dependabot-bundler 0.97.11 → 0.98.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7fbdda14506f6f4a0d4592dbaf2610e471c472d357d56bc468683bbb627aff01
-  data.tar.gz: 1cab003f87150ab9761de0d8347c1fb99dd32e51dbba6abf211dca538a8e1c29
+  metadata.gz: 026ac6b83480fb678b304b964df0d1df48e48d6e5ed410e5a218313d3aba4e9f
+  data.tar.gz: 10f30e2b1563c8fc9de2324b1621c3029b919170f2ba7d9ca67ec8a60a2eb55c
 SHA512:
-  metadata.gz: 6a88153fd1b4828a4e8f971485030dfe5a17557708b584ef3768a0d25abe36c5da911c21fe20957441b578e1fcd578e564adbe191a5587c0cc8f2ad110aa22ba
-  data.tar.gz: 3c587400d797b2813f5012c9607e683b4102ee0301419cc7dd11a3d0770e1e9f59e6da56e30aa7ed2a16b3eb4ecd03b3af09e0bb72aef7952718cf77c54b908e
+  metadata.gz: 88c48dadf3d4c391e994c717dd6fcf5b3522e7048e2297f9cc5cc42e30af270dd054b955000c8da0bdd741b9cc05c6e438ef08809e78f85b2cd005c37ce8aea3
+  data.tar.gz: 16c4ba9b1119c1134ccedf64b1b24eb6b2ff5d5bc774ba0e17bdc99c378cb1cac5b5107632fc059936e604e144dee0fbc66fddad011dca4d97eacc22f8abb10a

data/lib/dependabot/bundler/file_fetcher/child_gemfile_finder.rb

@@ -26,23 +26,20 @@ module Dependabot
 
         attr_reader :gemfile
 
-        # rubocop:disable Security/Eval
         def find_child_gemfile_paths(node)
           return [] unless node.is_a?(Parser::AST::Node)
 
           if declares_eval_gemfile?(node)
-            # We use eval here, but we know what we're doing. The FileFetchers
-            # helper method should only ever be run in an isolated environment
-            source = node.children[2].loc.expression.source
-            begin
-              path = eval(source)
-            rescue StandardError
-              return []
-            end
-            if Pathname.new(path).absolute?
-              base_path = Pathname.new(File.expand_path(Dir.pwd))
-              path = Pathname.new(path).relative_path_from(base_path).to_s
+            path_node = node.children[2]
+            unless path_node.type == :str
+              path = gemfile.path
+              msg = "Dependabot only supports uninterpolated string arguments "\
+                    "to eval_gemfile. Got "\
+                    "`#{path_node.loc.expression.source}`"
+              raise Dependabot::DependencyFileNotParseable.new(path, msg)
             end
+
+            path = path_node.loc.expression.source.gsub(/['"]/, "")
             path = File.join(current_dir, path) unless current_dir.nil?
             return [Pathname.new(path).cleanpath.to_path]
           end
@@ -51,7 +48,6 @@ module Dependabot
             find_child_gemfile_paths(child_node)
           end
         end
-        # rubocop:enable Security/Eval
 
         def current_dir
           @current_dir ||= gemfile.name.rpartition("/").first

data/lib/dependabot/bundler/file_fetcher/gemspec_finder.rb

@@ -26,7 +26,6 @@ module Dependabot
 
         attr_reader :gemfile
 
-        # rubocop:disable Security/Eval
         def find_gemspec_paths(node)
           return [] unless node.is_a?(Parser::AST::Node)
 
@@ -34,14 +33,15 @@ module Dependabot
             path_node = path_node_for_gem_declaration(node)
             return [clean_path(".")] unless path_node
 
-            begin
-              # We use eval here, but we know what we're doing. The
-              # FileFetchers helper method should only ever be run in an
-              # isolated environment
-              path = eval(path_node.loc.expression.source)
-            rescue StandardError
-              return []
+            unless path_node.type == :str
+              path = gemfile.path
+              msg = "Dependabot only supports uninterpolated string arguments "\
+                    "to gemspec. Got "\
+                    "`#{path_node.loc.expression.source}`"
+              raise Dependabot::DependencyFileNotParseable.new(path, msg)
             end
+
+            path = path_node.loc.expression.source.gsub(/['"]/, "")
             return [clean_path(path)]
           end
 
@@ -49,7 +49,6 @@ module Dependabot
             find_gemspec_paths(child_node)
           end
         end
-        # rubocop:enable Security/Eval
 
         def current_dir
           @current_dir ||= gemfile.name.rpartition("/").first

data/lib/dependabot/bundler/file_fetcher/path_gemspec_finder.rb

@@ -26,29 +26,28 @@ module Dependabot
 
         attr_reader :gemfile
 
-        # rubocop:disable Security/Eval
         def find_path_gemspec_paths(node)
           return [] unless node.is_a?(Parser::AST::Node)
 
           if declares_path_dependency?(node)
             path_node = path_node_for_gem_declaration(node)
 
-            begin
-              # We use eval here, but we know what we're doing. The
-              # FileFetchers helper method should only ever be run in an
-              # isolated environment
-              path = eval(path_node.loc.expression.source)
-            rescue StandardError
-              return []
+            unless path_node.type == :str
+              path = gemfile.path
+              msg = "Dependabot only supports uninterpolated string arguments "\
+                    "for path dependencies. Got "\
+                    "`#{path_node.loc.expression.source}`"
+              raise Dependabot::DependencyFileNotParseable.new(path, msg)
             end
+
+            path = path_node.loc.expression.source.gsub(/['"]/, "")
             return [clean_path(path)]
           end
 
-          relevant_child_nodes(node).flat_map do |child_node|
+          node.children.flat_map do |child_node|
             find_path_gemspec_paths(child_node)
           end
         end
-        # rubocop:enable Security/Eval
 
         def current_dir
           @current_dir ||= gemfile.name.rpartition("/").first
@@ -72,23 +71,6 @@ module Dependabot
           Pathname.new(path).cleanpath
         end
 
-        # rubocop:disable Security/Eval
-        def relevant_child_nodes(node)
-          return [] unless node.is_a?(Parser::AST::Node)
-          return node.children unless node.type == :if
-
-          begin
-            if eval(node.children.first.loc.expression.source)
-              [node.children[1]]
-            else
-              [node.children[2]]
-            end
-          rescue StandardError
-            return node.children
-          end
-        end
-        # rubocop:enable Security/Eval
-
         def path_node_for_gem_declaration(node)
           return unless node.children.last.type == :hash
 

data/lib/dependabot/bundler/file_fetcher/require_relative_finder.rb

@@ -26,20 +26,13 @@ module Dependabot
 
         attr_reader :file
 
-        # rubocop:disable Security/Eval
         def find_require_relative_paths(node)
           return [] unless node.is_a?(Parser::AST::Node)
 
           if declares_require_relative?(node)
-            # We use eval here, but we know what we're doing. The FileFetchers
-            # helper method should only ever be run in an isolated environment
-            source = node.children[2].loc.expression.source
-            begin
-              path = eval(source)
-            rescue StandardError
-              return []
-            end
+            return [] unless node.children[2].type == :str
 
+            path = node.children[2].loc.expression.source.gsub(/['"]/, "")
             path = File.join(current_dir, path) unless current_dir.nil?
             return [Pathname.new(path + ".rb").cleanpath.to_path]
           end
@@ -48,7 +41,6 @@ module Dependabot
             find_require_relative_paths(child_node)
           end
         end
-        # rubocop:enable Security/Eval
 
         def current_dir
           @current_dir ||= file.name.rpartition("/").first

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-bundler
 version: !ruby/object:Gem::Version
-  version: 0.97.11
+  version: 0.98.0
 platform: ruby
 authors:
 - Dependabot
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.97.11
+        version: 0.98.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.97.11
+        version: 0.98.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement