dependabot-common 0.391.0 → 0.393.0

data/lib/dependabot/pull_request_creator/labeler.rb

@@ -1,9 +1,10 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
 require "octokit"
 require "sorbet-runtime"
 require "dependabot/pull_request_creator"
+require "dependabot/errors"
 require "dependabot/credential"
 
 module Dependabot
@@ -313,16 +314,13 @@ module Dependabot
       def fetch_github_labels
         client = github_client_for_source
 
-        labels = T.let(
-          T.unsafe(client.labels(source.repo, per_page: 100)).map(&:name),
-          T::Array[String]
-        )
-
+        raw_labels = client.labels(source.repo, per_page: 100)
+        labels = github_label_names(raw_labels)
         next_link = T.let(client.last_response.rels[:next], T.nilable(Sawyer::Relation))
 
         while next_link
           next_page = T.let(next_link.get, Sawyer::Response)
-          labels += T.unsafe(next_page.data).map(&:name)
+          labels.concat(github_labels_from_page(next_page))
           next_link = next_page.rels[:next]
         end
 
@@ -331,12 +329,51 @@ module Dependabot
 
       sig { returns(T::Array[String]) }
       def fetch_gitlab_labels
-        T.unsafe(
-          gitlab_client_for_source
-                   .labels(source.repo, per_page: 100)
-                   .auto_paginate
+        gitlab_client_for_source
+          .labels(source.repo, per_page: 100)
+          .auto_paginate
+          .map { |label| gitlab_label_name(label) }
+      end
+
+      sig { params(label: Sawyer::Resource).returns(String) }
+      def github_label_name(label)
+        value = T.cast(label[:name], Object)
+        return value if value.is_a?(String)
+
+        raise_bad_label_response("GitHub", "name must be a string")
+      end
+
+      sig { params(response: Sawyer::Response).returns(T::Array[String]) }
+      def github_labels_from_page(response)
+        github_label_names(T.cast(response.data, Object))
+      end
+
+      sig { params(data: Object).returns(T::Array[String]) }
+      def github_label_names(data)
+        raise_bad_label_response("GitHub", "page data must be an array") unless data.is_a?(Array)
+
+        data.map do |raw_label|
+          label = T.cast(raw_label, Object)
+          raise_bad_label_response("GitHub", "label must be an object") unless label.is_a?(Sawyer::Resource)
+
+          github_label_name(label)
+        end
+      end
+
+      sig { params(label: ::Gitlab::ObjectifiedHash).returns(String) }
+      def gitlab_label_name(label)
+        value = T.cast(label["name"], Object)
+        return value if value.is_a?(String)
+
+        raise_bad_label_response("GitLab", "name must be a string")
+      end
+
+      sig { params(provider: String, message: String).returns(T.noreturn) }
+      def raise_bad_label_response(provider, message)
+        raise Dependabot::PrivateSourceBadResponse.new(
+          source.url,
+          "Malformed #{provider} label response: #{message}"
         )
-         .map(&:name)
       end
 
       sig { returns(T::Array[String]) }
@@ -394,7 +431,7 @@ module Dependabot
         )
         @labels = [*@labels, DEFAULT_DEPENDENCIES_LABEL].uniq
       rescue Octokit::UnprocessableEntity => e
-        raise unless e.errors.first.fetch(:code) == "already_exists"
+        raise unless github_label_already_exists?(e)
 
         @labels = [*@labels, DEFAULT_DEPENDENCIES_LABEL].uniq
       end
@@ -421,7 +458,7 @@ module Dependabot
         )
         @labels = [*@labels, DEFAULT_SECURITY_LABEL].uniq
       rescue Octokit::UnprocessableEntity => e
-        raise unless e.errors.first.fetch(:code) == "already_exists"
+        raise unless github_label_already_exists?(e)
 
         @labels = [*@labels, DEFAULT_SECURITY_LABEL].uniq
       end
@@ -450,11 +487,24 @@ module Dependabot
         )
         @labels = [*@labels, language_name].uniq
       rescue Octokit::UnprocessableEntity => e
-        raise unless e.errors.first.fetch(:code) == "already_exists"
+        raise unless github_label_already_exists?(e)
 
         @labels = [*@labels, language_name].uniq.compact
       end
 
+      sig { params(error: Octokit::UnprocessableEntity).returns(T::Boolean) }
+      def github_label_already_exists?(error)
+        errors = T.cast(error.errors, Object)
+        return false unless errors.is_a?(Array)
+
+        first_error = T.cast(errors.first, Object)
+        return false unless first_error.is_a?(Hash)
+
+        typed_error = T.let(first_error, T::Hash[T.any(Symbol, String), Object])
+        code = typed_error[:code] || typed_error["code"]
+        code == "already_exists"
+      end
+
       sig { params(language: String).returns(String) }
       def default_description_for(language)
         "Pull requests that update #{language.capitalize} code"

data/lib/dependabot/pull_request_creator/message_builder/issue_linker.rb

@@ -2,6 +2,7 @@
 # frozen_string_literal: true
 
 require "sorbet-runtime"
+require "uri"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -53,19 +54,37 @@ module Dependabot
                      &.fetch("repo", nil)
 
               source = if repo
-                         "https://github.com/#{repo}"
+                         "#{qualified_reference_base_url}/#{repo}"
                        elsif source_url
                          source_url
                        end
 
               if source
-                "[#{repo ? (repo + tag) : tag}](#{source}/issues/#{number})"
+                "[#{repo ? (repo + tag) : tag}](#{source}#{issue_path(source)}/#{number})"
               else
                 issue_link
               end
             end
           end
         end
+
+        private
+
+        sig { params(source: String).returns(String) }
+        def issue_path(source)
+          URI.parse(source).host&.downcase == "gitlab.com" ? "/-/work_items" : "/issues"
+        rescue URI::InvalidURIError
+          "/issues"
+        end
+
+        sig { returns(String) }
+        def qualified_reference_base_url
+          return "https://github.com" unless source_url
+
+          URI.parse(T.must(source_url)).host&.downcase == "gitlab.com" ? "https://gitlab.com" : "https://github.com"
+        rescue URI::InvalidURIError
+          "https://github.com"
+        end
       end
     end
   end

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -4,6 +4,7 @@
 require "commonmarker"
 require "sorbet-runtime"
 require "strscan"
+require "uri"
 require "dependabot/pull_request_creator/message_builder"
 
 module Dependabot
@@ -13,6 +14,9 @@ module Dependabot
         extend T::Sig
 
         GITHUB_USERNAME = /[a-z0-9]+(-[a-z0-9]+)*/i
+        GITLAB_USERNAME = /[a-z0-9](?:[a-z0-9_.-]*[a-z0-9_-])?/i
+        GITHUB_HOST = "github.com"
+        GITLAB_HOST = "gitlab.com"
         GITHUB_REF_REGEX = %r{
           (?:https?://)?
           github\.com/(?<repo>#{GITHUB_USERNAME}/[^/\s]+)/
@@ -20,9 +24,6 @@ module Dependabot
         }x
         # [^/\s#]+ means one or more characters not matching (^) the class /, whitespace (\s), or #
         GITHUB_NWO_REGEX = %r{(?<repo>#{GITHUB_USERNAME}/[^/\s#]+)#(?<number>\d+)}
-        MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}
-        # regex to match a team mention on github
-        TEAM_MENTION_REGEX = %r{(?<![A-Za-z0-9`~])@(?<org>#{GITHUB_USERNAME})/(?<team>#{GITHUB_USERNAME})/?}
         # End of string
         EOS_REGEX = /\z/
 
@@ -49,9 +50,18 @@ module Dependabot
         sig { returns(T.nilable(String)) }
         attr_reader :github_redirection_service
 
-        sig { params(github_redirection_service: T.nilable(String)).void }
-        def initialize(github_redirection_service:)
+        sig { returns(T.nilable(String)) }
+        attr_reader :metadata_source_url
+
+        sig do
+          params(
+            github_redirection_service: T.nilable(String),
+            metadata_source_url: T.nilable(String)
+          ).void
+        end
+        def initialize(github_redirection_service:, metadata_source_url: nil)
           @github_redirection_service = github_redirection_service
+          @metadata_source_url = metadata_source_url
         end
 
         sig { params(text: String, unsafe: T::Boolean, format_html: T::Boolean).returns(String) }
@@ -90,7 +100,7 @@ module Dependabot
         def sanitize_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
-               node.string_content.match?(MENTION_REGEX)
+               node.string_content.match?(mention_regex)
               nodes = if parent_node_link?(node)
                         build_mention_link_text_nodes(node.string_content)
                       else
@@ -111,10 +121,10 @@ module Dependabot
         def sanitize_team_mentions(doc)
           doc.walk do |node|
             if node.type == :text &&
-               node.string_content.match?(TEAM_MENTION_REGEX)
+               node.string_content.match?(team_mention_regex)
               if parent_node_link?(node)
                 # Preserve text node formatting while preventing notifications with zero-width space
-                node.string_content = node.string_content.gsub(TEAM_MENTION_REGEX) do |match|
+                node.string_content = node.string_content.gsub(team_mention_regex) do |match|
                   insert_zero_width_space_in_mention(match)
                 end
               else
@@ -189,9 +199,9 @@ module Dependabot
           scan = StringScanner.new(text)
 
           until scan.eos?
-            line = scan.scan_until(MENTION_REGEX) ||
+            line = scan.scan_until(mention_regex) ||
                    scan.scan_until(EOS_REGEX)
-            line_match = T.must(line).match(MENTION_REGEX)
+            line_match = T.must(line).match(mention_regex)
             mention = line_match&.to_s
             text_node = Commonmarker::Node.new(:text)
 
@@ -199,7 +209,7 @@ module Dependabot
               text_node.string_content = line_match.pre_match
               nodes << text_node
               nodes << create_link_node(
-                "https://github.com/#{mention.tr('@', '')}", mention.to_s
+                "#{mention_profile_base_url}/#{mention.delete_prefix('@')}", mention.to_s
               )
             else
               text_node.string_content = line
@@ -216,9 +226,9 @@ module Dependabot
 
           scan = StringScanner.new(text)
           until scan.eos?
-            line = scan.scan_until(TEAM_MENTION_REGEX) ||
+            line = scan.scan_until(team_mention_regex) ||
                    scan.scan_until(EOS_REGEX)
-            line_match = T.must(line).match(TEAM_MENTION_REGEX)
+            line_match = T.must(line).match(team_mention_regex)
             mention = line_match&.to_s
             text_node = Commonmarker::Node.new(:text)
 
@@ -235,6 +245,36 @@ module Dependabot
           nodes
         end
 
+        sig { returns(Regexp) }
+        def mention_regex
+          %r{(?<![A-Za-z0-9`~])@#{mention_username_regex}/?}
+        end
+
+        sig { returns(Regexp) }
+        def team_mention_regex
+          username_regex = mention_username_regex
+          %r{(?<![A-Za-z0-9`~])@(?<org>#{username_regex})/(?<team>#{username_regex})/?}
+        end
+
+        sig { returns(Regexp) }
+        def mention_username_regex
+          metadata_source_host == GITLAB_HOST ? GITLAB_USERNAME : GITHUB_USERNAME
+        end
+
+        sig { returns(String) }
+        def mention_profile_base_url
+          "https://#{metadata_source_host == GITLAB_HOST ? GITLAB_HOST : GITHUB_HOST}"
+        end
+
+        sig { returns(T.nilable(String)) }
+        def metadata_source_host
+          return unless metadata_source_url
+
+          URI.parse(T.must(metadata_source_url)).host&.downcase
+        rescue URI::InvalidURIError
+          nil
+        end
+
         sig { params(text: String).returns(T::Array[Commonmarker::Node]) }
         def build_mention_link_text_nodes(text)
           code_node = Commonmarker::Node.new(:code)

data/lib/dependabot/pull_request_creator/message_builder/metadata_presenter.rb

@@ -85,13 +85,11 @@ module Dependabot
         def vulnerabilities_cascade
           return "" unless vulnerabilities_fixed&.any?
 
-          msg = ""
-          T.must(vulnerabilities_fixed).each do |v|
-            msg += serialized_vulnerability_details(v)
+          msg = T.must(vulnerabilities_fixed).map do |vulnerability|
+            details = sanitize_template_tags(serialized_vulnerability_details(vulnerability))
+            sanitize_links_and_mentions(details, metadata_source_url: vulnerability["source_url"])
           end
-
-          msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = msg.join
 
           build_details_tag(summary: "Vulnerabilities fixed", body: msg)
         end
@@ -109,7 +107,7 @@ module Dependabot
             base_url: source_url + "/blob/HEAD/"
           )
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: releases_url)
 
           build_details_tag(summary: "Release notes", body: msg)
         end
@@ -125,7 +123,7 @@ module Dependabot
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: changelog_url)
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: changelog_url)
 
           build_details_tag(summary: "Changelog", body: msg)
         end
@@ -141,7 +139,7 @@ module Dependabot
           msg = link_issues(text: msg)
           msg = fix_relative_links(text: msg, base_url: upgrade_guide_url)
           msg = sanitize_template_tags(msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: upgrade_guide_url)
 
           build_details_tag(summary: "Upgrade guide", body: msg)
         end
@@ -170,7 +168,7 @@ module Dependabot
               "- See full diff in [compare view](#{commits_url})\n"
             end
           msg = link_issues(text: msg)
-          msg = sanitize_links_and_mentions(msg)
+          msg = sanitize_links_and_mentions(msg, metadata_source_url: commits_url)
 
           build_details_tag(summary: "Commits", body: msg)
         end
@@ -317,10 +315,19 @@ module Dependabot
           !%w(bitbucket codecommit).include?(source.provider)
         end
 
-        sig { params(text: String, unsafe: T::Boolean).returns(String) }
-        def sanitize_links_and_mentions(text, unsafe: false)
+        sig do
+          params(
+            text: String,
+            unsafe: T::Boolean,
+            metadata_source_url: T.nilable(String)
+          ).returns(String)
+        end
+        def sanitize_links_and_mentions(text, unsafe: false, metadata_source_url: source_url)
           LinkAndMentionSanitizer
-            .new(github_redirection_service: github_redirection_service)
+            .new(
+              github_redirection_service: github_redirection_service,
+              metadata_source_url: metadata_source_url
+            )
             .sanitize_links_and_mentions(text: text, unsafe: unsafe, format_html: source_provider_supports_html?)
         end