dependabot-core 0.76.1

data/lib/dependabot/metadata_finders/docker/docker.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+require "dependabot/metadata_finders/base"
+
+module Dependabot
+  module MetadataFinders
+    module Docker
+      class Docker < Dependabot::MetadataFinders::Base
+        private
+
+        def look_up_source
+          # TODO: Find a way to add links to PRs
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/metadata_finders/dotnet/nuget.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/metadata_finders/base"
+
+module Dependabot
+  module MetadataFinders
+    module Dotnet
+      class Nuget < Dependabot::MetadataFinders::Base
+        private
+
+        def look_up_source
+          return Source.from_url(dependency_source_url) if dependency_source_url
+
+          look_up_source_in_nuspec(dependency_nuspec_file)
+        end
+
+        def look_up_source_in_nuspec(nuspec)
+          potential_source_urls = [
+            nuspec.at_css("package > metadata > repository")&.
+              attribute("url")&.value,
+            nuspec.at_css("package > metadata > repository > url")&.content,
+            nuspec.at_css("package > metadata > projectUrl")&.content,
+            nuspec.at_css("package > metadata > licenseUrl")&.content
+          ].compact
+
+          source_url = potential_source_urls.find { |url| Source.from_url(url) }
+          source_url ||= source_from_anywhere_in_nuspec(nuspec)
+
+          Source.from_url(source_url)
+        end
+
+        def source_from_anywhere_in_nuspec(nuspec)
+          github_urls = []
+          nuspec.to_s.scan(Source::SOURCE_REGEX) do
+            github_urls << Regexp.last_match.to_s
+          end
+
+          github_urls.find do |url|
+            repo = Source.from_url(url).repo
+            repo.downcase.end_with?(dependency.name.downcase)
+          end
+        end
+
+        def dependency_nuspec_file
+          return @dependency_nuspec_file unless @dependency_nuspec_file.nil?
+
+          response = Excon.get(
+            dependency_nuspec_url,
+            headers: auth_header,
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+          @dependency_nuspec_file = Nokogiri::XML(response.body)
+        end
+
+        # rubocop:disable Metrics/AbcSize
+        def dependency_nuspec_url
+          source = dependency.requirements.
+                   find { |r| r&.fetch(:source) }&.fetch(:source)
+
+          if source&.key?(:nuspec_url)
+            source.fetch(:nuspec_url) ||
+              "https://api.nuget.org/v3-flatcontainer/"\
+              "#{dependency.name.downcase}/#{dependency.version}/"\
+              "#{dependency.name.downcase}.nuspec"
+          elsif source&.key?(:nuspec_url)
+            source.fetch("nuspec_url") ||
+              "https://api.nuget.org/v3-flatcontainer/"\
+              "#{dependency.name.downcase}/#{dependency.version}/"\
+              "#{dependency.name.downcase}.nuspec"
+          else
+            "https://api.nuget.org/v3-flatcontainer/"\
+            "#{dependency.name.downcase}/#{dependency.version}/"\
+            "#{dependency.name.downcase}.nuspec"
+          end
+        end
+        # rubocop:enable Metrics/AbcSize
+
+        def dependency_source_url
+          source = dependency.requirements.
+                   find { |r| r&.fetch(:source) }&.fetch(:source)
+
+          return unless source
+          return source.fetch(:source_url) if source.key?(:source_url)
+
+          source.fetch("source_url")
+        end
+
+        def auth_header
+          source = dependency.requirements.
+                   find { |r| r&.fetch(:source) }&.fetch(:source)
+          url = source&.fetch(:url, nil) || source&.fetch("url")
+
+          token = credentials.
+                  select { |cred| cred["type"] == "nuget_feed" }.
+                  find { |cred| cred["url"] == url }&.
+                  fetch("token", nil)
+
+          return {} unless token
+
+          if token.include?(":")
+            encoded_token = Base64.encode64(token).delete("\n")
+            { "Authorization" => "Basic #{encoded_token}" }
+          elsif Base64.decode64(token).ascii_only? &&
+                Base64.decode64(token).include?(":")
+            { "Authorization" => "Basic #{token.delete("\n")}" }
+          else
+            { "Authorization" => "Bearer #{token}" }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/metadata_finders/elixir/hex.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "excon"
+require "dependabot/metadata_finders/base"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module MetadataFinders
+    module Elixir
+      class Hex < Dependabot::MetadataFinders::Base
+        SOURCE_KEYS = %w(
+          GitHub Github github
+          GitLab Gitlab gitlab
+          BitBucket Bitbucket bitbucket
+          Source source
+        ).freeze
+
+        private
+
+        def look_up_source
+          case new_source_type
+          when "default" then find_source_from_hex_listing
+          when "git" then find_source_from_git_url
+          else raise "Unexpected source type: #{new_source_type}"
+          end
+        end
+
+        def new_source_type
+          sources =
+            dependency.requirements.map { |r| r.fetch(:source) }.uniq.compact
+
+          return "default" if sources.empty?
+          raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
+
+          sources.first[:type] || sources.first.fetch("type")
+        end
+
+        def find_source_from_hex_listing
+          potential_source_urls =
+            SOURCE_KEYS.
+            map { |key| hex_listing.dig("meta", "links", key) }.
+            compact
+
+          source_url = potential_source_urls.find { |url| Source.from_url(url) }
+          Source.from_url(source_url)
+        end
+
+        def find_source_from_git_url
+          info = dependency.requirements.map { |r| r[:source] }.compact.first
+
+          url = info[:url] || info.fetch("url")
+          Source.from_url(url)
+        end
+
+        def hex_listing
+          return @hex_listing unless @hex_listing.nil?
+
+          response = Excon.get(
+            "https://hex.pm/api/packages/#{dependency.name}",
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+          @hex_listing = JSON.parse(response.body)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/metadata_finders/elm/elm_package.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require "dependabot/metadata_finders/base"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module MetadataFinders
+    module Elm
+      class ElmPackage < Dependabot::MetadataFinders::Base
+        private
+
+        def look_up_source
+          # For Elm 0.18 an elm-package is guaranteed to be `owner/name`
+          # on github. For 0.19 a lot will change, including the name of
+          # the dependency file, so I won't try to build something more
+          # sophisticated here for now.
+          Source.from_url("https://github.com/" + dependency.name)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/metadata_finders/git/submodules.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require "dependabot/metadata_finders/base"
+
+module Dependabot
+  module MetadataFinders
+    module Git
+      class Submodules < Dependabot::MetadataFinders::Base
+        private
+
+        def look_up_source
+          url = dependency.requirements.first.fetch(:source)[:url] ||
+                dependency.requirements.first.fetch(:source).fetch("url")
+
+          Source.from_url(url)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/metadata_finders/go/dep.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "dependabot/metadata_finders/base"
+require "dependabot/utils/go/path_converter"
+
+module Dependabot
+  module MetadataFinders
+    module Go
+      class Dep < Dependabot::MetadataFinders::Base
+        private
+
+        def look_up_source
+          return look_up_git_dependency_source if git_dependency?
+
+          path_str = (specified_source_string || dependency.name)
+          url = Dependabot::Utils::Go::PathConverter.
+                git_url_for_path_without_go_helper(path_str)
+          Source.from_url(url) if url
+        end
+
+        def git_dependency?
+          return false unless declared_source_details
+
+          dependency_type =
+            declared_source_details.fetch(:type, nil) ||
+            declared_source_details.fetch("type")
+
+          dependency_type == "git"
+        end
+
+        def look_up_git_dependency_source
+          specified_url =
+            declared_source_details.fetch(:url, nil) ||
+            declared_source_details.fetch("url")
+
+          Source.from_url(specified_url)
+        end
+
+        def specified_source_string
+          declared_source_details&.fetch(:source, nil) ||
+            declared_source_details&.fetch("source", nil)
+        end
+
+        def declared_source_details
+          sources = dependency.requirements.
+                    map { |r| r.fetch(:source) }.
+                    uniq.compact
+
+          raise "Multiple sources! #{sources.join(', ')}" if sources.count > 1
+
+          sources.first
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/metadata_finders/java/maven.rb

@@ -0,0 +1,173 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/metadata_finders/base"
+require "dependabot/file_fetchers/base"
+require "dependabot/file_parsers/java/maven"
+require "dependabot/file_parsers/java/maven/repositories_finder"
+
+module Dependabot
+  module MetadataFinders
+    module Java
+      class Maven < Dependabot::MetadataFinders::Base
+        DOT_SEPARATOR_REGEX = %r{\.(?:(?!\d+[.\/])+)}.freeze
+
+        private
+
+        def look_up_source
+          tmp_source = look_up_source_in_pom(dependency_pom_file)
+          return tmp_source if tmp_source
+
+          return unless (parent = parent_pom_file(dependency_pom_file))
+
+          tmp_source = look_up_source_in_pom(parent)
+          return unless tmp_source
+
+          artifact = dependency.name.split(":").last
+          return tmp_source if tmp_source.repo.end_with?(artifact)
+          return tmp_source if repo_has_subdir_for_dep?(tmp_source)
+        end
+
+        def repo_has_subdir_for_dep?(tmp_source)
+          @repo_has_subdir_for_dep ||= {}
+          if @repo_has_subdir_for_dep.key?(tmp_source)
+            return @repo_has_subdir_for_dep[tmp_source]
+          end
+
+          artifact = dependency.name.split(":").last
+          fetcher =
+            FileFetchers::Base.new(source: tmp_source, credentials: credentials)
+
+          @repo_has_subdir_for_dep[tmp_source] =
+            fetcher.send(:repo_contents, raise_errors: false).
+            select { |f| f.type == "dir" }.
+            any? { |f| artifact.end_with?(f.name) }
+        rescue Dependabot::RepoNotFound
+          @repo_has_subdir_for_dep[tmp_source] = false
+        end
+
+        def look_up_source_in_pom(pom)
+          potential_source_urls = [
+            pom.at_css("project > url")&.content,
+            pom.at_css("project > scm > url")&.content,
+            pom.at_css("project > issueManagement > url")&.content
+          ].compact
+
+          source_url = potential_source_urls.find { |url| Source.from_url(url) }
+          source_url ||= source_from_anywhere_in_pom(pom)
+          source_url = substitute_property_in_source_url(source_url, pom)
+
+          Source.from_url(source_url)
+        end
+
+        def substitute_property_in_source_url(source_url, pom)
+          return unless source_url
+          return source_url unless source_url.include?("${")
+
+          regex = FileParsers::Java::Maven::PROPERTY_REGEX
+          property_name = source_url.match(regex).named_captures["property"]
+          doc = pom.dup
+          doc.remove_namespaces!
+          nm = property_name.sub(/^pom\./, "").sub(/^project\./, "")
+          property_value =
+            loop do
+              candidate_node =
+                doc.at_xpath("/project/#{nm}") ||
+                doc.at_xpath("/project/properties/#{nm}") ||
+                doc.at_xpath("/project/profiles/profile/properties/#{nm}")
+              break candidate_node.content if candidate_node
+              break unless nm.match?(DOT_SEPARATOR_REGEX)
+
+              nm = nm.sub(DOT_SEPARATOR_REGEX, "/")
+            end
+
+          source_url.gsub("${#{property_name}}", property_value)
+        end
+
+        def source_from_anywhere_in_pom(pom)
+          github_urls = []
+          pom.to_s.scan(Source::SOURCE_REGEX) do
+            github_urls << Regexp.last_match.to_s
+          end
+
+          github_urls.find do |url|
+            repo = Source.from_url(url).repo
+            repo.end_with?(dependency.name.split(":").last)
+          end
+        end
+
+        def dependency_pom_file
+          return @dependency_pom_file unless @dependency_pom_file.nil?
+
+          artifact_id = dependency.name.split(":").last
+          response = Excon.get(
+            "#{maven_repo_dependency_url}/"\
+            "#{dependency.version}/"\
+            "#{artifact_id}-#{dependency.version}.pom",
+            headers: auth_details,
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+          @dependency_pom_file = Nokogiri::XML(response.body)
+        rescue Excon::Error::Timeout
+          @dependency_pom_file = Nokogiri::XML("")
+        end
+
+        def parent_pom_file(pom)
+          doc = pom.dup
+          doc.remove_namespaces!
+          group_id = doc.at_xpath("/project/parent/groupId")&.content&.strip
+          artifact_id =
+            doc.at_xpath("/project/parent/artifactId")&.content&.strip
+          version = doc.at_xpath("/project/parent/version")&.content&.strip
+
+          return unless artifact_id && group_id && version
+
+          response = Excon.get(
+            "#{maven_repo_url}/#{group_id.tr('.', '/')}/#{artifact_id}/"\
+            "#{version}/"\
+            "#{artifact_id}-#{version}.pom",
+            headers: auth_details,
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+          Nokogiri::XML(response.body)
+        end
+
+        def maven_repo_url
+          source = dependency.requirements.
+                   find { |r| r&.fetch(:source) }&.fetch(:source)
+
+          source&.fetch(:url, nil) ||
+            source&.fetch("url") ||
+            FileParsers::Java::Maven::RepositoriesFinder::CENTRAL_REPO_URL
+        end
+
+        def maven_repo_dependency_url
+          group_id, artifact_id = dependency.name.split(":")
+
+          "#{maven_repo_url}/#{group_id.tr('.', '/')}/#{artifact_id}"
+        end
+
+        def auth_details
+          cred =
+            credentials.select { |c| c["type"] == "maven_repository" }.
+            find do |c|
+              cred_url = c.fetch("url").gsub(%r{/+$}, "")
+              next false unless cred_url == maven_repo_url
+
+              c.fetch("username", nil)
+            end
+
+          return {} unless cred
+
+          token = cred.fetch("username") + ":" + cred.fetch("password")
+          encoded_token = Base64.encode64(token).delete("\n")
+          { "Authorization" => "Basic #{encoded_token}" }
+        end
+      end
+    end
+  end
+end