dependabot-common 0.392.0 → 0.394.0

data/lib/dependabot/command_helpers.rb

@@ -1,7 +1,6 @@
-# typed: strict
+# typed: strong
 # frozen_string_literal: true
 
-require "open3"
 require "timeout"
 require "sorbet-runtime"
 require "shellwords"
@@ -23,11 +22,15 @@ module Dependabot
       T.nilable(T.proc.params(data: String).returns(T::Hash[Symbol, T.anything]))
     end
 
+    Environment = T.type_alias { T::Hash[String, String] }
+    SpawnOptions = T.type_alias { T::Hash[Symbol, T.anything] }
+
     EnvCmdItem = T.type_alias do
       T.any(
         String,
         T::Array[String],
-        T::Hash[T.any(String, Symbol), T.anything]
+        Environment,
+        SpawnOptions
       )
     end
 
@@ -101,25 +104,31 @@ module Dependabot
       start_time = Time.now
 
       begin
-        T.unsafe(Open3).popen3(*env_cmd) do |stdin, stdout_io, stderr_io, wait_thr| # rubocop:disable Metrics/BlockLength
+        stdout_io, stderr_io, wait_thr = open_process(env_cmd)
+        begin
           pid = wait_thr.pid
           command_string = command_string_for_logging(env_cmd)
           log_level = short_git_config_command?(command_string) ? :debug : :info
-          sanitized_env_cmd = if env_cmd.first.is_a?(Hash)
-                                [SharedHelpers.send(:sanitize_env_for_logging, env_cmd.first), *env_cmd[1..]]
-                              else
-                                env_cmd
-                              end
+          first_item = env_cmd.first
+          sanitized_env_cmd = T.let(
+            if first_item.is_a?(Hash)
+              environment = extract_environment(env_cmd.dup)
+              [T.must(SharedHelpers.sanitize_env_for_logging(environment)), *env_cmd.drop(1)]
+            else
+              env_cmd
+            end,
+            T::Array[EnvCmdItem]
+          )
           command_for_log = sanitized_env_cmd.map { |item| item.is_a?(Array) ? item.first : item }.join(" ")
           Dependabot.logger.public_send(log_level, "Started process PID: #{pid} with command: #{command_for_log}")
 
           # Write to stdin if input data is provided
           begin
-            stdin&.write(stdin_data) if stdin_data
+            stdout_io.write(stdin_data) if stdin_data
           rescue Errno::EPIPE
             # Process exited before reading stdin - continue to collect output
           end
-          stdin&.close
+          stdout_io.close_write
 
           stdout_io.sync = true
           stderr_io.sync = true
@@ -191,6 +200,10 @@ module Dependabot
 
           status = ProcessStatus.new(wait_thr.value)
           Dependabot.logger.public_send(log_level, "Process PID: #{pid} completed with status: #{status}")
+        ensure
+          stdout_io.close unless stdout_io.closed?
+          stderr_io.close unless stderr_io.closed?
+          wait_thr.join
         end
       rescue Timeout::Error => e
         Dependabot.logger.error("Process PID: #{pid} failed due to timeout: #{e.message}")
@@ -215,6 +228,61 @@ module Dependabot
     # rubocop:enable Metrics/PerceivedComplexity
     # rubocop:enable Metrics/CyclomaticComplexity
 
+    sig { params(env_cmd: T::Array[EnvCmdItem]).returns([IO, IO, Process::Waiter]) }
+    def self.open_process(env_cmd)
+      process_io = T.let(nil, T.nilable(IO))
+      stderr_io = T.let(nil, T.nilable(IO))
+      stderr_writer = T.let(nil, T.nilable(IO))
+      arguments = env_cmd.dup
+      environment = extract_environment(arguments)
+      options = extract_options(arguments)
+      command = command_for_popen(arguments)
+
+      stderr_io, stderr_writer = IO.pipe
+      options[:err] = stderr_writer
+      process_io = T.cast(IO.popen(environment, command, "r+", options), IO)
+      stderr_writer.close
+
+      wait_thread = T.cast(Process.detach(process_io.pid), Process::Waiter)
+      [process_io, stderr_io, wait_thread]
+    rescue StandardError
+      process_io.close if process_io && !process_io.closed?
+      stderr_io.close if stderr_io && !stderr_io.closed?
+      stderr_writer.close if stderr_writer && !stderr_writer.closed?
+      raise
+    end
+    private_class_method :open_process
+
+    sig { params(arguments: T::Array[EnvCmdItem]).returns(Environment) }
+    def self.extract_environment(arguments)
+      return {} unless arguments.first.is_a?(Hash)
+
+      T.cast(arguments.shift, Environment)
+    end
+    private_class_method :extract_environment
+
+    sig { params(arguments: T::Array[EnvCmdItem]).returns(SpawnOptions) }
+    def self.extract_options(arguments)
+      return {} unless arguments.last.is_a?(Hash)
+
+      T.cast(arguments.pop, SpawnOptions).dup
+    end
+    private_class_method :extract_options
+
+    sig do
+      params(arguments: T::Array[EnvCmdItem])
+        .returns(T.any(String, T::Array[T.any(String, T::Array[String])]))
+    end
+    def self.command_for_popen(arguments)
+      raise ArgumentError, "command must not be empty" if arguments.empty?
+
+      first_argument = arguments.first
+      return first_argument if arguments.one? && first_argument.is_a?(String)
+
+      T.cast(arguments, T::Array[T.any(String, T::Array[String])])
+    end
+    private_class_method :command_for_popen
+
     # Terminate a process by PID
     sig { params(pid: T.nilable(Integer)).void }
     def self.terminate_process(pid)

data/lib/dependabot/credential.rb

@@ -9,9 +9,11 @@ module Dependabot
     extend T::Sig
     extend Forwardable
 
+    Value = T.type_alias { T.nilable(String) }
+
     def_delegators :@credential, :fetch, :keys, :[]=, :delete, :slice, :values, :entries
 
-    sig { params(credential: T::Hash[String, T.any(T::Boolean, String, T::Array[String])]).void }
+    sig { params(credential: T::Hash[String, T.nilable(T.any(T::Boolean, String, T::Array[String]))]).void }
     def initialize(credential)
       @replaces_base = T.let(credential["replaces-base"] == true, T::Boolean)
       credential.delete("replaces-base")
@@ -25,7 +27,14 @@ module Dependabot
         T.nilable(T::Array[String])
       )
 
-      @credential = T.let(T.unsafe(credential), T::Hash[String, String])
+      @credential = T.let(
+        credential.to_h do |key, value|
+          raise TypeError, "credential #{key} must be a string or nil" unless value.nil? || value.is_a?(String)
+
+          [key, value]
+        end,
+        T::Hash[String, Value]
+      )
     end
 
     sig { returns(T::Boolean) }
@@ -46,7 +55,7 @@ module Dependabot
       Credential.new(@credential.merge(other.to_h))
     end
 
-    sig { returns(T::Hash[String, String]) }
+    sig { returns(T::Hash[String, Value]) }
     def to_h
       @credential
     end

data/lib/dependabot/errors.rb

@@ -580,7 +580,10 @@ module Dependabot
     end
     def initialize(tool_name, tool_message)
       @tool_name = tool_name
-      @tool_message = tool_message
+      # Sanitize here as well as via `super`: the raw `tool_message` attribute is read
+      # directly during error serialization (see `updater_error_details`), so it must not
+      # carry credentials (e.g. basic-auth URLs) that the base message sanitization strips.
+      @tool_message = T.let(filter_sensitive_data(tool_message), String)
 
       msg = "Dependabot detected that #{tool_name} is misconfigured in this repository. " \
             "Running `#{tool_name.downcase}` results in the following error: #{tool_message}"