dependabot-core 0.76.1

data/lib/dependabot/file_updaters/ruby/bundler/requirement_replacer.rb

@@ -0,0 +1,188 @@
+# frozen_string_literal: true
+
+require "parser/current"
+require "dependabot/file_updaters/ruby/bundler"
+
+module Dependabot
+  module FileUpdaters
+    module Ruby
+      class Bundler
+        class RequirementReplacer
+          attr_reader :dependency, :file_type, :updated_requirement,
+                      :previous_requirement
+
+          def initialize(dependency:, file_type:, updated_requirement:,
+                         previous_requirement: nil, insert_if_bare: false)
+            @dependency           = dependency
+            @file_type            = file_type
+            @updated_requirement  = updated_requirement
+            @previous_requirement = previous_requirement
+            @insert_if_bare       = insert_if_bare
+          end
+
+          def rewrite(content)
+            buffer = Parser::Source::Buffer.new("(gemfile_content)")
+            buffer.source = content
+            ast = Parser::CurrentRuby.new.parse(buffer)
+
+            updated_content = Rewriter.new(
+              dependency: dependency,
+              file_type: file_type,
+              updated_requirement: updated_requirement,
+              insert_if_bare: insert_if_bare?
+            ).rewrite(buffer, ast)
+
+            update_comment_spacing_if_required(content, updated_content)
+          end
+
+          private
+
+          def insert_if_bare?
+            @insert_if_bare
+          end
+
+          def update_comment_spacing_if_required(content, updated_content)
+            return updated_content unless previous_requirement
+
+            return updated_content if updated_content == content
+            return updated_content if length_change.zero?
+
+            updated_lines = updated_content.lines
+            updated_line_index =
+              updated_lines.length.
+              times.find { |i| content.lines[i] != updated_content.lines[i] }
+            updated_line = updated_lines[updated_line_index]
+
+            updated_line =
+              if length_change.positive?
+                updated_line.sub(/(?<=\s)\s{#{length_change}}#/, "#")
+              elsif length_change.negative?
+                updated_line.sub(/(?<=\s{2})#/, " " * length_change.abs + "#")
+              end
+
+            updated_lines[updated_line_index] = updated_line
+            updated_lines.join
+          end
+
+          def length_change
+            unless previous_requirement.start_with?("=")
+              return updated_requirement.length - previous_requirement.length
+            end
+
+            updated_requirement.length -
+              previous_requirement.gsub(/^=/, "").strip.length
+          end
+
+          class Rewriter < Parser::TreeRewriter
+            # TODO: Ideally we wouldn't have to ignore all of these, but
+            # implementing each one will be tricky.
+            SKIPPED_TYPES = %i(send lvar dstr begin if splat const).freeze
+
+            def initialize(dependency:, file_type:, updated_requirement:,
+                           insert_if_bare:)
+              @dependency          = dependency
+              @file_type           = file_type
+              @updated_requirement = updated_requirement
+              @insert_if_bare      = insert_if_bare
+
+              return if %i(gemfile gemspec).include?(file_type)
+
+              raise "File type must be :gemfile or :gemspec. Got #{file_type}."
+            end
+
+            def on_send(node)
+              return unless declares_targeted_gem?(node)
+
+              req_nodes = node.children[3..-1]
+              req_nodes = req_nodes.reject { |child| child.type == :hash }
+
+              return if req_nodes.none? && !insert_if_bare?
+              return if req_nodes.any? { |n| SKIPPED_TYPES.include?(n.type) }
+
+              quote_characters = extract_quote_characters_from(req_nodes)
+              space_after_specifier = space_after_specifier?(req_nodes)
+
+              new_req =
+                new_requirement_string(quote_characters, space_after_specifier)
+              if req_nodes.any?
+                replace(range_for(req_nodes), new_req)
+              else
+                insert_after(range_for(node.children[2..2]), ", #{new_req}")
+              end
+            end
+
+            private
+
+            attr_reader :dependency, :file_type, :updated_requirement
+
+            def insert_if_bare?
+              @insert_if_bare
+            end
+
+            def declaration_methods
+              return %i(gem) if file_type == :gemfile
+
+              %i(add_dependency add_runtime_dependency
+                 add_development_dependency)
+            end
+
+            def declares_targeted_gem?(node)
+              return false unless declaration_methods.include?(node.children[1])
+
+              node.children[2].children.first == dependency.name
+            end
+
+            def extract_quote_characters_from(requirement_nodes)
+              return ['"', '"'] if requirement_nodes.none?
+
+              case requirement_nodes.first.type
+              when :str, :dstr
+                [
+                  requirement_nodes.first.loc.begin.source,
+                  requirement_nodes.first.loc.end.source
+                ]
+              else
+                [
+                  requirement_nodes.first.children.first.loc.begin.source,
+                  requirement_nodes.first.children.first.loc.end.source
+                ]
+              end
+            end
+
+            def space_after_specifier?(requirement_nodes)
+              return true if requirement_nodes.none?
+
+              req_string =
+                case requirement_nodes.first.type
+                when :str, :dstr
+                  requirement_nodes.first.loc.expression.source
+                else
+                  requirement_nodes.first.children.first.loc.expression.source
+                end
+
+              ops = Gem::Requirement::OPS.keys
+              return true if ops.none? { |op| req_string.include?(op) }
+
+              req_string.include?(" ")
+            end
+
+            def new_requirement_string(quote_characters, space_after_specifier)
+              open_quote, close_quote = quote_characters
+              new_requirement_string =
+                updated_requirement.split(",").
+                map { |r| %(#{open_quote}#{r.strip}#{close_quote}) }.
+                join(", ")
+
+              new_requirement_string.delete!(" ") unless space_after_specifier
+              new_requirement_string
+            end
+
+            def range_for(nodes)
+              nodes.first.loc.begin.begin.join(nodes.last.loc.expression)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/rust/cargo.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "toml-rb"
+require "dependabot/git_commit_checker"
+require "dependabot/file_updaters/base"
+require "dependabot/file_parsers/rust/cargo"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module FileUpdaters
+    module Rust
+      class Cargo < Dependabot::FileUpdaters::Base
+        require_relative "cargo/manifest_updater"
+        require_relative "cargo/lockfile_updater"
+
+        def self.updated_files_regex
+          [
+            /^Cargo\.toml$/,
+            /^Cargo\.lock$/
+          ]
+        end
+
+        def updated_dependency_files
+          # Returns an array of updated files. Only files that have been updated
+          # should be returned.
+          updated_files = []
+
+          manifest_files.each do |file|
+            next unless file_changed?(file)
+
+            updated_files <<
+              updated_file(
+                file: file,
+                content: updated_manifest_content(file)
+              )
+          end
+
+          if lockfile && updated_lockfile_content != lockfile.content
+            updated_files <<
+              updated_file(file: lockfile, content: updated_lockfile_content)
+          end
+
+          raise "No files changed!" if updated_files.empty?
+
+          updated_files
+        end
+
+        private
+
+        def check_required_files
+          raise "No Cargo.toml!" unless get_original_file("Cargo.toml")
+        end
+
+        def updated_manifest_content(file)
+          ManifestUpdater.new(
+            dependencies: dependencies,
+            manifest: file
+          ).updated_manifest_content
+        end
+
+        def updated_lockfile_content
+          @updated_lockfile_content ||=
+            LockfileUpdater.new(
+              dependencies: dependencies,
+              dependency_files: dependency_files,
+              credentials: credentials
+            ).updated_lockfile_content
+        end
+
+        def manifest_files
+          @manifest_files ||=
+            dependency_files.
+            select { |f| f.name.end_with?("Cargo.toml") }.
+            reject { |f| f.type == "path_dependency" }
+        end
+
+        def lockfile
+          @lockfile ||= get_original_file("Cargo.lock")
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/file_updaters/rust/cargo/lockfile_updater.rb

@@ -0,0 +1,251 @@
+# frozen_string_literal: true
+
+require "toml-rb"
+require "dependabot/git_commit_checker"
+require "dependabot/file_updaters/rust/cargo"
+require "dependabot/file_updaters/rust/cargo/manifest_updater"
+require "dependabot/file_parsers/rust/cargo"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module FileUpdaters
+    module Rust
+      class Cargo
+        class LockfileUpdater
+          def initialize(dependencies:, dependency_files:, credentials:)
+            @dependencies = dependencies
+            @dependency_files = dependency_files
+            @credentials = credentials
+          end
+
+          def updated_lockfile_content
+            base_directory = dependency_files.first.directory
+            SharedHelpers.in_a_temporary_directory(base_directory) do
+              write_temporary_dependency_files
+
+              SharedHelpers.with_git_configured(credentials: credentials) do
+                # Shell out to Cargo, which handles everything for us, and does
+                # so without doing an install (so it's fast).
+                command = "cargo update -p #{dependency_spec}"
+                run_shell_command(command)
+              end
+
+              updated_lockfile = File.read("Cargo.lock")
+              updated_lockfile = post_process_lockfile(updated_lockfile)
+
+              if updated_lockfile.include?(desired_lockfile_content)
+                next updated_lockfile
+              end
+
+              raise "Failed to update #{dependency.name}!"
+            end
+          rescue Dependabot::SharedHelpers::HelperSubprocessFailed => error
+            handle_cargo_error(error)
+          end
+
+          private
+
+          attr_reader :dependencies, :dependency_files, :credentials
+
+          # Currently, there will only be a single updated dependency
+          def dependency
+            dependencies.first
+          end
+
+          def handle_cargo_error(error)
+            raise unless error.message.include?("no matching version")
+            raise if error.message.include?("`#{dependency.name}`")
+
+            raise Dependabot::DependencyFileNotResolvable, error.message
+          end
+
+          def dependency_spec
+            spec = dependency.name
+
+            if git_dependency?
+              spec += ":#{git_previous_version}" if git_previous_version
+            elsif dependency.previous_version
+              spec += ":#{dependency.previous_version}"
+            end
+
+            spec
+          end
+
+          def git_previous_version
+            TomlRB.parse(lockfile.content).
+              fetch("package", []).
+              select { |p| p["name"] == dependency.name }.
+              find { |p| p["source"].end_with?(dependency.previous_version) }.
+              fetch("version")
+          end
+
+          def desired_lockfile_content
+            return dependency.version if git_dependency?
+
+            %(name = "#{dependency.name}"\nversion = "#{dependency.version}")
+          end
+
+          def run_shell_command(command)
+            raw_response = nil
+            IO.popen(command, err: %i(child out)) do |process|
+              raw_response = process.read
+            end
+
+            # Raise an error with the output from the shell session if Cargo
+            # returns a non-zero status
+            return if $CHILD_STATUS.success?
+
+            raise SharedHelpers::HelperSubprocessFailed.new(
+              raw_response,
+              command
+            )
+          end
+
+          def write_temporary_dependency_files
+            write_temporary_manifest_files
+            write_temporary_path_dependency_files
+
+            File.write(lockfile.name, lockfile.content)
+            File.write(toolchain.name, toolchain.content) if toolchain
+          end
+
+          def write_temporary_manifest_files
+            manifest_files.each do |file|
+              path = file.name
+              dir = Pathname.new(path).dirname
+              FileUtils.mkdir_p(Pathname.new(path).dirname)
+              File.write(file.name, prepared_manifest_content(file))
+
+              FileUtils.mkdir_p(File.join(dir, "src"))
+              File.write(File.join(dir, "src/lib.rs"), dummy_app_content)
+              File.write(File.join(dir, "src/main.rs"), dummy_app_content)
+            end
+          end
+
+          def write_temporary_path_dependency_files
+            path_dependency_files.each do |file|
+              path = file.name
+              dir = Pathname.new(path).dirname
+              FileUtils.mkdir_p(Pathname.new(path).dirname)
+              File.write(file.name, prepared_path_dependency_content(file))
+
+              FileUtils.mkdir_p(File.join(dir, "src"))
+              File.write(File.join(dir, "src/lib.rs"), dummy_app_content)
+              File.write(File.join(dir, "src/main.rs"), dummy_app_content)
+            end
+          end
+
+          def prepared_manifest_content(file)
+            content = updated_manifest_content(file)
+            content = pin_version(content) unless git_dependency?
+            content = replace_ssh_urls(content)
+            content
+          end
+
+          def prepared_path_dependency_content(file)
+            content = file.content.dup
+            content = replace_ssh_urls(content)
+            content
+          end
+
+          def updated_manifest_content(file)
+            ManifestUpdater.new(
+              dependencies: dependencies,
+              manifest: file
+            ).updated_manifest_content
+          end
+
+          def pin_version(content)
+            parsed_manifest = TomlRB.parse(content)
+
+            FileParsers::Rust::Cargo::DEPENDENCY_TYPES.each do |type|
+              next unless (req = parsed_manifest.dig(type, dependency.name))
+
+              updated_req = "=#{dependency.version}"
+
+              if req.is_a?(Hash)
+                parsed_manifest[type][dependency.name]["version"] = updated_req
+              else
+                parsed_manifest[type][dependency.name] = updated_req
+              end
+            end
+
+            TomlRB.dump(parsed_manifest)
+          end
+
+          def replace_ssh_urls(content)
+            git_ssh_requirements_to_swap.each do |ssh_url, https_url|
+              content = content.gsub(ssh_url, https_url)
+            end
+            content
+          end
+
+          def post_process_lockfile(content)
+            git_ssh_requirements_to_swap.each do |ssh_url, https_url|
+              content = content.gsub(https_url, ssh_url)
+            end
+
+            content
+          end
+
+          def git_ssh_requirements_to_swap
+            if @git_ssh_requirements_to_swap
+              return @git_ssh_requirements_to_swap
+            end
+
+            @git_ssh_requirements_to_swap = {}
+
+            [*manifest_files, *path_dependency_files].each do |manifest|
+              parsed_manifest = TomlRB.parse(manifest.content)
+
+              FileParsers::Rust::Cargo::DEPENDENCY_TYPES.each do |type|
+                (parsed_manifest[type] || {}).each do |_, details|
+                  next unless details.is_a?(Hash)
+                  next unless details["git"]&.match?(%r{ssh://git@(.*?)/})
+
+                  @git_ssh_requirements_to_swap[details["git"]] =
+                    details["git"].gsub(%r{ssh://git@(.*?)/}, 'https://\1/')
+                end
+              end
+            end
+
+            @git_ssh_requirements_to_swap
+          end
+
+          def dummy_app_content
+            %{fn main() {\nprintln!("Hello, world!");\n}}
+          end
+
+          def git_dependency?
+            GitCommitChecker.new(
+              dependency: dependency,
+              credentials: credentials
+            ).git_dependency?
+          end
+
+          def manifest_files
+            @manifest_files ||=
+              dependency_files.
+              select { |f| f.name.end_with?("Cargo.toml") }.
+              reject { |f| f.type == "path_dependency" }
+          end
+
+          def path_dependency_files
+            @path_dependency_files ||=
+              dependency_files.
+              select { |f| f.type == "path_dependency" }
+          end
+
+          def lockfile
+            @lockfile ||= dependency_files.find { |f| f.name == "Cargo.lock" }
+          end
+
+          def toolchain
+            @toolchain ||=
+              dependency_files.find { |f| f.name == "rust-toolchain" }
+          end
+        end
+      end
+    end
+  end
+end