dependabot-common 0.129.0 → 0.129.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2aad47f438d1d29c9df39dc471c2acac25431693903e4b433d4cad6e9bdbfcb9
-  data.tar.gz: fd64c94c99f99c8ee0d759f6987ab32aebeb76e299f9a82a50062d0b560ec46c
+  metadata.gz: 7eea4634c39d341b056956d51d57a9fea64190c1a172a96fb3317c356ca2532b
+  data.tar.gz: 3f0ba3352b108078c8acc41231198906d6c57f6365988fd487c05fe0a0d83540
 SHA512:
-  metadata.gz: fec4b20261eb3780f58719427892bd9b3a6b2105c5e51a7b99a949d07f23b6de942ea747da379cc03c30cf4a57d6bdcac2c0c3544edb713d022789672e2c9a47
-  data.tar.gz: 3c484b2152ef03bae5b890401a91bd3d3029ffdf145ad868405044f7db50a4ff56ccc4a12adbf614427b089a8b3aa60dcbab30bf8b08b5fdf64e72b1c8140ab0
+  metadata.gz: 75e7fc049f1bea358690dbd12cc820e25b63d6c96ed8ee1e41fabbed50da001de4149f9a91aa1b952e8b87b23ceb2952b98ef36b7413be2ae09380705257996a
+  data.tar.gz: 707447c34d57d896a73029b2b3b7d8a96914863eb4f6e611fd92b2f196ed602e42bd9784a1217487b9b1e89a23d6a832bdf4ea8e67a5d9d6621d89af0b627569

data/lib/dependabot/errors.rb

@@ -1,24 +1,45 @@
 # frozen_string_literal: true
 
-require "dependabot/shared_helpers"
+require "dependabot/utils"
 
 module Dependabot
   class DependabotError < StandardError
-    def initialize(msg = nil)
-      msg = sanitize_message(msg)
-      super(msg)
+    BASIC_AUTH_REGEX = %r{://(?<auth>[^:]*:[^@%\s]+(@|%40))}.freeze
+    # Remove any path segment from fury.io sources
+    FURY_IO_PATH_REGEX = %r{fury\.io/(?<path>.+)}.freeze
+
+    def initialize(message = nil)
+      super(sanitize_message(message))
     end
 
     private
 
     def sanitize_message(message)
-      return unless message
+      return message unless message.is_a?(String)
 
       path_regex =
-        Regexp.escape(SharedHelpers::BUMP_TMP_DIR_PATH) + "\/" +
-        Regexp.escape(SharedHelpers::BUMP_TMP_FILE_PREFIX) + "[^/]*"
+        Regexp.escape(Utils::BUMP_TMP_DIR_PATH) + "\/" +
+        Regexp.escape(Utils::BUMP_TMP_FILE_PREFIX) + "[a-zA-Z0-9-]*"
+
+      message = message.gsub(/#{path_regex}/, "dependabot_tmp_dir").strip
+      filter_sensitive_data(message)
+    end
+
+    def filter_sensitive_data(message)
+      replace_capture_groups(message, BASIC_AUTH_REGEX, "")
+    end
+
+    def sanitize_source(source)
+      source = filter_sensitive_data(source)
+      replace_capture_groups(source, FURY_IO_PATH_REGEX, "<redacted>")
+    end
+
+    def replace_capture_groups(string, regex, replacement)
+      return string unless string.is_a?(String)
 
-      message.gsub(/#{path_regex}/, "dependabot_tmp_dir")
+      string.scan(regex).flatten.compact.reduce(string) do |original_msg, match|
+        original_msg.gsub(match, replacement)
+      end
     end
   end
 
@@ -35,7 +56,6 @@ module Dependabot
 
     def initialize(branch_name, msg = nil)
       @branch_name = branch_name
-      msg = sanitize_message(msg)
       super(msg)
     end
   end
@@ -101,10 +121,10 @@ module Dependabot
     attr_reader :source
 
     def initialize(source)
-      @source = source.gsub(%r{(?<=\.fury\.io)/[A-Za-z0-9]{20}(?=/)}, "")
+      @source = sanitize_source(source)
       msg = "The following source could not be reached as it requires "\
             "authentication (and any provided details were invalid or lacked "\
-            "the required permissions): #{source}"
+            "the required permissions): #{@source}"
       super(msg)
     end
   end
@@ -113,8 +133,8 @@ module Dependabot
     attr_reader :source
 
     def initialize(source)
-      @source = source.gsub(%r{(?<=\.fury\.io)/[A-Za-z0-9]{20}(?=/)}, "")
-      super("The following source timed out: #{source}")
+      @source = sanitize_source(source)
+      super("The following source timed out: #{@source}")
     end
   end
 
@@ -122,8 +142,8 @@ module Dependabot
     attr_reader :source
 
     def initialize(source)
-      @source = source.gsub(%r{(?<=\.fury\.io)/[A-Za-z0-9]{20}(?=/)}, "")
-      super("Could not verify the SSL certificate for #{source}")
+      @source = sanitize_source(source)
+      super("Could not verify the SSL certificate for #{@source}")
     end
   end
 
@@ -132,7 +152,7 @@ module Dependabot
 
     def initialize(environment_variable)
       @environment_variable = environment_variable
-      super("Missing environment variable #{environment_variable}")
+      super("Missing environment variable #{@environment_variable}")
     end
   end
 
@@ -149,10 +169,10 @@ module Dependabot
 
     def initialize(*dependency_urls)
       @dependency_urls =
-        dependency_urls.flatten.map { |uri| uri.gsub(/x-access-token.*?@/, "") }
+        dependency_urls.flatten.map { |uri| filter_sensitive_data(uri) }
 
       msg = "The following git URLs could not be retrieved: "\
-            "#{dependency_urls.join(', ')}"
+            "#{@dependency_urls.join(', ')}"
       super(msg)
     end
   end
@@ -163,7 +183,7 @@ module Dependabot
     def initialize(dependency)
       @dependency = dependency
 
-      msg = "The branch or reference specified for #{dependency} could not "\
+      msg = "The branch or reference specified for #{@dependency} could not "\
             "be retrieved"
       super(msg)
     end
@@ -175,7 +195,7 @@ module Dependabot
     def initialize(*dependencies)
       @dependencies = dependencies.flatten
       msg = "The following path based dependencies could not be retrieved: "\
-            "#{dependencies.join(', ')}"
+            "#{@dependencies.join(', ')}"
       super(msg)
     end
   end
@@ -188,8 +208,8 @@ module Dependabot
       @declared_path = declared_path
       @discovered_path = discovered_path
 
-      msg = "The module path '#{declared_path}' found in #{go_mod} doesn't "\
-            "match the actual path '#{discovered_path}' in the dependency's "\
+      msg = "The module path '#{@declared_path}' found in #{@go_mod} doesn't "\
+            "match the actual path '#{@discovered_path}' in the dependency's "\
             "go.mod"
       super(msg)
     end

data/lib/dependabot/shared_helpers.rb

@@ -8,12 +8,12 @@ require "digest"
 require "open3"
 require "shellwords"
 
+require "dependabot/utils"
+require "dependabot/errors"
 require "dependabot/version"
 
 module Dependabot
   module SharedHelpers
-    BUMP_TMP_FILE_PREFIX = "dependabot_"
-    BUMP_TMP_DIR_PATH = "tmp"
     GIT_CONFIG_GLOBAL_PATH = File.expand_path("~/.gitconfig")
     USER_AGENT = "dependabot-core/#{Dependabot::VERSION} "\
                  "#{Excon::USER_AGENT} ruby/#{RUBY_VERSION} "\
@@ -21,21 +21,6 @@ module Dependabot
                  "(+https://github.com/dependabot/dependabot-core)"
     SIGKILL = 9
 
-    class ChildProcessFailed < StandardError
-      attr_reader :error_class, :error_message, :error_backtrace
-
-      def initialize(error_class:, error_message:, error_backtrace:)
-        @error_class = error_class
-        @error_message = error_message
-        @error_backtrace = error_backtrace
-
-        msg = "Child process raised #{error_class} with message: "\
-              "#{error_message}"
-        super(msg)
-        set_backtrace(error_backtrace)
-      end
-    end
-
     def self.in_a_temporary_repo_directory(directory = "/",
                                            repo_contents_path = nil,
                                            &block)
@@ -53,15 +38,15 @@ module Dependabot
     end
 
     def self.in_a_temporary_directory(directory = "/")
-      Dir.mkdir(BUMP_TMP_DIR_PATH) unless Dir.exist?(BUMP_TMP_DIR_PATH)
-      Dir.mktmpdir(BUMP_TMP_FILE_PREFIX, BUMP_TMP_DIR_PATH) do |dir|
+      Dir.mkdir(Utils::BUMP_TMP_DIR_PATH) unless Dir.exist?(Utils::BUMP_TMP_DIR_PATH)
+      Dir.mktmpdir(Utils::BUMP_TMP_FILE_PREFIX, Utils::BUMP_TMP_DIR_PATH) do |dir|
         path = Pathname.new(File.join(dir, directory)).expand_path
         FileUtils.mkpath(path)
         Dir.chdir(path) { yield(path) }
       end
     end
 
-    class HelperSubprocessFailed < StandardError
+    class HelperSubprocessFailed < Dependabot::DependabotError
       attr_reader :error_class, :error_context, :trace
 
       def initialize(message:, error_context:, error_class: nil, trace: nil)

data/lib/dependabot/utils.rb

@@ -4,6 +4,9 @@
 #       dependabot-core.
 module Dependabot
   module Utils
+    BUMP_TMP_FILE_PREFIX = "dependabot_"
+    BUMP_TMP_DIR_PATH = "tmp"
+
     @version_classes = {}
 
     def self.version_class_for_package_manager(package_manager)

data/lib/dependabot/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Dependabot
-  VERSION = "0.129.0"
+  VERSION = "0.129.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-common
 version: !ruby/object:Gem::Version
-  version: 0.129.0
+  version: 0.129.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-12-15 00:00:00.000000000 Z
+date: 2020-12-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-codecommit