dependabot-common 0.113.6 → 0.113.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 357d4ec95f23bfd1ba9bd76cd00a043b187d7094a73ad567f1d0b471110451cf
-  data.tar.gz: 52aad85593c1ce95951ac42e6cc9d3c098859ba18a5197fec2df611cc726bf2f
+  metadata.gz: 48912fb9054dc3409b1b3890324d5664883666841e73899c81f82fada8709598
+  data.tar.gz: 721c424e9b83f4fcac58772d09df61f8539df3594ba65094d04e3b4a9f2e4976
 SHA512:
-  metadata.gz: 383d7211d4938c43bf3edcd9a8f0782494ad4cca8a28d276dd5017c41b7ff1188393f5c032d9b259ddb891d3d4c9afd01b8cf556f7e1b5abf412d13451a19e83
-  data.tar.gz: 5d1bedccf30f94c65d44fd818f0911616b2142b68b064cfbb6302879199039353948ae6e77b6129bc0ed0e14324b52d49444b0696a580e92845a90326a290f19
+  metadata.gz: 5f604c14e2298705ca0714bd7a9c4097d9cfcebfff9200fcee4476f997897175339134a921f497b0d79730bab55a85246ffa51e02f2ffa988556bdaaa26418b2
+  data.tar.gz: ecc17f5c9ae5f4cea9e937c82468831d44c18d86bc90c4aef02ed846a27832dd636968ca9b79f32c2102fd1590b9d66db899993398ced48c07577d983dba0340

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "strscan"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -12,18 +13,9 @@ module Dependabot
           github\.com/(?<repo>#{GITHUB_USERNAME}/[^/\s]+)/
           (?:issue|pull)s?/(?<number>\d+)
         }x.freeze
-
-        # Note that we're being deliberately careful about not matching
-        # different length strings of what look like code block quotes. By
-        # doing so we err on the side of sanitizing, which is *much* better
-        # than accidentally not sanitizing.
-        #
-        # rubocop:disable Style/RegexpLiteral
-        CODEBLOCK_REGEX = %r{
-          (?=[\s]`{3}[^`])|(?=[\s]`{3}\Z)|(?=\A`{3}[^`])|
-          (?=[\s]~{3}[^~])|(?=[\s]~{3}\Z)|(?=\A~{3}[^~])
-        }x.freeze
-        # rubocop:enable Style/RegexpLiteral
+        CODEBLOCK_REGEX = /```|~~~/.freeze
+        # End of string
+        EOS_REGEX = /\z/.freeze
 
         attr_reader :github_redirection_service
 
@@ -33,18 +25,20 @@ module Dependabot
 
         def sanitize_links_and_mentions(text:)
           # We don't want to sanitize any links or mentions that are contained
-          # within code blocks, so we split the text on "```"
-          snippets = text.split(CODEBLOCK_REGEX)
-          if snippets.first&.start_with?(CODEBLOCK_REGEX)
-            snippets = ["", *snippets]
+          # within code blocks, so we split the text on "```" or "~~~"
+          lines = []
+          scan = StringScanner.new(text)
+          until scan.eos?
+            line = scan.scan_until(CODEBLOCK_REGEX) ||
+                   scan.scan_until(EOS_REGEX)
+            delimiter = line.match(CODEBLOCK_REGEX)&.to_s
+            unless delimiter && lines.count { |l| l.include?(delimiter) }.odd?
+              line = sanitize_mentions(line)
+              line = sanitize_links(line)
+            end
+            lines << line
           end
-
-          snippets.map.with_index do |snippet, index|
-            next snippet if index.odd?
-
-            snippet = sanitize_mentions(snippet)
-            sanitize_links(snippet)
-          end.join
+          lines.join
         end
 
         private

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.113.6"
+  VERSION = "0.113.11"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.113.6
+  version: 0.113.11
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-09-30 00:00:00.000000000 Z
+date: 2019-10-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -286,14 +286,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.74.0
+        version: 0.75.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.74.0
+        version: 0.75.0
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement