dependabot-core 0.76.1

data/lib/dependabot/file_fetchers/git/submodules.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "parseconfig"
+require "dependabot/file_fetchers/base"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module FileFetchers
+    module Git
+      class Submodules < Dependabot::FileFetchers::Base
+        def self.required_files_in?(filenames)
+          filenames.include?(".gitmodules")
+        end
+
+        def self.required_files_message
+          "Repo must contain a .gitmodules file."
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+          fetched_files << gitmodules_file
+          fetched_files += submodule_refs
+          fetched_files
+        end
+
+        def gitmodules_file
+          @gitmodules_file ||= fetch_file_from_host(".gitmodules")
+        end
+
+        def submodule_refs
+          submodule_paths.
+            map { |path| fetch_submodule_ref_from_host(path) }.
+            tap { |refs| refs.each { |f| f.support_file = true } }
+        end
+
+        def submodule_paths
+          SharedHelpers.in_a_temporary_directory do
+            File.write(".gitmodules", gitmodules_file.content)
+            ParseConfig.new(".gitmodules").params.values.map { |p| p["path"] }
+          end
+        end
+
+        def fetch_submodule_ref_from_host(submodule_path)
+          path = Pathname.new(File.join(directory, submodule_path)).
+                 cleanpath.to_path.gsub(%r{^/*}, "")
+          sha =  case source.provider
+                 when "github"
+                   github_client_for_source.contents(
+                     repo,
+                     path: path,
+                     ref: commit
+                   ).sha
+                 when "gitlab"
+                   tmp_path = path.gsub(%r{^/*}, "")
+                   gitlab_client.get_file(repo, tmp_path, commit).blob_id
+                 else raise "Unsupported provider '#{source.provider}'."
+                 end
+
+          DependencyFile.new(
+            name: Pathname.new(submodule_path).cleanpath.to_path,
+            content: sha,
+            directory: directory,
+            type: "submodule"
+          )
+        rescue Octokit::NotFound, Gitlab::Error::NotFound
+          raise Dependabot::DependencyFileNotFound, path
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/go/dep.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Go
+      class Dep < Dependabot::FileFetchers::Base
+        def self.required_files_in?(filenames)
+          (%w(Gopkg.toml Gopkg.lock) - filenames).empty?
+        end
+
+        def self.required_files_message
+          "Repo must contain a Gopkg.toml and Gopkg.lock."
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+          fetched_files << manifest if manifest
+          fetched_files << lockfile if lockfile
+
+          unless manifest
+            raise(
+              Dependabot::DependencyFileNotFound,
+              File.join(directory, "Gopkg.toml")
+            )
+          end
+
+          unless lockfile
+            raise(
+              Dependabot::DependencyFileNotFound,
+              File.join(directory, "Gopkg.lock")
+            )
+          end
+
+          # Fetch the main.go file if present, as this will later identify
+          # this repo as an app.
+          fetched_files << main if main
+          fetched_files
+        end
+
+        def manifest
+          @manifest ||= fetch_file_if_present("Gopkg.toml")
+        end
+
+        def lockfile
+          @lockfile ||= fetch_file_if_present("Gopkg.lock")
+        end
+
+        def main
+          return @main if @main
+
+          go_files = repo_contents.select { |f| f.name.end_with?(".go") }
+
+          go_files.each do |go_file|
+            file = fetch_file_from_host(go_file.name, type: "package_main")
+            next unless file.content.match?(/\s*package\s+main/)
+
+            return @main = file.tap { |f| f.support_file = true }
+          end
+
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/go/modules.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Go
+      class Modules < Dependabot::FileFetchers::Base
+        def self.required_files_in?(filenames)
+          filenames.include?("go.mod")
+        end
+
+        def self.required_files_message
+          "Repo must contain a go.mod."
+        end
+
+        private
+
+        def fetch_files
+          unless go_mod
+            raise(
+              Dependabot::DependencyFileNotFound,
+              File.join(directory, "go.mod")
+            )
+          end
+
+          fetched_files = [go_mod]
+
+          # Fetch the (optional) go.sum
+          fetched_files << go_sum if go_sum
+
+          # Fetch the main.go file if present, as this will later identify
+          # this repo as an app.
+          fetched_files << main if main
+
+          fetched_files
+        end
+
+        def go_mod
+          @go_mod ||= fetch_file_if_present("go.mod")
+        end
+
+        def go_sum
+          @go_sum ||= fetch_file_if_present("go.sum")
+        end
+
+        def main
+          return @main if @main
+
+          go_files = repo_contents.select { |f| f.name.end_with?(".go") }
+
+          go_files.each do |go_file|
+            file = fetch_file_from_host(go_file.name, type: "package_main")
+            next unless file.content.match?(/\s*package\s+main/)
+
+            return @main = file.tap { |f| f.support_file = true }
+          end
+
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/java/gradle.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Java
+      class Gradle < Dependabot::FileFetchers::Base
+        require_relative "gradle/settings_file_parser"
+
+        def self.required_files_in?(filenames)
+          filenames.include?("build.gradle")
+        end
+
+        def self.required_files_message
+          "Repo must contain a build.gradle."
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+          fetched_files << buildfile
+          fetched_files += subproject_buildfiles
+          fetched_files
+        end
+
+        def buildfile
+          @buildfile ||= fetch_file_from_host("build.gradle")
+        end
+
+        def subproject_buildfiles
+          return [] unless settings_file
+
+          subproject_paths =
+            SettingsFileParser.
+            new(settings_file: settings_file).
+            subproject_paths
+
+          subproject_paths.map do |path|
+            fetch_file_from_host(File.join(path, "build.gradle"))
+          rescue Dependabot::DependencyFileNotFound
+            # Gradle itself doesn't worry about missing subprojects, so we don't
+            nil
+          end.compact
+        end
+
+        def settings_file
+          @settings_file ||= fetch_file_from_host("settings.gradle")
+        rescue Dependabot::DependencyFileNotFound
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/java/gradle/settings_file_parser.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "dependabot/file_fetchers/java/gradle"
+
+module Dependabot
+  module FileFetchers
+    module Java
+      class Gradle
+        class SettingsFileParser
+          INCLUDE_ARGS_REGEX =
+            /(?:^|\s)include(?:\(|\s)(\s*[^\s,\)]+(?:,\s*[^\s,\)]+)*)/.freeze
+
+          def initialize(settings_file:)
+            @settings_file = settings_file
+          end
+
+          def subproject_paths
+            subprojects = []
+
+            comment_free_content.scan(function_regex("include")) do
+              args = Regexp.last_match.named_captures.fetch("args")
+              args = args.split(",")
+              args = args.map { |p| p.gsub(/["']/, "").strip }.compact
+              subprojects += args
+            end
+
+            subprojects = subprojects.uniq
+
+            subproject_dirs = subprojects.map do |proj|
+              if comment_free_content.match?(project_dir_regex(proj))
+                comment_free_content.match(project_dir_regex(proj)).
+                  named_captures.fetch("path").sub(%r{^/}, "")
+              else
+                proj.tr(":", "/").sub(%r{^/}, "")
+              end
+            end
+
+            subproject_dirs.uniq
+          end
+
+          private
+
+          attr_reader :settings_file
+
+          def comment_free_content
+            settings_file.content.
+              gsub(%r{(?<=^|\s)//.*$}, "\n").
+              gsub(%r{(?<=^|\s)/\*.*?\*/}m, "")
+          end
+
+          def function_regex(function_name)
+            /
+              (?:^|\s)#{Regexp.quote(function_name)}(?:\(|\s)
+              (?<args>\s*[^\s,\)]+(?:,\s*[^\s,\)]+)*)
+            /mx
+          end
+
+          def project_dir_regex(proj)
+            prefixed_proj = Regexp.quote(":#{proj.gsub(/^:/, '')}")
+            /['"]#{prefixed_proj}['"].*dir\s*=.*['"](?<path>.*?)['"]/i
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_fetchers/java/maven.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/file_fetchers/base"
+
+module Dependabot
+  module FileFetchers
+    module Java
+      class Maven < Dependabot::FileFetchers::Base
+        MODULE_SELECTOR = "project > modules > module"
+
+        def self.required_files_in?(filenames)
+          (%w(pom.xml) - filenames).empty?
+        end
+
+        def self.required_files_message
+          "Repo must contain a pom.xml."
+        end
+
+        private
+
+        def fetch_files
+          fetched_files = []
+          fetched_files << pom
+          fetched_files += child_poms
+          fetched_files += relative_path_parents(fetched_files)
+          fetched_files.uniq
+        end
+
+        def pom
+          @pom ||= fetch_file_from_host("pom.xml")
+        end
+
+        def child_poms
+          recursively_fetch_child_poms(pom, fetched_filenames: ["pom.xml"])
+        end
+
+        def relative_path_parents(fetched_files)
+          fetched_files.flat_map do |file|
+            recursively_fetch_relative_path_parents(
+              file,
+              fetched_filenames: fetched_files.map(&:name)
+            )
+          end
+        end
+
+        def recursively_fetch_child_poms(pom, fetched_filenames:)
+          base_path = pom.name.gsub(/pom\.xml$/, "")
+          doc = Nokogiri::XML(pom.content)
+
+          doc.css(MODULE_SELECTOR).flat_map do |module_node|
+            relative_path = module_node.content.strip
+            name_parts = [
+              base_path,
+              relative_path,
+              relative_path.end_with?("pom.xml") ? nil : "pom.xml"
+            ].compact.reject(&:empty?)
+            path = Pathname.new(File.join(*name_parts)).cleanpath.to_path
+
+            next [] if fetched_filenames.include?(path)
+
+            child_pom = fetch_file_from_host(path)
+            fetched_filenames += [child_pom.name]
+            [
+              child_pom,
+              recursively_fetch_child_poms(
+                child_pom,
+                fetched_filenames: fetched_filenames
+              )
+            ].flatten
+          rescue Dependabot::DependencyFileNotFound
+            raise unless fetch_file_from_host_or_submodule(path)
+
+            [] # Ignore any child submodules (since we can't update them)
+          end
+        end
+
+        def recursively_fetch_relative_path_parents(pom, fetched_filenames:)
+          path = parent_path_for_pom(pom)
+
+          if fetched_filenames.include?(path) ||
+             fetched_filenames.include?(path.gsub("pom.xml", "pom_parent.xml"))
+            return []
+          end
+
+          full_path_parts =
+            [directory.gsub(%r{^/}, ""), path].reject(&:empty?).compact
+
+          full_path = Pathname.new(File.join(*full_path_parts)).
+                      cleanpath.to_path
+
+          return [] if full_path.start_with?("..")
+
+          parent_pom = fetch_file_from_host(path)
+          parent_pom.support_file = true
+          parent_pom.name = parent_pom.name.gsub("pom.xml", "pom_parent.xml")
+
+          [
+            parent_pom,
+            recursively_fetch_relative_path_parents(
+              parent_pom,
+              fetched_filenames: fetched_filenames + [parent_pom.name]
+            )
+          ].flatten
+        rescue Dependabot::DependencyFileNotFound
+          []
+        end
+
+        def parent_path_for_pom(pom)
+          doc = Nokogiri::XML(pom.content)
+          doc.remove_namespaces!
+
+          relative_parent_path =
+            doc.at_xpath("/project/parent/relativePath")&.content&.strip || ".."
+
+          name_parts = [
+            pom.name.gsub(/pom\.xml$/, "").gsub(/pom_parent\.xml$/, ""),
+            relative_parent_path,
+            relative_parent_path.end_with?("pom.xml") ? nil : "pom.xml"
+          ].compact.reject(&:empty?)
+
+          Pathname.new(File.join(*name_parts)).cleanpath.to_path
+        end
+      end
+    end
+  end
+end