuby.new.parse(buffer)
+
+          updated_content = Rewriter.new(
+            dependency: dependency,
+            file_type: file_type,
+            updated_requirement: updated_requirement,
+            insert_if_bare: insert_if_bare?
+          ).rewrite(buffer, ast)
+
+          update_comment_spacing_if_required(content, updated_content)
+        end
+
+        private
+
+        def insert_if_bare?
+          @insert_if_bare
+        end
+
+        def update_comment_spacing_if_required(content, updated_content)
+          return updated_content unless previous_requirement
+
+          return updated_content if updated_content == content
+          return updated_content if length_change.zero?
+
+          updated_lines = updated_content.lines
+          updated_line_index =
+            updated_lines.length.
+            times.find { |i| content.lines[i] != updated_content.lines[i] }
+          updated_line = updated_lines[updated_line_index]
+
+          updated_line =
+            if length_change.positive?
+              updated_line.sub(/(?<=\s)\s{#{length_change}}#/, "#")
+            elsif length_change.negative?
+              updated_line.sub(/(?<=\s{2})#/, " " * length_change.abs + "#")
+            end
+
+          updated_lines[updated_line_index] = updated_line
+          updated_lines.join
+        end
+
+        def length_change
+          unless previous_requirement.start_with?("=")
+            return updated_requirement.length - previous_requirement.length
+          end
+
+          updated_requirement.length -
+            previous_requirement.gsub(/^=/, "").strip.length
+        end
+
+        class Rewriter < Parser::TreeRewriter
+          # TODO: Ideally we wouldn't have to ignore all of these, but
+          # implementing each one will be tricky.
+          SKIPPED_TYPES = %i(send lvar dstr begin if splat const).freeze
+
+          def initialize(dependency:, file_type:, updated_requirement:,
+                         insert_if_bare:)
+            @dependency          = dependency
+            @file_type           = file_type
+            @updated_requirement = updated_requirement
+            @insert_if_bare      = insert_if_bare
+
+            return if %i(gemfile gemspec).include?(file_type)
+
+            raise "File type must be :gemfile or :gemspec. Got #{file_type}."
+          end
+
+          def on_send(node)
+            return unless declares_targeted_gem?(node)
+
+            req_nodes = node.children[3..-1]
+            req_nodes = req_nodes.reject { |child| child.type == :hash }
+
+            return if req_nodes.none? && !insert_if_bare?
+            return if req_nodes.any? { |n| SKIPPED_TYPES.include?(n.type) }
+
+            quote_characters = extract_quote_characters_from(req_nodes)
+            space_after_specifier = space_after_specifier?(req_nodes)
+            use_equality_operator = use_equality_operator?(req_nodes)
+
+            new_req = new_requirement_string(
+              quote_characters: quote_characters,
+              space_after_specifier: space_after_specifier,
+              use_equality_operator: use_equality_operator
+            )
+            if req_nodes.any?
+              replace(range_for(req_nodes), new_req)
+            else
+              insert_after(range_for(node.children[2..2]), ", #{new_req}")
+            end
+          end
+
+          private
+
+          attr_reader :dependency, :file_type, :updated_requirement
+
+          def insert_if_bare?
+            @insert_if_bare
+          end
+
+          def declaration_methods
+            return %i(gem) if file_type == :gemfile
+
+            %i(add_dependency add_runtime_dependency
+               add_development_dependency)
+          end
+
+          def declares_targeted_gem?(node)
+            return false unless declaration_methods.include?(node.children[1])
+
+            node.children[2].children.first == dependency.name
+          end
+
+          def extract_quote_characters_from(requirement_nodes)
+            return ['"', '"'] if requirement_nodes.none?
+
+            case requirement_nodes.first.type
+            when :str, :dstr
+              [
+                requirement_nodes.first.loc.begin.source,
+                requirement_nodes.first.loc.end.source
+              ]
+            else
+              [
+                requirement_nodes.first.children.first.loc.begin.source,
+                requirement_nodes.first.children.first.loc.end.source
+              ]
+            end
+          end
+
+          def space_after_specifier?(requirement_nodes)
+            return true if requirement_nodes.none?
+
+            req_string =
+              case requirement_nodes.first.type
+              when :str, :dstr
+                requirement_nodes.first.loc.expression.source
+              else
+                requirement_nodes.first.children.first.loc.expression.source
+              end
+
+            ops = Gem::Requirement::OPS.keys
+            return true if ops.none? { |op| req_string.include?(op) }
+
+            req_string.include?(" ")
+          end
+
+          def use_equality_operator?(requirement_nodes)
+            return true if requirement_nodes.none?
+
+            req_string =
+              case requirement_nodes.first.type
+              when :str, :dstr
+                requirement_nodes.first.loc.expression.source
+              else
+                requirement_nodes.first.children.first.loc.expression.source
+              end
+
+            req_string.match?(/(?<![<>])=/)
+          end
+
+          def new_requirement_string(quote_characters:,
+                                     space_after_specifier:,
+                                     use_equality_operator:)
+            open_quote, close_quote = quote_characters
+            new_requirement_string =
+              updated_requirement.split(",").
+              map do |r|
+                req_string = serialized_req(r, use_equality_operator)
+                %(#{open_quote}#{req_string}#{close_quote})
+              end.join(", ")
+
+            new_requirement_string.delete!(" ") unless space_after_specifier
+            new_requirement_string
+          end
+
+          def serialized_req(req, use_equality_operator)
+            tmp_req = req
+
+            # Gem::Requirement serializes exact matches as a string starting
+            # with `=`. We may need to remove that equality operator if it
+            # wasn't used originally.
+            unless use_equality_operator
+              tmp_req = tmp_req.gsub(/(?<![<>])=/, "")
+            end
+
+            tmp_req.strip
+          end
+
+          def range_for(nodes)
+            nodes.first.loc.begin.begin.join(nodes.last.loc.expression)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/bundler/metadata_finder.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require "excon"
+require "dependabot/metadata_finders"
+require "dependabot/metadata_finders/base"
+
+module Dependabot
+  module Bundler
+    class MetadataFinder < Dependabot::MetadataFinders::Base
+      SOURCE_KEYS = %w(
+        source_code_uri
+        homepage_uri
+        wiki_uri
+        bug_tracker_uri
+        documentation_uri
+        changelog_uri
+        mailing_list_uri
+        download_uri
+      ).freeze
+
+      def homepage_url
+        return super unless %w(default rubygems).include?(new_source_type)
+        return super unless rubygems_api_response["homepage_uri"]
+
+        rubygems_api_response["homepage_uri"]
+      end
+
+      private
+
+      def look_up_source
+        case new_source_type
+        when "git" then find_source_from_git_url
+        when "default", "rubygems" then find_source_from_rubygems
+        else raise "Unexpected source type: #{new_source_type}"
+        end
+      end
+
+      def new_source_type
+        sources =
+          dependency.requirements.map { |r| r.fetch(:source) }.uniq.compact
+
+        return "default" if sources.empty?
+        raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
+
+        sources.first[:type] || sources.first.fetch("type")
+      end
+
+      def find_source_from_rubygems
+        api_source = find_source_from_rubygems_api_response
+        return api_source if api_source || new_source_type == "default"
+
+        find_source_from_gemspec_download
+      end
+
+      def find_source_from_rubygems_api_response
+        source_url = rubygems_api_response.
+                     values_at(*SOURCE_KEYS).
+                     compact.
+                     find { |url| Source.from_url(url) }
+
+        Source.from_url(source_url)
+      end
+
+      def find_source_from_git_url
+        info = dependency.requirements.map { |r| r[:source] }.compact.first
+
+        url = info[:url] || info.fetch("url")
+        Source.from_url(url)
+      end
+
+      def find_source_from_gemspec_download
+        github_urls = []
+        return unless rubygems_marshalled_gemspec_response
+
+        rubygems_marshalled_gemspec_response.scan(Source::SOURCE_REGEX) do
+          github_urls << Regexp.last_match.to_s
+        end
+
+        source_url = github_urls.find do |url|
+          repo = Source.from_url(url).repo
+          repo.downcase.end_with?(dependency.name)
+        end
+        return unless source_url
+
+        Source.from_url(source_url)
+      end
+
+      # Note: This response MUST NOT be unmarshalled
+      # (as calling Marshal.load is unsafe)
+      def rubygems_marshalled_gemspec_response
+        if defined?(@rubygems_marshalled_gemspec_response)
+          return @rubygems_marshalled_gemspec_response
+        end
+
+        gemspec_uri =
+          "#{registry_url}quick/Marshal.4.8/"\
+          "#{dependency.name}-#{dependency.version}.gemspec.rz"
+
+        response =
+          Excon.get(
+            gemspec_uri,
+            headers: registry_auth_headers,
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+        if response.status >= 400
+          return @rubygems_marshalled_gemspec_response = nil
+        end
+
+        @rubygems_marshalled_gemspec_response =
+          Zlib::Inflate.inflate(response.body)
+      rescue Zlib::DataError
+        @rubygems_marshalled_gemspec_response = nil
+      end
+
+      def rubygems_api_response
+        return @rubygems_api_response if defined?(@rubygems_api_response)
+
+        response =
+          Excon.get(
+            "#{registry_url}api/v1/gems/#{dependency.name}.json",
+            headers: registry_auth_headers,
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+        return @rubygems_api_response = {} if response.status >= 400
+
+        response_body = response.body
+        response_body = augment_private_response_if_appropriate(response_body)
+
+        @rubygems_api_response = JSON.parse(response_body)
+        append_slash_to_source_code_uri(@rubygems_api_response)
+      rescue JSON::ParserError, Excon::Error::Timeout
+        @rubygems_api_response = {}
+      end
+
+      def append_slash_to_source_code_uri(listing)
+        # We have to do this so that `Source.from_url(...)` doesn't prune the
+        # last line off of the directory.
+        return listing unless listing&.fetch("source_code_uri", nil)
+        return listing if listing.fetch("source_code_uri").end_with?("/")
+
+        listing["source_code_uri"] = listing["source_code_uri"] + "/"
+        listing
+      end
+
+      def augment_private_response_if_appropriate(response_body)
+        return response_body if new_source_type == "default"
+
+        parsed_body = JSON.parse(response_body)
+        return response_body if (SOURCE_KEYS - parsed_body.keys).none?
+
+        digest = parsed_body.values_at("version", "authors", "info").hash
+
+        source_url = parsed_body.
+                     values_at(*SOURCE_KEYS).
+                     compact.
+                     find { |url| Source.from_url(url) }
+        return response_body if source_url
+
+        rubygems_response =
+          Excon.get(
+            "https://rubygems.org/api/v1/gems/#{dependency.name}.json",
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+        parsed_rubygems_body = JSON.parse(rubygems_response.body)
+        rubygems_digest =
+          parsed_rubygems_body.values_at("version", "authors", "info").hash
+
+        digest == rubygems_digest ? rubygems_response.body : response_body
+      rescue JSON::ParserError, Excon::Error::Socket, Excon::Error::Timeout
+        response_body
+      end
+
+      def registry_url
+        return "https://rubygems.org/" if new_source_type == "default"
+
+        info = dependency.requirements.map { |r| r[:source] }.compact.first
+        info[:url] || info.fetch("url")
+      end
+
+      def registry_auth_headers
+        return {} unless new_source_type == "rubygems"
+
+        token =
+          credentials.
+          select { |cred| cred["type"] == "rubygems_server" }.
+          find { |cred| registry_url.include?(cred["host"]) }&.
+          fetch("token")
+
+        return {} unless token
+
+        token += ":" unless token.include?(":")
+        encoded_token = Base64.encode64(token).delete("\n")
+        { "Authorization" => "Basic #{encoded_token}" }
+      end
+    end
+  end
+end
+
+Dependabot::MetadataFinders.
+  register("bundler", Dependabot::Bundler::MetadataFinder)

data/lib/dependabot/bundler/requirement.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "dependabot/utils"
+
+module Dependabot
+  module Bundler
+    class Requirement < Gem::Requirement
+      # For consistency with other langauges, we define a requirements array.
+      # Ruby doesn't have an `OR` separator for requirements, so it always
+      # contains a single element.
+      def self.requirements_array(requirement_string)
+        [new(requirement_string)]
+      end
+
+      # Patches Gem::Requirement to make it accept requirement strings like
+      # "~> 4.2.5, >= 4.2.5.1" without first needing to split them.
+      def initialize(*requirements)
+        requirements = requirements.flatten.flat_map do |req_string|
+          req_string.split(",")
+        end
+
+        super(requirements)
+      end
+    end
+  end
+end
+
+Dependabot::Utils.
+  register_requirement_class("bundler", Dependabot::Bundler::Requirement)