dependabot-common 0.107.47 → 0.107.48

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec10a3321e4a5d285628170c84a3f5bcd9dc25d5033e8d599ef0ea7f6fd893a8
-  data.tar.gz: dd0a4733f9706cc750d93b522f4af86b6ee194d75d5a72bb8c790239254bb744
+  metadata.gz: 54c9c985c6d3b8e7d52eef7ca828a527eed5e8e61e1cc6c6d1d53a6cae193fe2
+  data.tar.gz: 54f9b314a4890e35bc75d1e6dcef46f9fbab99ec20be22fbf0948981eb9e9efc
 SHA512:
-  metadata.gz: 21a068f8e63525920f05a77fead0d100f20aa0c76365e33b26dcd684240b57dee1dc2bdf353fdf2de37bbd1cd3962cb9a14179f9acdaf65f8df8260c0349cd87
-  data.tar.gz: 2f9ff82d0d8eafafc5e522864edf6b57ccedd2827437606777cfbfc1acb472954fc1b828fc4c6e99451064cdd9859e1319659f1505e5d5283d71654b03c60765
+  metadata.gz: 7494d793513c280fa792209948ab4cc32e6e95460b1198fe13c5c24a31640069a7f26ccf0753d0bf1bc63fe480c9fcf60ce85a69f948daabaaca9e4e19d0bf53
+  data.tar.gz: fd8a90f63b6fadc2e1efd0d43069fd5d8685da655261db17d8b95f9270a56eb7c72d7b4f4e5e57acb41cd80970208285ef1899c66c9708f1024053b7ca3fa3a5

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "dependabot/pull_request_creator/message_builder"
+
+module Dependabot
+  class PullRequestCreator
+    class MessageBuilder
+      class LinkAndMentionSanitizer
+        GITHUB_REF_REGEX = %r{
+          (?:https?://)?
+          github\.com/[^/\s]+/[^/\s]+/
+          (?:issue|pull)s?/(?<number>\d+)
+        }x.freeze
+
+        # Note that we're being deliberately careful about not matching
+        # different length strings of what look like code block quotes. By
+        # doing so we err on the side of sanitizing, which is *much* better
+        # than accidentally not sanitizing.
+        #
+        # rubocop:disable Style/RegexpLiteral
+        CODEBLOCK_REGEX = %r{
+          (?=[\s]`{3}[^`])|(?=[\s]`{3}\Z)|(?=\A`{3}[^`])|
+          (?=[\s]~{3}[^~])|(?=[\s]~{3}\Z)|(?=\A~{3}[^~])
+        }x.freeze
+        # rubocop:enable Style/RegexpLiteral
+
+        attr_reader :github_redirection_service
+
+        def initialize(github_redirection_service:)
+          @github_redirection_service = github_redirection_service
+        end
+
+        def sanitize_links_and_mentions(text:)
+          # We don't want to sanitize any links or mentions that are contained
+          # within code blocks, so we split the text on "```"
+          snippets = text.split(CODEBLOCK_REGEX)
+          if snippets.first&.start_with?(CODEBLOCK_REGEX)
+            snippets = ["", *snippets]
+          end
+
+          snippets.map.with_index do |snippet, index|
+            next snippet if index.odd?
+
+            snippet = sanitize_mentions(snippet)
+            sanitize_links(snippet)
+          end.join
+        end
+
+        private
+
+        def sanitize_mentions(text)
+          text.gsub(%r{(?<![A-Za-z0-9`~])@[\w][\w.-/]*}) do |mention|
+            next mention if mention.include?("/")
+
+            last_match = Regexp.last_match
+
+            sanitized_mention = mention.gsub("@", "@&#8203;")
+            if last_match.pre_match.chars.last == "[" &&
+               last_match.post_match.chars.first == "]"
+              sanitized_mention
+            else
+              "[#{sanitized_mention}]"\
+              "(https://github.com/#{mention.tr('@', '')})"
+            end
+          end
+        end
+
+        def sanitize_links(text)
+          text.gsub(GITHUB_REF_REGEX) do |ref|
+            last_match = Regexp.last_match
+            previous_char = last_match.pre_match.chars.last
+            next_char = last_match.post_match.chars.first
+
+            sanitized_url =
+              ref.gsub("github.com", github_redirection_service || "github.com")
+            if (previous_char.nil? || previous_char.match?(/\s/)) &&
+               (next_char.nil? || next_char.match?(/\s/))
+              "[##{last_match.named_captures.fetch('number')}]"\
+              "(#{sanitized_url})"
+            else
+              sanitized_url
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/pull_request_creator/message_builder.rb

@@ -11,6 +11,7 @@ module Dependabot
   class PullRequestCreator
     class MessageBuilder
       require_relative "message_builder/issue_linker"
+      require_relative "message_builder/link_and_mention_sanitizer"
 
       ANGULAR_PREFIXES = %w(build chore ci docs feat fix perf refactor style
                             test).freeze
@@ -29,11 +30,6 @@ module Dependabot
                             see_no_evil sparkles speech_balloon tada truck
                             twisted_rightwards_arrows whale wheelchair
                             white_check_mark wrench zap).freeze
-      GITHUB_REF_REGEX = %r{
-        (?:https?://)?
-        github\.com/[^/\s]+/[^/\s]+/
-        (?:issue|pull)s?/(?<number>\d+)
-      }x.freeze
 
       attr_reader :source, :dependencies, :files, :credentials,
                   :pr_message_footer, :author_details, :vulnerabilities_fixed,
@@ -716,41 +712,9 @@ module Dependabot
       end
 
       def sanitize_links_and_mentions(text)
-        text = sanitize_mentions(text)
-        sanitize_links(text)
-      end
-
-      def sanitize_mentions(text)
-        text.gsub(%r{(?<![A-Za-z0-9`])@[\w][\w.-/]*}) do |mention|
-          next mention if mention.include?("/")
-
-          last_match = Regexp.last_match
-
-          sanitized_mention = mention.gsub("@", "@&#8203;")
-          if last_match.pre_match.chars.last == "[" &&
-             last_match.post_match.chars.first == "]"
-            sanitized_mention
-          else
-            "[#{sanitized_mention}](https://github.com/#{mention.tr('@', '')})"
-          end
-        end
-      end
-
-      def sanitize_links(text)
-        text.gsub(GITHUB_REF_REGEX) do |ref|
-          last_match = Regexp.last_match
-          previous_char = last_match.pre_match.chars.last
-          next_char = last_match.post_match.chars.first
-
-          sanitized_url =
-            ref.gsub("github.com", github_redirection_service || "github.com")
-          if (previous_char.nil? || previous_char.match?(/\s/)) &&
-             (next_char.nil? || next_char.match?(/\s/))
-            "[##{last_match.named_captures.fetch('number')}](#{sanitized_url})"
-          else
-            sanitized_url
-          end
-        end
+        LinkAndMentionSanitizer.
+          new(github_redirection_service: github_redirection_service).
+          sanitize_links_and_mentions(text: text)
       end
 
       def sanitize_template_tags(text)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.107.47"
+  VERSION = "0.107.48"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.107.47
+  version: 0.107.48
 platform: ruby
 authors:
 - Dependabot
@@ -345,6 +345,7 @@ files:
 - lib/dependabot/pull_request_creator/labeler.rb
 - lib/dependabot/pull_request_creator/message_builder.rb
 - lib/dependabot/pull_request_creator/message_builder/issue_linker.rb
+- lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb
 - lib/dependabot/pull_request_updater.rb
 - lib/dependabot/pull_request_updater/github.rb
 - lib/dependabot/security_advisory.rb