dependabot-common 0.128.0 → 0.129.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4ac759f834287050eb32bc586ab8d414010e64283ff9f1f7be6b9dc481969ec3
-  data.tar.gz: 38dc8a8d6e321e1f2c6ba817e1da7aeb656508560f795d5c2efbc7d900d93ae8
+  metadata.gz: c7174415aef0e15737217d314a45c2630aacae829ef4e513534ad6f4a4a20e0e
+  data.tar.gz: 0f995c8ec75f07917de8829386a070a2d1ac3dab21162299b2b0cb3fa83190b7
 SHA512:
-  metadata.gz: b4d47dbe5867a869681d19779cbcea2fcf10cba21be3d9d0fb482821b1f8a375e95b04f4027a526c7cf527d74a109ae34e275ab63efabfb630463ef453da70bd
-  data.tar.gz: 8d6d58686a1a1d70a61f61f4f1744c3946886121bceea01b9a6169cee9777c63098dff78d10e9132c1ec3789baa0871342cec291c2bec9cb01c5bfca25765f37
+  metadata.gz: 41418972531aedf8379e330be0fc3439ecf7ec7f9d247740be77f9dd2d4a7d6da7c63769fd615bcd378f4e13075a41fab52069557e7cd6f6227ed05058f33f2e
+  data.tar.gz: 81b2df6efb3465fd42563ea28fa728a170d0bac9b68f7bd0cf13cfe4783d04dbab2bed462e59f7c3cd0fbc4114fc085b57f43bf2fcaf32e66669d1f0a599708b

data/lib/dependabot/clients/azure.rb

@@ -8,6 +8,14 @@ module Dependabot
     class Azure
       class NotFound < StandardError; end
 
+      class InternalServerError < StandardError; end
+
+      class ServiceNotAvailable < StandardError; end
+
+      class BadGateway < StandardError; end
+
+      RETRYABLE_ERRORS = [InternalServerError, BadGateway, ServiceNotAvailable].freeze
+
       MAX_PR_DESCRIPTION_LENGTH = 3999
 
       #######################
@@ -27,10 +35,11 @@ module Dependabot
       # Client #
       ##########
 
-      def initialize(source, credentials)
+      def initialize(source, credentials, max_retries: 3)
         @source = source
         @credentials = credentials
         @auth_header = auth_header_for(credentials&.fetch("token", nil))
+        @max_retries = max_retries || 3
       end
 
       def fetch_commit(_repo, branch)
@@ -175,15 +184,24 @@ module Dependabot
       # rubocop:enable Metrics/ParameterLists
 
       def get(url)
-        response = Excon.get(
-          url,
-          user: credentials&.fetch("username", nil),
-          password: credentials&.fetch("password", nil),
-          idempotent: true,
-          **SharedHelpers.excon_defaults(
-            headers: auth_header
+        response = nil
+
+        retry_connection_failures do
+          response = Excon.get(
+            url,
+            user: credentials&.fetch("username", nil),
+            password: credentials&.fetch("password", nil),
+            idempotent: true,
+            **SharedHelpers.excon_defaults(
+              headers: auth_header
+            )
           )
-        )
+
+          raise InternalServerError if response.status == 500
+          raise BadGateway if response.status == 502
+          raise ServiceNotAvailable if response.status == 503
+        end
+
         raise NotFound if response.status == 404
 
         response
@@ -211,6 +229,17 @@ module Dependabot
 
       private
 
+      def retry_connection_failures
+        retry_attempt = 0
+
+        begin
+          yield
+        rescue *RETRYABLE_ERRORS
+          retry_attempt += 1
+          retry_attempt <= @max_retries ? retry : raise
+        end
+      end
+
       def auth_header_for(token)
         return {} unless token
 

data/lib/dependabot/clients/bitbucket.rb

@@ -18,6 +18,7 @@ module Dependabot
 
       def initialize(credentials:)
         @credentials = credentials
+        @auth_header = auth_header_for(credentials&.fetch("token", nil))
       end
 
       def fetch_commit(repo, branch)
@@ -72,7 +73,9 @@ module Dependabot
           user: credentials&.fetch("username", nil),
           password: credentials&.fetch("password", nil),
           idempotent: true,
-          **Dependabot::SharedHelpers.excon_defaults
+          **Dependabot::SharedHelpers.excon_defaults(
+            headers: auth_header
+          )
         )
         raise Unauthorized if response.status == 401
         raise Forbidden if response.status == 403
@@ -89,6 +92,13 @@ module Dependabot
 
       private
 
+      def auth_header_for(token)
+        return {} unless token
+
+        { "Authorization" => "Bearer #{token}" }
+      end
+
+      attr_reader :auth_header
       attr_reader :credentials
 
       def base_url

data/lib/dependabot/errors.rb

@@ -1,24 +1,45 @@
 # frozen_string_literal: true
 
-require "dependabot/shared_helpers"
+require "dependabot/utils"
 
 module Dependabot
   class DependabotError < StandardError
-    def initialize(msg = nil)
-      msg = sanitize_message(msg)
-      super(msg)
+    BASIC_AUTH_REGEX = %r{://(?<auth>[^:]*:[^@%\s]+(@|%40))}.freeze
+    # Remove any path segment from fury.io sources
+    FURY_IO_PATH_REGEX = %r{fury\.io/(?<path>.+)}.freeze
+
+    def initialize(message = nil)
+      super(sanitize_message(message))
     end
 
     private
 
     def sanitize_message(message)
-      return unless message
+      return message unless message.is_a?(String)
 
       path_regex =
-        Regexp.escape(SharedHelpers::BUMP_TMP_DIR_PATH) + "\/" +
-        Regexp.escape(SharedHelpers::BUMP_TMP_FILE_PREFIX) + "[^/]*"
+        Regexp.escape(Utils::BUMP_TMP_DIR_PATH) + "\/" +
+        Regexp.escape(Utils::BUMP_TMP_FILE_PREFIX) + "[a-zA-Z0-9-]*"
+
+      message = message.gsub(/#{path_regex}/, "dependabot_tmp_dir").strip
+      filter_sensitive_data(message)
+    end
+
+    def filter_sensitive_data(message)
+      replace_capture_groups(message, BASIC_AUTH_REGEX, "")
+    end
+
+    def sanitize_source(source)
+      source = filter_sensitive_data(source)
+      replace_capture_groups(source, FURY_IO_PATH_REGEX, "<redacted>")
+    end
+
+    def replace_capture_groups(string, regex, replacement)
+      return string unless string.is_a?(String)
 
-      message.gsub(/#{path_regex}/, "dependabot_tmp_dir")
+      string.scan(regex).flatten.compact.reduce(string) do |original_msg, match|
+        original_msg.gsub(match, replacement)
+      end
     end
   end
 
@@ -35,7 +56,6 @@ module Dependabot
 
     def initialize(branch_name, msg = nil)
       @branch_name = branch_name
-      msg = sanitize_message(msg)
       super(msg)
     end
   end
@@ -101,10 +121,10 @@ module Dependabot
     attr_reader :source
 
     def initialize(source)
-      @source = source.gsub(%r{(?<=\.fury\.io)/[A-Za-z0-9]{20}(?=/)}, "")
+      @source = sanitize_source(source)
       msg = "The following source could not be reached as it requires "\
             "authentication (and any provided details were invalid or lacked "\
-            "the required permissions): #{source}"
+            "the required permissions): #{@source}"
       super(msg)
     end
   end
@@ -113,8 +133,8 @@ module Dependabot
     attr_reader :source
 
     def initialize(source)
-      @source = source.gsub(%r{(?<=\.fury\.io)/[A-Za-z0-9]{20}(?=/)}, "")
-      super("The following source timed out: #{source}")
+      @source = sanitize_source(source)
+      super("The following source timed out: #{@source}")
     end
   end
 
@@ -122,8 +142,8 @@ module Dependabot
     attr_reader :source
 
     def initialize(source)
-      @source = source.gsub(%r{(?<=\.fury\.io)/[A-Za-z0-9]{20}(?=/)}, "")
-      super("Could not verify the SSL certificate for #{source}")
+      @source = sanitize_source(source)
+      super("Could not verify the SSL certificate for #{@source}")
     end
   end
 
@@ -132,7 +152,7 @@ module Dependabot
 
     def initialize(environment_variable)
       @environment_variable = environment_variable
-      super("Missing environment variable #{environment_variable}")
+      super("Missing environment variable #{@environment_variable}")
     end
   end
 
@@ -149,10 +169,10 @@ module Dependabot
 
     def initialize(*dependency_urls)
       @dependency_urls =
-        dependency_urls.flatten.map { |uri| uri.gsub(/x-access-token.*?@/, "") }
+        dependency_urls.flatten.map { |uri| filter_sensitive_data(uri) }
 
       msg = "The following git URLs could not be retrieved: "\
-            "#{dependency_urls.join(', ')}"
+            "#{@dependency_urls.join(', ')}"
       super(msg)
     end
   end
@@ -163,7 +183,7 @@ module Dependabot
     def initialize(dependency)
       @dependency = dependency
 
-      msg = "The branch or reference specified for #{dependency} could not "\
+      msg = "The branch or reference specified for #{@dependency} could not "\
             "be retrieved"
       super(msg)
     end
@@ -175,7 +195,7 @@ module Dependabot
     def initialize(*dependencies)
       @dependencies = dependencies.flatten
       msg = "The following path based dependencies could not be retrieved: "\
-            "#{dependencies.join(', ')}"
+            "#{@dependencies.join(', ')}"
       super(msg)
     end
   end
@@ -188,8 +208,8 @@ module Dependabot
       @declared_path = declared_path
       @discovered_path = discovered_path
 
-      msg = "The module path '#{declared_path}' found in #{go_mod} doesn't "\
-            "match the actual path '#{discovered_path}' in the dependency's "\
+      msg = "The module path '#{@declared_path}' found in #{@go_mod} doesn't "\
+            "match the actual path '#{@discovered_path}' in the dependency's "\
             "go.mod"
       super(msg)
     end

data/lib/dependabot/shared_helpers.rb

@@ -8,12 +8,12 @@ require "digest"
 require "open3"
 require "shellwords"
 
+require "dependabot/utils"
+require "dependabot/errors"
 require "dependabot/version"
 
 module Dependabot
   module SharedHelpers
-    BUMP_TMP_FILE_PREFIX = "dependabot_"
-    BUMP_TMP_DIR_PATH = "tmp"
     GIT_CONFIG_GLOBAL_PATH = File.expand_path("~/.gitconfig")
     USER_AGENT = "dependabot-core/#{Dependabot::VERSION} "\
                  "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} "\
@@ -21,21 +21,6 @@ module Dependabot
                  "(+https://github.com/dependabot/dependabot-core)"
     SIGKILL = 9
 
-    class ChildProcessFailed < StandardError
-      attr_reader :error_class, :error_message, :error_backtrace
-
-      def initialize(error_class:, error_message:, error_backtrace:)
-        @error_class = error_class
-        @error_message = error_message
-        @error_backtrace = error_backtrace
-
-        msg = "Child process raised #{error_class} with message: "\
-              "#{error_message}"
-        super(msg)
-        set_backtrace(error_backtrace)
-      end
-    end
-
     def self.in_a_temporary_repo_directory(directory = "/",
                                            repo_contents_path = nil,
                                            &block)
@@ -53,15 +38,15 @@ module Dependabot
     end
 
     def self.in_a_temporary_directory(directory = "/")
-      Dir.mkdir(BUMP_TMP_DIR_PATH) unless Dir.exist?(BUMP_TMP_DIR_PATH)
-      Dir.mktmpdir(BUMP_TMP_FILE_PREFIX, BUMP_TMP_DIR_PATH) do |dir|
+      Dir.mkdir(Utils::BUMP_TMP_DIR_PATH) unless Dir.exist?(Utils::BUMP_TMP_DIR_PATH)
+      Dir.mktmpdir(Utils::BUMP_TMP_FILE_PREFIX, Utils::BUMP_TMP_DIR_PATH) do |dir|
         path = Pathname.new(File.join(dir, directory)).expand_path
         FileUtils.mkpath(path)
         Dir.chdir(path) { yield(path) }
       end
     end
 
-    class HelperSubprocessFailed < StandardError
+    class HelperSubprocessFailed < Dependabot::DependabotError
       attr_reader :error_class, :error_context, :trace
 
       def initialize(message:, error_context:, error_class: nil, trace: nil)

data/lib/dependabot/utils.rb

@@ -4,6 +4,9 @@
 #       dependabot-core.
 module Dependabot
   module Utils
+    BUMP_TMP_FILE_PREFIX = "dependabot_"
+    BUMP_TMP_DIR_PATH = "tmp"
+
     @version_classes = {}
 
     def self.version_class_for_package_manager(package_manager)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.128.0"
+  VERSION = "0.129.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.128.0
+  version: 0.129.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-12-14 00:00:00.000000000 Z
+date: 2021-01-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit
@@ -292,28 +292,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.6.0
+        version: 1.7.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.6.0
+        version: 1.7.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.0
+        version: 0.21.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.20.0
+        version: 0.21.0
 - !ruby/object:Gem::Dependency
   name: simplecov-console
   requirement: !ruby/object:Gem::Requirement