dependabot-core 0.76.1

data/helpers/php/setup.sh

@@ -0,0 +1,4 @@
+php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
+php -r "if (hash_file('SHA384', 'composer-setup.php') === '544e09ee996cdf60ece3804abc52599c22b1f40f4323403c44d44fdfdd586475ca9813a858088ffbc1f233e9b180f061') { echo 'Installer verified'; } else { echo hash_file('SHA384', 'composer-setup.php'); unlink('composer-setup.php'); } echo PHP_EOL;"
+php composer-setup.php
+php -r "unlink('composer-setup.php');"

data/helpers/php/src/DependabotInstallationManager.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Dependabot\PHP;
+
+use Composer\DependencyResolver\Operation\InstallOperation;
+use Composer\DependencyResolver\Operation\UninstallOperation;
+use Composer\DependencyResolver\Operation\UpdateOperation;
+use Composer\Installer\InstallationManager;
+use Composer\Package\PackageInterface;
+use Composer\Repository\RepositoryInterface;
+
+class DependabotInstallationManager extends InstallationManager
+{
+    private $installed = [];
+    private $updated = [];
+    private $uninstalled = [];
+
+    public function install(RepositoryInterface $repo, InstallOperation $operation): void
+    {
+        parent::install($repo, $operation);
+        $this->installed[] = $operation->getPackage();
+    }
+
+    public function update(RepositoryInterface $repo, UpdateOperation $operation): void
+    {
+        parent::update($repo, $operation);
+        $this->updated[] = [$operation->getInitialPackage(), $operation->getTargetPackage()];
+    }
+
+    public function uninstall(RepositoryInterface $repo, UninstallOperation $operation): void
+    {
+        parent::uninstall($repo, $operation);
+        $this->uninstalled[] = $operation->getPackage();
+    }
+
+    /**
+     * @return PackageInterface[]
+     */
+    public function getInstalledPackages(): array
+    {
+        return $this->installed;
+    }
+
+    /**
+     * @return PackageInterface[]
+     */
+    public function getUpdatedPackages(): array
+    {
+        return $this->updated;
+    }
+
+    /**
+     * @return PackageInterface[]
+     */
+    public function getUninstalledPackages(): array
+    {
+        return $this->uninstalled;
+    }
+}

data/helpers/php/src/DependabotPluginManager.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Dependabot\PHP;
+
+use Composer\Package\PackageInterface;
+use Composer\Plugin\PluginManager;
+
+class DependabotPluginManager extends PluginManager
+{
+    public function registerPackage(PackageInterface $package, $failOnMissingClasses = false): void
+    {
+        // This package does some setup for PHP_CodeSniffer, but errors out the
+        // install if Symfony isn't installed (which it won't be for a lockfile
+        // only install run). Safe to ignore
+        if (strpos($package->getName(), 'phpcodesniffer') !== false) {
+            return;
+        }
+
+        parent::registerPackage($package, $failOnMissingClasses);
+    }
+}

data/helpers/php/src/ExceptionIO.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Dependabot\PHP;
+
+use Composer\IO\NullIO;
+
+class ExceptionIO extends NullIO
+{
+    private $raise_next_error = false;
+
+    public function writeError($messages, $newline = true, $verbosity = self::NORMAL): void
+    {
+        if (is_array($messages)) {
+            return;
+        }
+        if ($this->raise_next_error) {
+            throw new \RuntimeException('Your requirements could not be resolved to an installable set of packages.' . $messages);
+        }
+        if (strpos($messages, 'Your requirements could not be resolved') !== false) {
+            $this->raise_next_error = true;
+        }
+    }
+}

data/helpers/php/src/Hasher.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Dependabot\PHP;
+
+use Composer\Factory;
+
+class Hasher
+{
+    public static function getContentHash(array $args): ?string
+    {
+        [$workingDirectory] = $args;
+
+        $io = new ExceptionIO();
+        $composer = Factory::create($io, $workingDirectory . '/composer.json');
+        $locker = $composer->getLocker();
+
+        return $locker->getContentHash(file_get_contents(Factory::getComposerFile()));
+    }
+}

data/helpers/php/src/UpdateChecker.php

@@ -0,0 +1,123 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Dependabot\PHP;
+
+use Composer\Factory;
+use Composer\Installer;
+use Composer\Package\PackageInterface;
+
+class UpdateChecker
+{
+    public static function getLatestResolvableVersion(array $args): ?string
+    {
+        [$workingDirectory, $dependencyName, $gitCredentials, $registryCredentials] = $args;
+
+        $io = new ExceptionIO();
+        $composer = Factory::create($io, $workingDirectory . '/composer.json');
+        $config = $composer->getConfig();
+        $httpBasicCredentials = [];
+
+        foreach ($gitCredentials as &$cred) {
+            $httpBasicCredentials[$cred['host']] = [
+                'username' => $cred['username'],
+                'password' => $cred['password'],
+            ];
+        }
+
+        foreach ($registryCredentials as &$cred) {
+            $httpBasicCredentials[$cred['registry']] = [
+                'username' => $cred['username'],
+                'password' => $cred['password'],
+            ];
+        }
+
+        if ($httpBasicCredentials) {
+            $config->merge(
+                [
+                    'config' => [
+                        'http-basic' => $httpBasicCredentials,
+                    ],
+                ]
+            );
+            $io->loadConfiguration($config);
+        }
+
+        $installationManager = new DependabotInstallationManager();
+        $install = new Installer(
+            $io,
+            $config,
+            $composer->getPackage(),
+            $composer->getDownloadManager(),
+            $composer->getRepositoryManager(),
+            $composer->getLocker(),
+            $installationManager,
+            $composer->getEventDispatcher(),
+            $composer->getAutoloadGenerator()
+        );
+
+        // For all potential options, see UpdateCommand in composer
+        $install
+            ->setDryRun(true)
+            ->setUpdate(true)
+            ->setDevMode(true)
+            ->setUpdateWhitelist([$dependencyName])
+            ->setWhitelistTransitiveDependencies(true)
+            ->setExecuteOperations(false)
+            ->setDumpAutoloader(false)
+            ->setRunScripts(false);
+
+        /*
+         * If a platform is set we assume people know what they are doing and we respect the setting.
+         * If no platform is set we ignore it so that the php we run as doesn't interfere
+         */
+        if ($config->get('platform') === []) {
+            $install->setIgnorePlatformRequirements(true);
+        }
+
+        $install->run();
+
+        $installedPackages = $installationManager->getInstalledPackages();
+
+        $updatedPackage = current(array_filter($installedPackages, function (PackageInterface $package) use ($dependencyName) {
+            return $package->getName() == $dependencyName;
+        }));
+
+        // We found the package in the list of updated packages. Return its version.
+        if ($updatedPackage) {
+            return preg_replace('/^([v])/', '', $updatedPackage->getPrettyVersion());
+        }
+
+        // We didn't find the package in the list of updated packages. Check if
+        // it was replaced by another package (in which case we can ignore).
+        foreach ($composer->getPackage()->getReplaces() as $link) {
+            if ($link->getTarget() == $dependencyName) {
+                return null;
+            }
+        }
+        foreach ($installedPackages as $package) {
+            foreach ($package->getReplaces() as $link) {
+                if ($link->getTarget() == $dependencyName) {
+                    return null;
+                }
+            }
+        }
+
+        // Similarly, check if the package was provided by any other package.
+        foreach ($composer->getPackage()->getProvides() as $link) {
+            if ($link->getTarget() == $dependencyName) {
+                return preg_replace('/^([v])/', '', $link->getPrettyConstraint());
+            }
+        }
+        foreach ($installedPackages as $package) {
+            foreach ($package->getProvides() as $link) {
+                if ($link->getTarget() == $dependencyName) {
+                    return preg_replace('/^([v])/', '', $link->getPrettyConstraint());
+                }
+            }
+        }
+
+        throw new \RuntimeException('Package not found in updated packages!');
+    }
+}

data/helpers/php/src/Updater.php

@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Dependabot\PHP;
+
+use Composer\Factory;
+use Composer\Installer;
+
+class Updater
+{
+    public static function update(array $args): array
+    {
+        [$workingDirectory, $dependencyName, $dependencyVersion, $gitCredentials, $registryCredentials] = $args;
+
+        // Change working directory to the one provided, this ensures that we
+        // install dependencies into the working dir, rather than a vendor folder
+        // in the root of the project
+        $originalDir = getcwd();
+        chdir($workingDirectory);
+
+        $io = new ExceptionIO();
+        $composer = Factory::create($io);
+        $config = $composer->getConfig();
+        $httpBasicCredentials = [];
+
+        $pm = new DependabotPluginManager($io, $composer, null, false);
+        $composer->setPluginManager($pm);
+        $pm->loadInstalledPlugins();
+
+        foreach ($gitCredentials as &$cred) {
+            $httpBasicCredentials[$cred['host']] = [
+                'username' => $cred['username'],
+                'password' => $cred['password'],
+            ];
+        }
+
+        foreach ($registryCredentials as &$cred) {
+            $httpBasicCredentials[$cred['registry']] = [
+                'username' => $cred['username'],
+                'password' => $cred['password'],
+            ];
+        }
+
+        if ($httpBasicCredentials) {
+            $config->merge(
+                [
+                    'config' => [
+                        'http-basic' => $httpBasicCredentials,
+                    ],
+                ]
+            );
+            $io->loadConfiguration($config);
+        }
+
+        $install = new Installer(
+            $io,
+            $config,
+            $composer->getPackage(),
+            $composer->getDownloadManager(),
+            $composer->getRepositoryManager(),
+            $composer->getLocker(),
+            $composer->getInstallationManager(),
+            $composer->getEventDispatcher(),
+            $composer->getAutoloadGenerator()
+        );
+
+        // For all potential options, see UpdateCommand in composer
+        $install
+            ->setWriteLock(true)
+            ->setUpdate(true)
+            ->setDevMode(true)
+            ->setUpdateWhitelist([$dependencyName])
+            ->setWhitelistTransitiveDependencies(true)
+            ->setExecuteOperations(false)
+            ->setDumpAutoloader(false)
+            ->setRunScripts(false);
+
+        /*
+         * If a platform is set we assume people know what they are doing and we respect the setting.
+         * If no platform is set we ignore it so that the php we run as doesn't interfere
+         */
+        if ($config->get('platform') === []) {
+            $install->setIgnorePlatformRequirements(true);
+        }
+
+        $install->run();
+
+        $result = [
+            'composer.lock' => file_get_contents('composer.lock'),
+        ];
+
+        chdir($originalDir);
+
+        return $result;
+    }
+}

data/helpers/python/lib/hasher.py

@@ -0,0 +1,23 @@
+import hashin
+import json
+import pipfile
+from poetry.poetry import Poetry
+
+def get_dependency_hash(dependency_name, dependency_version, algorithm):
+    hashes = hashin.get_package_hashes(
+        dependency_name,
+        version=dependency_version,
+        algorithm=algorithm
+    )
+
+    return json.dumps({ "result": hashes["hashes"] })
+
+def get_pipfile_hash(directory):
+    p = pipfile.load(directory + '/Pipfile')
+
+    return json.dumps({ "result": p.hash })
+
+def get_pyproject_hash(directory):
+    p = Poetry.create(directory)
+
+    return json.dumps({ "result": p.locker._get_content_hash() })

data/helpers/python/lib/parser.py

@@ -0,0 +1,130 @@
+from itertools import chain
+import glob
+import io
+import json
+import os.path
+import re
+
+import setuptools
+import pip._internal.req.req_file
+from pip._internal.download import PipSession
+from pip._internal.req.constructors import install_req_from_line
+
+def parse_requirements(directory):
+    # Parse the requirements.txt
+    requirement_packages = []
+
+    requirement_files = glob.glob(os.path.join(directory, '*.txt')) \
+                        + glob.glob(os.path.join(directory, '**', '*.txt'))
+
+    pip_compile_files = glob.glob(os.path.join(directory, '*.in')) \
+                        + glob.glob(os.path.join(directory, '**', '*.in'))
+
+    for reqs_file in requirement_files + pip_compile_files:
+        try:
+            requirements = pip._internal.req.req_file.parse_requirements(
+                reqs_file,
+                session=PipSession()
+            )
+            for install_req in requirements:
+                if install_req.original_link:
+                    continue
+                if install_req.is_pinned:
+                    version = next(iter(install_req.specifier)).version
+                else:
+                    version = None
+
+                pattern = r"-[cr] (.*) \(line \d+\)"
+                abs_path = re.search(pattern, install_req.comes_from).group(1)
+                rel_path = os.path.relpath(abs_path, directory)
+
+                requirement_packages.append({
+                    "name": install_req.req.name,
+                    "version": version,
+                    "markers": str(install_req.markers) or None,
+                    "file": rel_path,
+                    "requirement": str(install_req.specifier) or None
+                })
+        except Exception as e:
+            print(json.dumps({ "error": repr(e) }))
+            exit(1)
+
+    return json.dumps({ "result": requirement_packages })
+
+def parse_setup(directory):
+    # Parse the setup.py
+    setup_packages = []
+    if os.path.isfile(directory + '/setup.py'):
+        def parse_requirement(req, req_type):
+            install_req = install_req_from_line(req)
+            if install_req.original_link:
+                return
+            if install_req.is_pinned:
+                version = next(iter(install_req.specifier)).version
+            else:
+                version = None
+            setup_packages.append({
+                "name": install_req.req.name,
+                "version": version,
+                "markers": str(install_req.markers) or None,
+                "file": "setup.py",
+                "requirement": str(install_req.specifier) or None,
+                "requirement_type": req_type
+            })
+
+        def setup(*args, **kwargs):
+            for arg in ['setup_requires', 'install_requires', 'tests_require']:
+                if not kwargs.get(arg):
+                    continue
+                for req in kwargs.get(arg):
+                    parse_requirement(req, arg)
+            extras_require_dict = kwargs.get('extras_require', {})
+            for key in extras_require_dict:
+                for req in extras_require_dict[key]:
+                    parse_requirement(req, 'extras_require:{}'.format(key))
+        setuptools.setup = setup
+
+        def noop(*args, **kwargs):
+            pass
+
+        def fake_parse(*args, **kwargs):
+            return []
+
+        global fake_open
+        def fake_open(*args, **kwargs):
+            content = ("VERSION = (0, 0, 1)\n"
+                       "__version__ = '0.0.1'\n"
+                       "__author__ = 'someone'\n"
+                       "__title__ = 'something'\n"
+                       "__description__ = 'something'\n"
+                       "__author_email__ = 'something'\n"
+                       "__license__ = 'something'\n"
+                       "__url__ = 'something'\n")
+            return io.StringIO(content)
+
+        content = open(directory + '/setup.py', 'r').read()
+
+        # Remove `print`, `open`, `log` and import statements
+        content = re.sub(r"print\s*\(", "noop(", content)
+        content = re.sub(r"log\s*(\.\w+)*\(", "noop(", content)
+        content = re.sub(r"\b(\w+\.)*(open|file)\s*\(", "fake_open(", content)
+        content = content.replace("parse_requirements(", "fake_parse(")
+        version_re = re.compile(r"^.*import.*__version__.*$", re.MULTILINE)
+        content = re.sub(version_re, "", content)
+
+        # Set variables likely to be imported
+        __version__ = '0.0.1'
+        __author__ = 'someone'
+        __title__ = 'something'
+        __description__ = 'something'
+        __author_email__ = 'something'
+        __license__ = 'something'
+        __url__ = 'something'
+
+        # Run as main (since setup.py is a script)
+        __name__ = '__main__'
+
+        # Exec the setup.py
+        exec(content) in globals(), locals()
+
+    return json.dumps({ "result": setup_packages })