dependabot-common 0.99.7 → 0.100.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 98884158fba0e3b064fef891c739d4c9325313302c6a29c7a5284a1509f35eab
-  data.tar.gz: 3dbc41a9033f8e5bd13dbdd6d1dbcc5a8133a9f03efe8d7115398dba5ff2b60d
+  metadata.gz: f9668f1967a71d3410cbc64d841b11b6489c2fcb18c44fe93c46c41a04fba5d7
+  data.tar.gz: 61c5d476ca5df6fa4c0d071f325708db732de08a5104cf88d4fdf9a510f00e34
 SHA512:
-  metadata.gz: bfc6417f509d36642bd6f6cef21b631b16b9c609a1e67eca6d4035cea92eafb5d4182153e16e88f103bfa69d9c704a31612ebc5a2858df9d560b839110a7ddf5
-  data.tar.gz: dfb0622119af5e1b83eb544ebfa1548b5403f1db1a412208d3f6bd3677902ef84abf7d06c37e75ae2f3a1668801f41968d66a7974c9d9be527b4e3e7206cf8bb
+  metadata.gz: 66bccb0d40bff7af3d3bdb7e64b8818f52f33fffac90c8d789bed1257be1550269bf85516e95b2fad63548cf2c2ff60d11e0119b34bcd4e67de6531bd51ca87f
+  data.tar.gz: 77d31ecd4dbf6e0c46e6c9b927197d4c8494ce134bfbcb900a5f81ea3a535b6b2feced921aedbace21502bfc7460a3d1dcea36e0d60d31104a8896f1de993b7e

data/lib/dependabot/security_advisory.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "rubygems_version_patch"
+
+module Dependabot
+  class SecurityAdvisory
+    attr_reader :vulnerable_versions, :safe_versions, :package_manager
+
+    def initialize(vulnerable_versions: [], safe_versions: [], package_manager:)
+      @vulnerable_versions = vulnerable_versions || []
+      @safe_versions = safe_versions || []
+      @package_manager = package_manager
+
+      convert_string_version_requirements
+      check_version_requirements
+    end
+
+    def vulnerable?(version)
+      unless version.is_a?(version_class)
+        raise ArgumentError, "must be a #{version_class}"
+      end
+
+      in_safe_range =
+        safe_versions.
+        any? { |r| r.satisfied_by?(version_class.new(version)) }
+
+      # If version is known safe for this advisory, it's not vulnerable
+      return false if in_safe_range
+
+      in_vulnerable_range =
+        vulnerable_versions.
+        any? { |r| r.satisfied_by?(version_class.new(version)) }
+
+      # If in the vulnerable range and not known safe, it's vulnerable
+      return true if in_vulnerable_range
+
+      # If a vulnerable range present but not met, it's not vulnerable
+      return false if vulnerable_versions.any?
+
+      # Finally, if no vulnerable range provided, but a safe range provided,
+      # and this versions isn't included (checked earler), it's vulnerable
+      safe_versions.any?
+    end
+
+    private
+
+    def convert_string_version_requirements
+      @vulnerable_versions = vulnerable_versions.flat_map do |vuln_str|
+        next vuln_str unless vuln_str.is_a?(String)
+
+        requirement_class.requirements_array(vuln_str)
+      end
+
+      @safe_versions = safe_versions.flat_map do |safe_str|
+        next safe_str unless safe_str.is_a?(String)
+
+        requirement_class.requirements_array(safe_str)
+      end
+    end
+
+    def check_version_requirements
+      unless vulnerable_versions.is_a?(Array) &&
+             vulnerable_versions.all? { |i| requirement_class <= i.class }
+        raise ArgumentError, "vulnerable_versions must be an array "\
+                             "of #{requirement_class} instances"
+      end
+
+      unless safe_versions.is_a?(Array) &&
+             safe_versions.all? { |i| requirement_class <= i.class }
+        raise ArgumentError, "safe_versions must be an array "\
+                             "of #{requirement_class} instances"
+      end
+    end
+
+    def version_class
+      Utils.version_class_for_package_manager(package_manager)
+    end
+
+    def requirement_class
+      Utils.requirement_class_for_package_manager(package_manager)
+    end
+  end
+end

data/lib/dependabot/update_checkers/base.rb

@@ -2,24 +2,28 @@
 
 require "json"
 require "dependabot/utils"
+require "dependabot/security_advisory"
 
 module Dependabot
   module UpdateCheckers
     class Base
       attr_reader :dependency, :dependency_files, :credentials,
-                  :ignored_versions, :requirements_update_strategy
+                  :ignored_versions, :security_advisories,
+                  :requirements_update_strategy
 
       def initialize(dependency:, dependency_files:, credentials:,
-                     ignored_versions: [], requirements_update_strategy: nil)
+                     ignored_versions: [], security_advisories: [],
+                     requirements_update_strategy: nil)
         @dependency = dependency
         @dependency_files = dependency_files
         @credentials = credentials
         @requirements_update_strategy = requirements_update_strategy
         @ignored_versions = ignored_versions
+        @security_advisories = security_advisories
       end
 
       def up_to_date?
-        if dependency.appears_in_lockfile?
+        if dependency.version
           version_up_to_date?
         else
           requirements_up_to_date?
@@ -30,7 +34,7 @@ module Dependabot
         # Can't update if all versions are being ignored
         return false if ignore_reqs.include?(requirement_class.new(">= 0"))
 
-        if dependency.appears_in_lockfile?
+        if dependency.version
           version_can_update?(requirements_to_unlock: requirements_to_unlock)
         else
           # TODO: Handle full unlock updates for dependencies without a lockfile
@@ -57,10 +61,25 @@ module Dependabot
         raise NotImplementedError
       end
 
+      def preferred_resolvable_version
+        # If this dependency is vulnerable, prefer trying to update to the
+        # lowest_resolvable_security_fix_version. Otherwise update all the way
+        # to the latest_resolvable_version.
+        return lowest_resolvable_security_fix_version if vulnerable?
+
+        latest_resolvable_version
+      rescue NotImplementedError
+        latest_resolvable_version
+      end
+
       def latest_resolvable_version
         raise NotImplementedError
       end
 
+      def lowest_resolvable_security_fix_version
+        raise NotImplementedError
+      end
+
       def latest_resolvable_version_with_no_unlock
         raise NotImplementedError
       end
@@ -84,6 +103,20 @@ module Dependabot
         true
       end
 
+      def vulnerable?
+        return false if security_advisories.none?
+
+        # Can't (currently) detect whether dependencies without a version
+        # (i.e., for repos without a lockfile) are vulnerable
+        return false unless dependency.version
+
+        # Can't (currently) detect whether git dependencies are vulnerable
+        return false if existing_version_is_sha?
+
+        version = version_class.new(dependency.version)
+        security_advisories.any? { |a| a.vulnerable?(version) }
+      end
+
       private
 
       def latest_version_resolvable_with_full_unlock?
@@ -104,7 +137,7 @@ module Dependabot
       def updated_dependency_with_own_req_unlock
         Dependency.new(
           name: dependency.name,
-          version: latest_resolvable_version.to_s,
+          version: preferred_resolvable_version.to_s,
           requirements: updated_requirements,
           previous_version: dependency.version,
           previous_requirements: dependency.requirements,
@@ -153,7 +186,7 @@ module Dependabot
           new_version = latest_resolvable_version_with_no_unlock
           new_version && !new_version.to_s.start_with?(dependency.version)
         when :own
-          new_version = latest_resolvable_version
+          new_version = preferred_resolvable_version
           new_version && !new_version.to_s.start_with?(dependency.version)
         when :all
           latest_version_resolvable_with_full_unlock?
@@ -180,7 +213,7 @@ module Dependabot
           new_version = latest_resolvable_version_with_no_unlock
           new_version && new_version > version_class.new(dependency.version)
         when :own
-          new_version = latest_resolvable_version
+          new_version = preferred_resolvable_version
           new_version && new_version > version_class.new(dependency.version)
         when :all
           latest_version_resolvable_with_full_unlock?

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.99.7"
+  VERSION = "0.100.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.99.7
+  version: 0.100.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-10 00:00:00.000000000 Z
+date: 2019-04-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-ecr
@@ -345,6 +345,7 @@ files:
 - lib/dependabot/pull_request_creator/message_builder.rb
 - lib/dependabot/pull_request_updater.rb
 - lib/dependabot/pull_request_updater/github.rb
+- lib/dependabot/security_advisory.rb
 - lib/dependabot/shared_helpers.rb
 - lib/dependabot/source.rb
 - lib/dependabot/update_checkers.rb