dependabot-common 0.113.5 → 0.113.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95e256e79a2e6e9c69478b3376219b4a6b27e4a2ec1671f2691832f442a9c242
-  data.tar.gz: 0c96f62c27f3b417f43535eaf171bffe84d1e1572a26ba839c314e0803239b94
+  metadata.gz: d600a59386c6492eb9411615427693b6b15278a0a03ada2c0858cdb9492ba4a2
+  data.tar.gz: ab5c208f0e2c706d2a19c33a2950b409f8fbb843bc54725c22a22be909b10700
 SHA512:
-  metadata.gz: 15ba9bcb6be0042e8f9054b79a27aa14abd64d0c36f0c449d3c1e46c5d46bbfea6908e668232c61bf9939a0a3e4102bef597d4b94a5f2c63b1bd70ef881b874e
-  data.tar.gz: e575e120631013b83ba68eeca53a86ff9d44f7758a9c924b8d517993579c4ff6c59cbb2913026b17cc03de07ed068003c16148d37eed392420ab269b4446f2da
+  metadata.gz: 866c909e0f9217a229230b42de9012cb3e8f4bc12cca87aba57fe5c91412086065ae4fdc0bcb85494eb3292d4148661cebbf5ef7f1677c652b445ff2fdd97dd6
+  data.tar.gz: b0903cb5206f5eca16250d4b3d6a18cee962ba2487b2dbd640176a48320150f86435686d111ad332692ba448a67532fb2031df872bdeb43f8c457f551fc67f2b

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "strscan"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -12,18 +13,9 @@ module Dependabot
           github\.com/(?<repo>#{GITHUB_USERNAME}/[^/\s]+)/
           (?:issue|pull)s?/(?<number>\d+)
         }x.freeze
-
-        # Note that we're being deliberately careful about not matching
-        # different length strings of what look like code block quotes. By
-        # doing so we err on the side of sanitizing, which is *much* better
-        # than accidentally not sanitizing.
-        #
-        # rubocop:disable Style/RegexpLiteral
-        CODEBLOCK_REGEX = %r{
-          (?=[\s]`{3}[^`])|(?=[\s]`{3}\Z)|(?=\A`{3}[^`])|
-          (?=[\s]~{3}[^~])|(?=[\s]~{3}\Z)|(?=\A~{3}[^~])
-        }x.freeze
-        # rubocop:enable Style/RegexpLiteral
+        CODEBLOCK_REGEX = /```|~~~/.freeze
+        # End of string
+        EOS_REGEX = /\z/.freeze
 
         attr_reader :github_redirection_service
 
@@ -33,18 +25,20 @@ module Dependabot
 
         def sanitize_links_and_mentions(text:)
           # We don't want to sanitize any links or mentions that are contained
-          # within code blocks, so we split the text on "```"
-          snippets = text.split(CODEBLOCK_REGEX)
-          if snippets.first&.start_with?(CODEBLOCK_REGEX)
-            snippets = ["", *snippets]
+          # within code blocks, so we split the text on "```" or "~~~"
+          lines = []
+          scan = StringScanner.new(text)
+          until scan.eos?
+            line = scan.scan_until(CODEBLOCK_REGEX) ||
+                   scan.scan_until(EOS_REGEX)
+            delimiter = line.match(CODEBLOCK_REGEX)&.to_s
+            unless delimiter && lines.count { |l| l.include?(delimiter) }.odd?
+              line = sanitize_mentions(line)
+              line = sanitize_links(line)
+            end
+            lines << line
           end
-
-          snippets.map.with_index do |snippet, index|
-            next snippet if index.odd?
-
-            snippet = sanitize_mentions(snippet)
-            sanitize_links(snippet)
-          end.join
+          lines.join
         end
 
         private

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.113.5"
+  VERSION = "0.113.10"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.113.5
+  version: 0.113.10
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-09-30 00:00:00.000000000 Z
+date: 2019-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -230,14 +230,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12'
+        version: '13'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12'
+        version: '13'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -286,14 +286,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.74.0
+        version: 0.75.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.74.0
+        version: 0.75.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement