dependabot-common 0.113.8 → 0.113.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e237dcfe1f60fe9dc9e264f5119d916c6498bf11180ab832067f8f50e40053c4
-  data.tar.gz: 739ba909c900ebc9635ff04f312237e6c3e3f9a66e651da9194c66df83bda86e
+  metadata.gz: d7dc4bc4e7243b5783878592692ff326a7d2f80f6d4c6f97d51234353fd5d8f8
+  data.tar.gz: '0274587f10ad8b81fa768804d5300177b3b7919e67235142ac4a8e9cf07a885e'
 SHA512:
-  metadata.gz: a2e013639daedfa94637e55ad67e54c6e1be464ea6e2bc4074831cc939e311ed71c8b8aa86502770f0762d311b2fdefb9618b5a59ab57e2e0113a7a6d0a5296d
-  data.tar.gz: 51ba82962b4df0eeb9700c80763d791315ceb4f09fcaed69cc5d4d7921a6564ffef716fd2dc01fc69d177c15bd956516f766d1f6ee77a22d802323dc1b8a4859
+  metadata.gz: 5e23b2228c629a3b23acf1dd4ebf278201f7dd8d4005b3f643099bb7f563389d67a27ce8130848ce881cb8cb5d2e4c5306439157fca2567e3bd25853c204c1f6
+  data.tar.gz: 4ecf0ef7609d7cd88a0481f373cdbad1d98adec373e922a16556a738d4a4ed912c479da0fa484cb6e806738cbfc934b4aa21a166f8b1754beae9cf2caf0c11f4

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "strscan"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -12,18 +13,9 @@ module Dependabot
           github\.com/(?<repo>#{GITHUB_USERNAME}/[^/\s]+)/
           (?:issue|pull)s?/(?<number>\d+)
         }x.freeze
-
-        # Note that we're being deliberately careful about not matching
-        # different length strings of what look like code block quotes. By
-        # doing so we err on the side of sanitizing, which is *much* better
-        # than accidentally not sanitizing.
-        #
-        # rubocop:disable Style/RegexpLiteral
-        CODEBLOCK_REGEX = %r{
-          (?=[\s]`{3}[^`])|(?=[\s]`{3}\Z)|(?=\A`{3}[^`])|
-          (?=[\s]~{3}[^~])|(?=[\s]~{3}\Z)|(?=\A~{3}[^~])
-        }x.freeze
-        # rubocop:enable Style/RegexpLiteral
+        CODEBLOCK_REGEX = /(`+).*?(\1)|~~~.*?~~~/m.freeze
+        # End of string
+        EOS_REGEX = /\z/.freeze
 
         attr_reader :github_redirection_service
 
@@ -33,22 +25,35 @@ module Dependabot
 
         def sanitize_links_and_mentions(text:)
           # We don't want to sanitize any links or mentions that are contained
-          # within code blocks, so we split the text on "```"
-          snippets = text.split(CODEBLOCK_REGEX)
-          if snippets.first&.start_with?(CODEBLOCK_REGEX)
-            snippets = ["", *snippets]
+          # within code blocks, so we split the text on "```" or "~~~"
+          sanitized_text = []
+          scan = StringScanner.new(text)
+          until scan.eos?
+            block = scan.scan_until(CODEBLOCK_REGEX) ||
+                    scan.scan_until(EOS_REGEX)
+            sanitized_text << sanitize_links_and_mentions_in_block(block)
           end
-
-          snippets.map.with_index do |snippet, index|
-            next snippet if index.odd?
-
-            snippet = sanitize_mentions(snippet)
-            sanitize_links(snippet)
-          end.join
+          sanitized_text.join
         end
 
         private
 
+        def sanitize_links_and_mentions_in_block(block)
+          # Handle code blocks one by one
+          normal_text = block
+          verbatim_text = ""
+          match = block.match(CODEBLOCK_REGEX)
+          if match
+            # Part leading up to start of code block
+            normal_text = match.pre_match
+            # Entire code block copied verbatim
+            verbatim_text = match.to_s
+          end
+          normal_text = sanitize_mentions(normal_text)
+          normal_text = sanitize_links(normal_text)
+          normal_text + verbatim_text
+        end
+
         def sanitize_mentions(text)
           text.gsub(%r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}) do |mention|
             next mention if mention.end_with?("/")

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.113.8"
+  VERSION = "0.113.13"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.113.8
+  version: 0.113.13
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-02 00:00:00.000000000 Z
+date: 2019-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit