dependabot-core 0.76.1

data/lib/dependabot/update_checkers/dotnet/nuget.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+require "dependabot/file_parsers/dotnet/nuget"
+require "dependabot/update_checkers/base"
+
+module Dependabot
+  module UpdateCheckers
+    module Dotnet
+      class Nuget < Dependabot::UpdateCheckers::Base
+        require_relative "nuget/version_finder"
+        require_relative "nuget/property_updater"
+        require_relative "nuget/requirements_updater"
+
+        def latest_version
+          @latest_version = latest_version_details&.fetch(:version)
+        end
+
+        def latest_resolvable_version
+          # TODO: Check version resolution!
+          return nil if version_comes_from_multi_dependency_property?
+
+          latest_version
+        end
+
+        def latest_resolvable_version_with_no_unlock
+          # Irrelevant, since Nuget has a single dependency file
+          nil
+        end
+
+        def updated_requirements
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            latest_version: latest_version&.to_s,
+            source_details: latest_version_details&.
+                            slice(:nuspec_url, :repo_url, :source_url)
+          ).updated_requirements
+        end
+
+        def up_to_date?
+          # If any requirements have an uninterpolated property in them then
+          # that property couldn't be found, and we assume that the dependency
+          # is up-to-date
+          return true unless requirements_unlocked_or_can_be?
+
+          super
+        end
+
+        def requirements_unlocked_or_can_be?
+          # If any requirements have an uninterpolated property in them then
+          # that property couldn't be found, and the requirement therefore
+          # cannot be unlocked (since we can't update that property)
+          namespace = FileParsers::Dotnet::Nuget::PropertyValueFinder
+          dependency.requirements.none? do |req|
+            req.fetch(:requirement)&.match?(namespace::PROPERTY_REGEX)
+          end
+        end
+
+        private
+
+        def latest_version_resolvable_with_full_unlock?
+          return false unless version_comes_from_multi_dependency_property?
+
+          property_updater.update_possible?
+        end
+
+        def updated_dependencies_after_full_unlock
+          property_updater.updated_dependencies
+        end
+
+        def latest_version_details
+          @latest_version_details ||= version_finder.latest_version_details
+        end
+
+        def version_finder
+          @version_finder ||=
+            VersionFinder.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              credentials: credentials,
+              ignored_versions: ignored_versions
+            )
+        end
+
+        def property_updater
+          @property_updater ||=
+            PropertyUpdater.new(
+              dependency: dependency,
+              dependency_files: dependency_files,
+              target_version_details: latest_version_details,
+              credentials: credentials,
+              ignored_versions: ignored_versions
+            )
+        end
+
+        def version_comes_from_multi_dependency_property?
+          declarations_using_a_property.any? do |requirement|
+            property_name = requirement.fetch(:metadata).fetch(:property_name)
+
+            all_property_based_dependencies.any? do |dep|
+              next false if dep.name == dependency.name
+
+              dep.requirements.any? do |req|
+                req.dig(:metadata, :property_name) == property_name
+              end
+            end
+          end
+        end
+
+        def declarations_using_a_property
+          @declarations_using_a_property ||=
+            dependency.requirements.
+            select { |req| req.dig(:metadata, :property_name) }
+        end
+
+        def all_property_based_dependencies
+          @all_property_based_dependencies ||=
+            FileParsers::Dotnet::Nuget.new(
+              dependency_files: dependency_files,
+              source: nil
+            ).parse.select do |dep|
+              dep.requirements.any? { |req| req.dig(:metadata, :property_name) }
+            end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/dotnet/nuget/property_updater.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require "dependabot/file_parsers/dotnet/nuget"
+require "dependabot/update_checkers/dotnet/nuget"
+
+module Dependabot
+  module UpdateCheckers
+    module Dotnet
+      class Nuget
+        class PropertyUpdater
+          require_relative "version_finder"
+          require_relative "requirements_updater"
+
+          def initialize(dependency:, dependency_files:, credentials:,
+                         target_version_details:, ignored_versions:)
+            @dependency       = dependency
+            @dependency_files = dependency_files
+            @credentials      = credentials
+            @ignored_versions = ignored_versions
+            @target_version   = target_version_details&.fetch(:version)
+            @source_details   = target_version_details&.
+                                slice(:nuspec_url, :repo_url, :source_url)
+          end
+
+          def update_possible?
+            return false unless target_version
+
+            @update_possible ||=
+              dependencies_using_property.all? do |dep|
+                versions = VersionFinder.new(
+                  dependency: dep,
+                  dependency_files: dependency_files,
+                  credentials: credentials,
+                  ignored_versions: ignored_versions
+                ).versions.map { |v| v.fetch(:version) }
+
+                versions.include?(target_version) || versions.none?
+              end
+          end
+
+          def updated_dependencies
+            raise "Update not possible!" unless update_possible?
+
+            @updated_dependencies ||=
+              dependencies_using_property.map do |dep|
+                Dependency.new(
+                  name: dep.name,
+                  version: target_version.to_s,
+                  requirements: updated_requirements(dep),
+                  previous_version: dep.version,
+                  previous_requirements: dep.requirements,
+                  package_manager: dep.package_manager
+                )
+              end
+          end
+
+          private
+
+          attr_reader :dependency, :dependency_files, :target_version,
+                      :source_details, :credentials, :ignored_versions
+
+          def dependencies_using_property
+            @dependencies_using_property ||=
+              FileParsers::Dotnet::Nuget.new(
+                dependency_files: dependency_files,
+                source: nil
+              ).parse.select do |dep|
+                dep.requirements.any? do |r|
+                  r.dig(:metadata, :property_name) == property_name
+                end
+              end
+          end
+
+          def property_name
+            @property_name ||= dependency.requirements.
+                               find { |r| r.dig(:metadata, :property_name) }&.
+                               dig(:metadata, :property_name)
+
+            raise "No requirement with a property name!" unless @property_name
+
+            @property_name
+          end
+
+          def updated_requirements(dep)
+            @updated_requirements ||= {}
+            @updated_requirements[dep.name] ||=
+              RequirementsUpdater.new(
+                requirements: dep.requirements,
+                latest_version: target_version,
+                source_details: source_details
+              ).updated_requirements
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/dotnet/nuget/repository_finder.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require "excon"
+require "nokogiri"
+require "dependabot/errors"
+require "dependabot/update_checkers/dotnet/nuget"
+require "dependabot/shared_helpers"
+
+module Dependabot
+  module UpdateCheckers
+    module Dotnet
+      class Nuget
+        class RepositoryFinder
+          DEFAULT_REPOSITORY_URL = "https://api.nuget.org/v3/index.json"
+
+          def initialize(dependency:, credentials:, config_file: nil)
+            @dependency  = dependency
+            @credentials = credentials
+            @config_file = config_file
+          end
+
+          def dependency_urls
+            find_dependency_urls
+          end
+
+          private
+
+          attr_reader :dependency, :credentials, :config_file
+
+          def find_dependency_urls
+            @find_dependency_urls ||=
+              known_repositories.flat_map do |details|
+                if details.fetch(:url) == DEFAULT_REPOSITORY_URL
+                  # Save a request for the default URL, since we already how
+                  # it addresses packages
+                  next default_repository_details
+                end
+
+                build_url_for_details(details)
+              end.compact.uniq
+          end
+
+          def build_url_for_details(repo_details)
+            response = get_repo_metadata(repo_details)
+            check_repo_reponse(response, repo_details)
+            return unless response.status == 200
+
+            base_url = base_url_from_v3_metadata(JSON.parse(response.body))
+            search_url = search_url_from_v3_metadata(JSON.parse(response.body))
+
+            details = {
+              repository_url: repo_details.fetch(:url),
+              auth_header: auth_header_for_token(repo_details.fetch(:token)),
+              repository_type: "v3"
+            }
+            if base_url
+              details[:versions_url] =
+                File.join(base_url, dependency.name.downcase, "index.json")
+            end
+            if search_url
+              details[:search_url] =
+                search_url + "?q=#{dependency.name.downcase}&prerelease=true"
+            end
+            details
+          rescue JSON::ParserError
+            build_v2_url(response, repo_details)
+          rescue Excon::Error::Timeout, Excon::Error::Socket
+            handle_timeout(repo_metadata_url: repo_details.fetch(:url))
+          end
+
+          def get_repo_metadata(repo_details)
+            Excon.get(
+              repo_details.fetch(:url),
+              headers: auth_header_for_token(repo_details.fetch(:token)),
+              idempotent: true,
+              **SharedHelpers.excon_defaults
+            )
+          end
+
+          def base_url_from_v3_metadata(metadata)
+            metadata.
+              fetch("resources", []).
+              find { |r| r.fetch("@type") == "PackageBaseAddress/3.0.0" }&.
+              fetch("@id")
+          end
+
+          def search_url_from_v3_metadata(metadata)
+            metadata.
+              fetch("resources", []).
+              find { |r| r.fetch("@type") == "SearchQueryService" }&.
+              fetch("@id")
+          end
+
+          def build_v2_url(response, repo_details)
+            doc = Nokogiri::XML(response.body)
+            doc.remove_namespaces!
+            base_url = doc.at_xpath("service")&.attributes&.fetch("base")&.value
+            return unless base_url
+
+            {
+              repository_url: base_url,
+              versions_url: File.join(
+                base_url,
+                "FindPackagesById()?id='#{dependency.name}'"
+              ),
+              auth_header: auth_header_for_token(repo_details.fetch(:token)),
+              repository_type: "v2"
+            }
+          end
+
+          def check_repo_reponse(response, details)
+            return unless [401, 402, 403].include?(response.status)
+            raise if details.fetch(:url) == DEFAULT_REPOSITORY_URL
+
+            raise PrivateSourceAuthenticationFailure, details.fetch(:url)
+          end
+
+          def handle_timeout(repo_metadata_url:)
+            raise if repo_metadata_url == DEFAULT_REPOSITORY_URL
+
+            raise PrivateSourceTimedOut, repo_metadata_url
+          end
+
+          def known_repositories
+            return @known_repositories if @known_repositories
+
+            @known_repositories = []
+            @known_repositories += credential_repositories
+            @known_repositories += config_file_repositories
+
+            if @known_repositories.empty?
+              @known_repositories << { url: DEFAULT_REPOSITORY_URL, token: nil }
+            end
+
+            @known_repositories.uniq
+          end
+
+          def credential_repositories
+            @credential_repositories ||=
+              credentials.
+              select { |cred| cred["type"] == "nuget_feed" }.
+              map { |c| { url: c.fetch("url"), token: c["token"] } }
+          end
+
+          def config_file_repositories
+            return [] unless config_file
+
+            doc = Nokogiri::XML(config_file.content)
+            doc.remove_namespaces!
+            sources =
+              doc.css("configuration > packageSources > add").map do |node|
+                {
+                  key:
+                    node.attribute("key")&.value&.strip ||
+                      node.at_xpath("./key")&.content&.strip,
+                  url:
+                    node.attribute("value")&.value&.strip ||
+                      node.at_xpath("./value")&.content&.strip
+                }
+              end
+
+            sources.reject! do |s|
+              known_urls = credential_repositories.map { |cr| cr.fetch(:url) }
+              known_urls.include?(s.fetch(:url))
+            end
+
+            add_config_file_credentials(sources: sources, doc: doc)
+            sources.each { |details| details.delete(:key) }
+
+            sources
+          end
+
+          def default_repository_details
+            {
+              repository_url: DEFAULT_REPOSITORY_URL,
+              versions_url: "https://api.nuget.org/v3-flatcontainer/"\
+                               "#{dependency.name.downcase}/index.json",
+              search_url: "https://api-v2v3search-0.nuget.org/query"\
+                               "?q=#{dependency.name.downcase}&prerelease=true",
+              auth_header: {},
+              repository_type: "v3"
+            }
+          end
+
+          def add_config_file_credentials(sources:, doc:)
+            sources.each do |source_details|
+              key = source_details.fetch(:key)
+              next source_details[:token] = nil unless key
+              next source_details[:token] = nil if key.match?(/^\d/)
+
+              tag = key.gsub(" ", "_x0020_")
+              creds_nodes = doc.css("configuration > packageSourceCredentials "\
+                                    "> #{tag} > add")
+
+              username =
+                creds_nodes.
+                find { |n| n.attribute("key")&.value == "Username" }&.
+                attribute("value")&.value
+              password =
+                creds_nodes.
+                find { |n| n.attribute("key")&.value == "ClearTextPassword" }&.
+                attribute("value")&.value
+
+              # Note: We have to look for plain text passwords, as we have no
+              # way of decrypting encrypted passwords. For the same reason we
+              # don't fetch API keys from the nuget.config at all.
+              next source_details[:token] = nil unless username && password
+
+              source_details[:token] = "#{username}:#{password}"
+            end
+
+            sources
+          end
+
+          def auth_header_for_token(token)
+            return {} unless token
+
+            if token.include?(":")
+              encoded_token = Base64.encode64(token).delete("\n")
+              { "Authorization" => "Basic #{encoded_token}" }
+            elsif Base64.decode64(token).ascii_only? &&
+                  Base64.decode64(token).include?(":")
+              { "Authorization" => "Basic #{token.delete("\n")}" }
+            else
+              { "Authorization" => "Bearer #{token}" }
+            end
+          end
+        end
+      end
+    end
+  end
+end