dependabot-core 0.76.1

data/lib/dependabot/file_fetchers/docker/docker.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Docker
+      class Docker < Dependabot::FileFetchers::Base
+        def self.required_files_in?(filenames)
+          filenames.any? { |f| f.match?(/dockerfile/i) }
+        end
+
+        def self.required_files_message
+          "Repo must contain a Dockerfile."
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+          fetched_files += dockerfiles
+
+          return fetched_files if fetched_files.any?
+
+          raise(
+            Dependabot::DependencyFileNotFound,
+            File.join(directory, "Dockerfile")
+          )
+        end
+
+        def dockerfiles
+          @dockerfiles ||=
+            repo_contents(raise_errors: false).
+            select { |f| f.type == "file" && f.name.match?(/dockerfile/i) }.
+            map { |f| fetch_file_from_host(f.name) }
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/dotnet/nuget.rb

@@ -0,0 +1,215 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Dotnet
+      class Nuget < Dependabot::FileFetchers::Base
+        require "dependabot/file_fetchers/dotnet/nuget/import_paths_finder"
+        require "dependabot/file_fetchers/dotnet/nuget/sln_project_paths_finder"
+
+        def self.required_files_in?(filenames)
+          return true if filenames.any? { |f| f.match?(/^packages\.config$/i) }
+          return true if filenames.any? { |f| f.end_with?(".sln") }
+
+          filenames.any? { |name| name.match?(%r{^[^/]*\.[a-z]{2}proj$}) }
+        end
+
+        def self.required_files_message
+          "Repo must contain a .(cs|vb|fs)proj file or a packages.config."
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+          fetched_files += project_files
+          fetched_files += directory_build_props_files
+          fetched_files += imported_property_files
+
+          fetched_files += packages_config_files
+          fetched_files << nuget_config if nuget_config
+
+          fetched_files = fetched_files.uniq
+
+          if project_files.none? && packages_config_files.none?
+            raise(
+              Dependabot::DependencyFileNotFound,
+              File.join(directory, "<anything>.(cs|vb|fs)proj")
+            )
+          end
+
+          fetched_files
+        end
+
+        def project_files
+          @project_files ||=
+            begin
+              project_files = []
+              project_files << csproj_file if csproj_file
+              project_files << vbproj_file if vbproj_file
+              project_files << fsproj_file if fsproj_file
+
+              project_files += sln_project_files
+              project_files
+            end
+        rescue Octokit::NotFound, Gitlab::Error::NotFound
+          raise(
+            Dependabot::DependencyFileNotFound,
+            File.join(directory, "<anything>.(cs|vb|fs)proj")
+          )
+        end
+
+        def packages_config_files
+          return @packages_config_files if @packages_config_files
+
+          candidate_paths =
+            [*project_files.map { |f| File.dirname(f.name) }, "."].uniq
+
+          @packages_config_files ||=
+            candidate_paths.map do |dir|
+              file = repo_contents(dir: dir).
+                     find { |f| f.name.casecmp("packages.config").zero? }
+              fetch_file_from_host(File.join(dir, file.name)) if file
+            end.compact
+        end
+
+        def sln_file
+          return unless sln_file_name
+
+          @sln_file ||= fetch_file_from_host(sln_file_name)
+        end
+
+        def sln_file_name
+          sln_files = repo_contents.select { |f| f.name.end_with?(".sln") }
+
+          # If there are no sln files, just return `nil`
+          return if sln_files.none?
+
+          # Use the biggest sln file
+          sln_files.max_by(&:size).name
+        end
+
+        def directory_build_props_files
+          return @directory_build_props_files if @directory_build_checked
+
+          @directory_build_checked = true
+          attempted_paths = []
+          @directory_build_props_files = []
+
+          # Don't need to insert "." here, because Directory.Build.props files
+          # can only be used by project files (not packages.config ones)
+          project_files.map { |f| File.dirname(f.name) }.uniq.map do |dir|
+            possible_paths = dir.split("/").map.with_index do |_, i|
+              base = dir.split("/").first(i + 1).join("/")
+              Pathname.new(base + "/Directory.Build.props").cleanpath.to_path
+            end.reverse + ["Directory.Build.props"]
+
+            possible_paths.each do |path|
+              break if attempted_paths.include?(path)
+
+              attempted_paths << path
+              @directory_build_props_files << fetch_file_from_host(path)
+            rescue Dependabot::DependencyFileNotFound
+              next
+            end
+          end
+
+          @directory_build_props_files
+        end
+
+        def sln_project_files
+          return [] unless sln_file
+
+          @sln_project_files ||=
+            begin
+              paths = SlnProjectPathsFinder.
+                      new(sln_file: sln_file).
+                      project_paths
+
+              paths.map do |path|
+                fetch_file_from_host(path)
+              rescue Dependabot::DependencyFileNotFound
+                # Don't worry about missing files too much for now (at least
+                # until we start resolving properties)
+                nil
+              end.compact
+            end
+        end
+
+        def csproj_file
+          @csproj_file ||=
+            begin
+              file = repo_contents.find { |f| f.name.end_with?(".csproj") }
+              fetch_file_from_host(file.name) if file
+            end
+        end
+
+        def vbproj_file
+          @vbproj_file ||=
+            begin
+              file = repo_contents.find { |f| f.name.end_with?(".vbproj") }
+              fetch_file_from_host(file.name) if file
+            end
+        end
+
+        def fsproj_file
+          @fsproj_file ||=
+            begin
+              file = repo_contents.find { |f| f.name.end_with?(".fsproj") }
+              fetch_file_from_host(file.name) if file
+            end
+        end
+
+        def nuget_config
+          @nuget_config ||=
+            begin
+              file = repo_contents.
+                     find { |f| f.name.casecmp("nuget.config").zero? }
+              file = fetch_file_from_host(file.name) if file
+              file&.tap { |f| f.support_file = true }
+            end
+        end
+
+        def imported_property_files
+          imported_property_files = []
+
+          [*project_files, *directory_build_props_files].each do |proj_file|
+            previously_fetched_files = project_files + imported_property_files
+            imported_property_files +=
+              fetch_imported_property_files(
+                file: proj_file,
+                previously_fetched_files: previously_fetched_files
+              )
+          end
+
+          imported_property_files
+        end
+
+        def fetch_imported_property_files(file:, previously_fetched_files:)
+          paths =
+            ImportPathsFinder.new(project_file: file).import_paths +
+            ImportPathsFinder.new(project_file: file).project_reference_paths
+
+          paths.flat_map do |path|
+            next if previously_fetched_files.map(&:name).include?(path)
+            next if file.name == path
+            next if path.include?("$(")
+
+            fetched_file = fetch_file_from_host(path)
+            grandchild_property_files = fetch_imported_property_files(
+              file: fetched_file,
+              previously_fetched_files: previously_fetched_files + [file]
+            )
+            [fetched_file, *grandchild_property_files]
+          rescue Dependabot::DependencyFileNotFound
+            # Don't worry about missing files too much for now (at least
+            # until we start resolving properties)
+            nil
+          end.compact
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/dotnet/nuget/import_paths_finder.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+
+require "pathname"
+require "dependabot/file_fetchers/dotnet/nuget"
+
+module Dependabot
+  module FileFetchers
+    module Dotnet
+      class Nuget
+        class ImportPathsFinder
+          def initialize(project_file:)
+            @project_file = project_file
+          end
+
+          def import_paths
+            doc = Nokogiri::XML(project_file.content)
+            doc.remove_namespaces!
+            doc.xpath("/Project/Import").map do |import_node|
+              path = import_node.attribute("Project").value.strip.tr("\\", "/")
+              path = File.join(current_dir, path) unless current_dir.nil?
+              Pathname.new(path).cleanpath.to_path
+            end
+          end
+
+          def project_reference_paths
+            doc = Nokogiri::XML(project_file.content)
+            doc.remove_namespaces!
+            doc.xpath("/Project/ItemGroup/ProjectReference").map do |node|
+              path = node.attribute("Include").value.strip.tr("\\", "/")
+              path = File.join(current_dir, path) unless current_dir.nil?
+              Pathname.new(path).cleanpath.to_path
+            end
+          end
+
+          private
+
+          attr_reader :project_file
+
+          def current_dir
+            parts = project_file.name.split("/")[0..-2]
+            return if parts.empty?
+
+            parts.join("/")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/dotnet/nuget/sln_project_paths_finder.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "pathname"
+require "dependabot/file_fetchers/dotnet/nuget"
+
+module Dependabot
+  module FileFetchers
+    module Dotnet
+      class Nuget
+        class SlnProjectPathsFinder
+          PROJECT_PATH_REGEX =
+            /(?<=["'])[^"']*?\.(?:vb|cs|fs)proj(?=["'])/.freeze
+
+          def initialize(sln_file:)
+            @sln_file = sln_file
+          end
+
+          def project_paths
+            paths = []
+            sln_file_lines = sln_file.content.lines
+
+            sln_file_lines.each_with_index do |line, index|
+              next unless line.match?(/^\s*Project/)
+
+              # Don't know how to handle multi-line project declarations yet
+              next unless sln_file_lines[index + 1]&.match?(/^\s*EndProject/)
+
+              path = line.split('"')[5]
+              path = path.tr("\\", "/")
+
+              # If the path doesn't have an extension it's probably a directory
+              next unless path.match?(/\.[a-z]{2}proj$/)
+
+              path = File.join(current_dir, path) unless current_dir.nil?
+              paths << Pathname.new(path).cleanpath.to_path
+            end
+
+            paths
+          end
+
+          private
+
+          attr_reader :sln_file
+
+          def current_dir
+            parts = sln_file.name.split("/")[0..-2]
+            return if parts.empty?
+
+            parts.join("/")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/elixir/hex.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Elixir
+      class Hex < Dependabot::FileFetchers::Base
+        APPS_PATH_REGEX = /apps_path:\s*"(?<path>.*?)"/m.freeze
+        STRING_ARG = %{(?:["'](.*?)["'])}
+        EVAL_FILE = /Code\.eval_file\(#{STRING_ARG}(?:\s*,\s*#{STRING_ARG})?\)/.
+                    freeze
+
+        def self.required_files_in?(filenames)
+          filenames.include?("mix.exs")
+        end
+
+        def self.required_files_message
+          "Repo must contain a mix.exs."
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+          fetched_files << mixfile
+          fetched_files << lockfile if lockfile
+          fetched_files += subapp_mixfiles
+          fetched_files += evaled_files
+          fetched_files
+        end
+
+        def mixfile
+          @mixfile ||= fetch_file_from_host("mix.exs")
+        end
+
+        def lockfile
+          return @lockfile if @lockfile_lookup_attempted
+
+          @lockfile_lookup_attempted = true
+          @lockfile ||= fetch_file_from_host("mix.lock")
+        rescue Dependabot::DependencyFileNotFound
+          nil
+        end
+
+        def subapp_mixfiles
+          apps_path = mixfile.content.match(APPS_PATH_REGEX)&.
+                      named_captures&.fetch("path")
+          return [] unless apps_path
+
+          app_directories = repo_contents(dir: apps_path).
+                            select { |f| f.type == "dir" }
+
+          app_directories.map do |dir|
+            fetch_file_from_host("#{dir.path}/mix.exs")
+          rescue Dependabot::DependencyFileNotFound
+            # If the folder doesn't have a mix.exs it *might* be because it's
+            # not an app. Ignore the fact we couldn't fetch one and proceed with
+            # updating (it will blow up later if there are problems)
+            nil
+          end.compact
+        rescue Octokit::NotFound, Gitlab::Error::NotFound
+          # If the path specified in apps_path doesn't exist then it's not being
+          # used. We can just return an empty array of subapp files.
+          []
+        end
+
+        def evaled_files
+          mixfile.content.scan(EVAL_FILE).map do |eval_file_args|
+            path = Pathname.new(File.join(*eval_file_args.reverse)).
+                   cleanpath.to_path
+            fetch_file_from_host(path).tap { |f| f.support_file = true }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/elm/elm_package.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Elm
+      class ElmPackage < Dependabot::FileFetchers::Base
+        def self.required_files_in?(filenames)
+          return true if filenames.include?("elm-package.json")
+
+          filenames.include?("elm.json")
+        end
+
+        def self.required_files_message
+          "Repo must contain an elm-package.json or an elm.json"
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+
+          fetched_files << elm_package if elm_package
+          fetched_files << elm_json if elm_json
+
+          # Note: We *do not* fetch the exact-dependencies.json file, as it is
+          # recommended that this is not committed
+
+          check_required_files_present
+          fetched_files
+        end
+
+        def check_required_files_present
+          return if elm_package || elm_json
+
+          path = Pathname.new(File.join(directory, "elm.json")).
+                 cleanpath.to_path
+          raise Dependabot::DependencyFileNotFound, path
+        end
+
+        def elm_package
+          @elm_package ||= fetch_file_if_present("elm-package.json")
+        end
+
+        def elm_json
+          @elm_json ||= fetch_file_if_present("elm.json")
+        end
+      end
+    end
+  end
+end