dependabot-common 0.113.11 → 0.113.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 48912fb9054dc3409b1b3890324d5664883666841e73899c81f82fada8709598
-  data.tar.gz: 721c424e9b83f4fcac58772d09df61f8539df3594ba65094d04e3b4a9f2e4976
+  metadata.gz: 3e11294f909352aa0f8826372c144b15e8f5ba4d38ac114e784c4537ac4c4c44
+  data.tar.gz: 2ff645789e8130aa5c188d80c6a2656900513e2d1cfdd0176b2fa61726e821f4
 SHA512:
-  metadata.gz: 5f604c14e2298705ca0714bd7a9c4097d9cfcebfff9200fcee4476f997897175339134a921f497b0d79730bab55a85246ffa51e02f2ffa988556bdaaa26418b2
-  data.tar.gz: ecc17f5c9ae5f4cea9e937c82468831d44c18d86bc90c4aef02ed846a27832dd636968ca9b79f32c2102fd1590b9d66db899993398ced48c07577d983dba0340
+  metadata.gz: 2ab237d88e37547717b86992b029dce437bc0eaab0239133c61f63de20849c5aaecb803043361bbd74e41a8ac3d91017508faf95443057c9e40a618ce45ce052
+  data.tar.gz: bfaae794e512efb73b58f2c5f187d3f67727d89ab0778e6794ea3f3deeeeba8036a654c12c7d271fc900838ab2aa2dd8d0d9a4f981f8af78512a0c326cac76e0

data/lib/dependabot/pull_request_creator/message_builder/link_and_mention_sanitizer.rb

@@ -13,7 +13,7 @@ module Dependabot
           github\.com/(?<repo>#{GITHUB_USERNAME}/[^/\s]+)/
           (?:issue|pull)s?/(?<number>\d+)
         }x.freeze
-        CODEBLOCK_REGEX = /```|~~~/.freeze
+        CODEBLOCK_REGEX = /(`+).*?(\1)|~~~.*?~~~/m.freeze
         # End of string
         EOS_REGEX = /\z/.freeze
 
@@ -26,23 +26,34 @@ module Dependabot
         def sanitize_links_and_mentions(text:)
           # We don't want to sanitize any links or mentions that are contained
           # within code blocks, so we split the text on "```" or "~~~"
-          lines = []
+          sanitized_text = []
           scan = StringScanner.new(text)
           until scan.eos?
-            line = scan.scan_until(CODEBLOCK_REGEX) ||
-                   scan.scan_until(EOS_REGEX)
-            delimiter = line.match(CODEBLOCK_REGEX)&.to_s
-            unless delimiter && lines.count { |l| l.include?(delimiter) }.odd?
-              line = sanitize_mentions(line)
-              line = sanitize_links(line)
-            end
-            lines << line
+            block = scan.scan_until(CODEBLOCK_REGEX) ||
+                    scan.scan_until(EOS_REGEX)
+            sanitized_text << sanitize_links_and_mentions_in_block(block)
           end
-          lines.join
+          sanitized_text.join
         end
 
         private
 
+        def sanitize_links_and_mentions_in_block(block)
+          # Handle code blocks one by one
+          normal_text = block
+          verbatim_text = ""
+          match = block.match(CODEBLOCK_REGEX)
+          if match
+            # Part leading up to start of code block
+            normal_text = match.pre_match
+            # Entire code block copied verbatim
+            verbatim_text = match.to_s
+          end
+          normal_text = sanitize_mentions(normal_text)
+          normal_text = sanitize_links(normal_text)
+          normal_text + verbatim_text
+        end
+
         def sanitize_mentions(text)
           text.gsub(%r{(?<![A-Za-z0-9`~])@#{GITHUB_USERNAME}/?}) do |mention|
             next mention if mention.end_with?("/")

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.113.11"
+  VERSION = "0.113.12"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.113.11
+  version: 0.113.12
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-08 00:00:00.000000000 Z
+date: 2019-10-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit