dependabot-core 0.76.1

data/lib/dependabot/update_checkers/php/composer.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "excon"
+require "dependabot/update_checkers/base"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+
+require "json"
+
+module Dependabot
+  module UpdateCheckers
+    module Php
+      class Composer < Dependabot::UpdateCheckers::Base
+        require_relative "composer/requirements_updater"
+        require_relative "composer/version_resolver"
+
+        def latest_version
+          return nil if path_dependency?
+
+          # Fall back to latest_resolvable_version if no listings found
+          latest_version_from_registry || latest_resolvable_version
+        end
+
+        def latest_resolvable_version
+          return nil if path_dependency?
+
+          @latest_resolvable_version ||=
+            VersionResolver.new(
+              credentials: credentials,
+              dependency: dependency,
+              dependency_files: dependency_files,
+              latest_allowable_version: latest_version_from_registry,
+              requirements_to_unlock: :own
+            ).latest_resolvable_version
+        end
+
+        def latest_resolvable_version_with_no_unlock
+          return nil if path_dependency?
+
+          @latest_resolvable_version_with_no_unlock ||=
+            VersionResolver.new(
+              credentials: credentials,
+              dependency: dependency,
+              dependency_files: dependency_files,
+              latest_allowable_version: latest_version_from_registry,
+              requirements_to_unlock: :none
+            ).latest_resolvable_version
+        end
+
+        def updated_requirements
+          RequirementsUpdater.new(
+            requirements: dependency.requirements,
+            latest_version: latest_version&.to_s,
+            latest_resolvable_version: latest_resolvable_version&.to_s,
+            library: library?
+          ).updated_requirements
+        end
+
+        private
+
+        def latest_version_resolvable_with_full_unlock?
+          # Full unlock checks aren't implemented for Composer (yet)
+          false
+        end
+
+        def latest_version_from_registry
+          versions =
+            registry_versions.
+            select { |version| version_class.correct?(version.gsub(/^v/, "")) }.
+            map { |version| version_class.new(version.gsub(/^v/, "")) }
+
+          versions.reject!(&:prerelease?) unless wants_prerelease?
+          versions.reject! { |v| ignore_reqs.any? { |r| r.satisfied_by?(v) } }
+          versions.max
+        end
+
+        def wants_prerelease?
+          current_version = dependency.version
+          if current_version && version_class.new(current_version).prerelease?
+            return true
+          end
+
+          dependency.requirements.any? do |req|
+            req[:requirement].match?(/\d-[A-Za-z]/)
+          end
+        end
+
+        def updated_dependencies_after_full_unlock
+          raise NotImplementedError
+        end
+
+        def path_dependency?
+          dependency.requirements.any? { |r| r.dig(:source, :type) == "path" }
+        end
+
+        def composer_file
+          composer_file =
+            dependency_files.find { |f| f.name == "composer.json" }
+          raise "No composer.json!" unless composer_file
+
+          composer_file
+        end
+
+        def lockfile
+          dependency_files.find { |f| f.name == "composer.lock" }
+        end
+
+        def registry_versions
+          return @registry_versions unless @registry_versions.nil?
+
+          repositories =
+            JSON.parse(composer_file.content).
+            fetch("repositories", []).
+            select { |r| r.is_a?(Hash) }
+
+          urls = repositories.
+                 select { |h| h["type"] == "composer" }.
+                 map { |h| h["url"] }.compact.
+                 map { |url| url.gsub(%r{\/$}, "") + "/packages.json" }
+
+          unless repositories.any? { |rep| rep["packagist.org"] == false }
+            urls << "https://packagist.org/p/#{dependency.name.downcase}.json"
+          end
+
+          @registry_versions = []
+          urls.each do |url|
+            @registry_versions += fetch_registry_versions_from_url(url)
+          end
+          @registry_versions.uniq
+        end
+
+        def fetch_registry_versions_from_url(url)
+          cred = registry_credentials.find { |c| url.include?(c["registry"]) }
+
+          response = Excon.get(
+            url,
+            idempotent: true,
+            user: cred&.fetch("username", nil),
+            password: cred&.fetch("password", nil),
+            **SharedHelpers.excon_defaults
+          )
+
+          return [] unless response.status == 200
+
+          listing = JSON.parse(response.body)
+          return [] if listing.nil?
+          return [] if listing.fetch("packages", []) == []
+          return [] unless listing.dig("packages", dependency.name.downcase)
+
+          listing.dig("packages", dependency.name.downcase).keys
+        rescue Excon::Error::Socket, Excon::Error::Timeout
+          []
+        end
+
+        def library?
+          JSON.parse(composer_file.content)["type"] == "library"
+        end
+
+        def registry_credentials
+          credentials.select { |cred| cred["type"] == "composer_repository" }
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/php/composer/requirements_updater.rb

@@ -0,0 +1,243 @@
+# frozen_string_literal: true
+
+################################################################################
+# For more details on Composer version constraints, see:                       #
+# https://getcomposer.org/doc/articles/versions.md#writing-version-constraints #
+################################################################################
+
+require "dependabot/update_checkers/php/composer"
+require "dependabot/utils/php/version"
+require "dependabot/utils/php/requirement"
+
+module Dependabot
+  module UpdateCheckers
+    module Php
+      class Composer
+        class RequirementsUpdater
+          ALIAS_REGEX = /[a-z0-9\-_\.]*\sas\s+/.freeze
+          VERSION_REGEX =
+            /(?:#{ALIAS_REGEX})?[0-9]+(?:\.[a-zA-Z0-9*\-]+)*/.freeze
+          AND_SEPARATOR =
+            /(?<=[a-zA-Z0-9*])(?<!\sas)[\s,]+(?![\s,]*[|-]|as)/.freeze
+          OR_SEPARATOR = /(?<=[a-zA-Z0-9*])[\s,]*\|\|?\s*/.freeze
+          SEPARATOR = /(?:#{AND_SEPARATOR})|(?:#{OR_SEPARATOR})/.freeze
+
+          def initialize(requirements:, library:,
+                         latest_version:, latest_resolvable_version:)
+            @requirements = requirements
+            @library = library
+
+            if latest_version
+              @latest_version = version_class.new(latest_version)
+            end
+
+            return unless latest_resolvable_version
+
+            @latest_resolvable_version =
+              version_class.new(latest_resolvable_version)
+          end
+
+          def updated_requirements
+            return requirements unless latest_resolvable_version
+
+            requirements.map { |req| updated_requirement(req) }
+          end
+
+          private
+
+          attr_reader :requirements, :latest_version, :latest_resolvable_version
+
+          # rubocop:disable Metrics/PerceivedComplexity
+          def updated_requirement(req)
+            req_string = req[:requirement].strip
+            or_string_reqs = req_string.split(OR_SEPARATOR)
+            or_separator = req_string.match(OR_SEPARATOR)&.to_s || " || "
+            numeric_or_string_reqs = or_string_reqs.
+                                     reject { |r| r.start_with?("dev-") }
+            branch_or_string_reqs = or_string_reqs.
+                                    select { |r| r.start_with?("dev-") }
+
+            return req unless req_string.match?(/\d/)
+            return req if numeric_or_string_reqs.none?
+            return updated_alias(req) if req_string.match?(ALIAS_REGEX)
+            return req if req_satisfied_by_latest_resolvable?(req_string)
+
+            new_req =
+              if library? then updated_library_requirement(req, or_separator)
+              else updated_app_requirement(req, or_separator)
+              end
+
+            new_req_string =
+              [new_req[:requirement], *branch_or_string_reqs].join(or_separator)
+            new_req.merge(requirement: new_req_string)
+          end
+          # rubocop:enable Metrics/PerceivedComplexity
+
+          def updated_alias(req)
+            req_string = req[:requirement]
+            real_version = req_string.split(/\sas\s/).first.strip
+
+            # If the version we're aliasing isn't a version then we don't know
+            # how to update it, so we just return the existing requirement.
+            return req unless version_class.correct?(real_version)
+
+            new_version_string = latest_resolvable_version.to_s
+            new_req = req_string.sub(real_version, new_version_string)
+            req.merge(requirement: new_req)
+          end
+
+          def library?
+            @library
+          end
+
+          def updated_app_requirement(req, or_separator)
+            current_requirement = req[:requirement]
+            reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
+
+            updated_requirement =
+              if reqs.count > 1
+                "^#{latest_resolvable_version}"
+              elsif reqs.any? { |r| r.match?(/<|(\s+-\s+)/) }
+                update_range_requirement(current_requirement, or_separator)
+              else
+                update_version_string(current_requirement)
+              end
+
+            req.merge(requirement: updated_requirement)
+          end
+
+          def updated_library_requirement(req, or_separator)
+            current_requirement = req[:requirement]
+            reqs = current_requirement.strip.split(SEPARATOR).map(&:strip)
+
+            updated_requirement =
+              if reqs.any? { |r| r.start_with?("^") }
+                update_caret_requirement(current_requirement, or_separator)
+              elsif reqs.any? { |r| r.start_with?("~") }
+                update_tilda_requirement(current_requirement, or_separator)
+              elsif reqs.any? { |r| r.include?("*") }
+                update_wildcard_requirement(current_requirement, or_separator)
+              elsif reqs.any? { |r| r.match?(/<|(\s+-\s+)/) }
+                update_range_requirement(current_requirement, or_separator)
+              else
+                update_version_string(current_requirement)
+              end
+
+            req.merge(requirement: updated_requirement)
+          end
+
+          def req_satisfied_by_latest_resolvable?(requirement_string)
+            ruby_requirements(requirement_string).
+              any? { |r| r.satisfied_by?(latest_resolvable_version) }
+          end
+
+          def update_version_string(req_string)
+            req_string.
+              sub(VERSION_REGEX) do |old_version|
+                unless req_string.match?(/[~*\^]/)
+                  next latest_resolvable_version.to_s
+                end
+
+                old_parts = old_version.split(".")
+                new_parts = latest_resolvable_version.to_s.split(".").
+                            first(old_parts.count)
+                new_parts.map.with_index do |part, i|
+                  old_parts[i] == "*" ? "*" : part
+                end.join(".")
+              end
+          end
+
+          def ruby_requirements(requirement_string)
+            Utils::Php::Requirement.requirements_array(requirement_string)
+          end
+
+          def update_caret_requirement(req_string, or_separator)
+            caret_requirements =
+              req_string.split(SEPARATOR).select { |r| r.start_with?("^") }
+            version_parts = latest_resolvable_version.segments
+
+            min_existing_precision =
+              caret_requirements.map { |r| r.split(".").count }.min
+            first_non_zero_index =
+              version_parts.count.times.find { |i| version_parts[i] != 0 }
+
+            precision = [min_existing_precision, first_non_zero_index + 1].max
+            version = version_parts.first(precision).map.with_index do |part, i|
+              i <= first_non_zero_index ? part : 0
+            end.join(".")
+
+            req_string + "#{or_separator}^#{version}"
+          end
+
+          def update_tilda_requirement(req_string, or_separator)
+            tilda_requirements =
+              req_string.split(SEPARATOR).select { |r| r.start_with?("~") }
+            precision = tilda_requirements.map { |r| r.split(".").count }.min
+
+            version_parts = latest_resolvable_version.segments.first(precision)
+            version_parts[-1] = 0
+            version = version_parts.join(".")
+
+            req_string + "#{or_separator}~#{version}"
+          end
+
+          def update_wildcard_requirement(req_string, or_separator)
+            wildcard_requirements =
+              req_string.split(SEPARATOR).select { |r| r.include?("*") }
+            precision = wildcard_requirements.map do |r|
+              r.split(".").reject { |s| s == "*" }.count
+            end.min
+            wildcard_count = wildcard_requirements.map do |r|
+              r.split(".").select { |s| s == "*" }.count
+            end.min
+
+            version_parts = latest_resolvable_version.segments.first(precision)
+            version = version_parts.join(".")
+
+            req_string + "#{or_separator}#{version}#{'.*' * wildcard_count}"
+          end
+
+          def update_range_requirement(req_string, or_separator)
+            range_requirements =
+              req_string.split(SEPARATOR).select { |r| r.match?(/<|(\s+-\s+)/) }
+
+            if range_requirements.count == 1
+              range_requirement = range_requirements.first
+              versions = range_requirement.scan(VERSION_REGEX)
+              upper_bound = versions.map { |v| version_class.new(v) }.max
+              new_upper_bound = update_greatest_version(
+                upper_bound,
+                latest_resolvable_version
+              )
+
+              req_string.sub(upper_bound.to_s, new_upper_bound.to_s)
+            else
+              req_string + "#{or_separator}^#{latest_resolvable_version}"
+            end
+          end
+
+          def update_greatest_version(old_version, version_to_be_permitted)
+            version = version_class.new(old_version)
+            version = version.release if version.prerelease?
+
+            index_to_update =
+              version.segments.map.with_index { |seg, i| seg.zero? ? 0 : i }.max
+
+            version.segments.map.with_index do |_, index|
+              if index < index_to_update
+                version_to_be_permitted.segments[index]
+              elsif index == index_to_update
+                version_to_be_permitted.segments[index] + 1
+              else 0
+              end
+            end.join(".")
+          end
+
+          def version_class
+            Utils::Php::Version
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/php/composer/version_resolver.rb

@@ -0,0 +1,203 @@
+# frozen_string_literal: true
+
+require "dependabot/shared_helpers"
+require "dependabot/update_checkers/php/composer"
+require "dependabot/utils/php/version"
+
+module Dependabot
+  module UpdateCheckers
+    module Php
+      class Composer
+        class VersionResolver
+          VERSION_REGEX = /[0-9]+(?:\.[A-Za-z0-9\-_]+)*/.freeze
+          SOURCE_TIMED_OUT_REGEX =
+            /The "(?<url>[^"]+packages\.json)".*timed out/.freeze
+
+          def initialize(credentials:, dependency:, dependency_files:,
+                         requirements_to_unlock:, latest_allowable_version:)
+            @credentials              = credentials
+            @dependency               = dependency
+            @dependency_files         = dependency_files
+            @requirements_to_unlock   = requirements_to_unlock
+            @latest_allowable_version = latest_allowable_version
+          end
+
+          def latest_resolvable_version
+            @latest_resolvable_version ||= fetch_latest_resolvable_version
+          end
+
+          private
+
+          attr_reader :credentials, :dependency, :dependency_files,
+                      :requirements_to_unlock, :latest_allowable_version
+
+          def fetch_latest_resolvable_version
+            version = fetch_latest_resolvable_version_string
+            return if version.nil?
+            return unless Utils::Php::Version.correct?(version)
+
+            Utils::Php::Version.new(version)
+          end
+
+          def fetch_latest_resolvable_version_string
+            base_directory = dependency_files.first.directory
+            SharedHelpers.in_a_temporary_directory(base_directory) do
+              File.write("composer.json", prepared_composer_json_content)
+              File.write("composer.lock", lockfile.content) if lockfile
+
+              run_update_checker
+            end
+          rescue SharedHelpers::HelperSubprocessFailed => error
+            retry_count ||= 0
+            retry_count += 1
+            retry if retry_count < 2 && error.message.include?("404 Not Found")
+            retry if retry_count < 2 && error.message.include?("timed out")
+            handle_composer_errors(error)
+          end
+
+          def run_update_checker
+            SharedHelpers.with_git_configured(credentials: credentials) do
+              SharedHelpers.run_helper_subprocess(
+                command: "php -d memory_limit=-1 #{php_helper_path}",
+                function: "get_latest_resolvable_version",
+                args: [
+                  Dir.pwd,
+                  dependency.name.downcase,
+                  git_credentials,
+                  registry_credentials
+                ]
+              )
+            end
+          end
+
+          def prepared_composer_json_content
+            content = composer_file.content
+
+            content.gsub(
+              /"#{Regexp.escape(dependency.name)}"\s*:\s*".*"/,
+              %("#{dependency.name}": "#{updated_version_requirement_string}")
+            )
+          end
+
+          def updated_version_requirement_string
+            lower_bound =
+              if requirements_to_unlock == :none
+                dependency.requirements.first&.fetch(:requirement) || ">= 0"
+              elsif dependency.version
+                ">= #{dependency.version}"
+              else
+                version_for_requirement =
+                  dependency.requirements.map { |r| r[:requirement] }.compact.
+                  reject { |req_string| req_string.start_with?("<") }.
+                  select { |req_string| req_string.match?(VERSION_REGEX) }.
+                  map { |req_string| req_string.match(VERSION_REGEX) }.
+                  select { |version| Gem::Version.correct?(version) }.
+                  max_by { |version| Gem::Version.new(version) }
+
+                ">= #{version_for_requirement || 0}"
+              end
+
+            # Add the latest_allowable_version as an upper bound. This means
+            # ignore conditions are considered when checking for the latest
+            # resolvable version.
+            #
+            # NOTE: This isn't perfect. If v2.x is ignored and v3 is out but
+            # unresolvable then the `latest_allowable_version` will be v3, and
+            # we won't be ignoring v2.x releases like we should be.
+            return lower_bound unless latest_allowable_version
+
+            lower_bound + ", <= #{latest_allowable_version}"
+          end
+
+          # rubocop:disable Metrics/PerceivedComplexity
+          # rubocop:disable Metrics/AbcSize
+          # rubocop:disable Metrics/CyclomaticComplexity
+          # rubocop:disable Metrics/MethodLength
+          def handle_composer_errors(error)
+            if error.message.start_with?("Failed to execute git clone")
+              dependency_url =
+                error.message.match(/--mirror '(?<url>.*?)'/).
+                named_captures.fetch("url")
+              raise Dependabot::GitDependenciesNotReachable, dependency_url
+            elsif error.message.start_with?("Failed to clone")
+              dependency_url =
+                error.message.match(/Failed to clone (?<url>.*?) via/).
+                named_captures.fetch("url")
+              raise Dependabot::GitDependenciesNotReachable, dependency_url
+            elsif error.message.start_with?("Could not parse version")
+              raise Dependabot::DependencyFileNotResolvable, error.message
+            elsif error.message.include?("requested PHP extension")
+              extensions = error.message.scan(/\sext\-.*?\s/).map(&:strip).uniq
+              msg = "Dependabot's installed extensions didn't match those "\
+                    "required by your application. Please add the following "\
+                    "extensions to the platform config in your composer.json: "\
+                    "#{extensions.join(', ')}.\n\n"\
+                    "The full error raised was:\n\n#{error.message}"
+              raise Dependabot::DependencyFileNotResolvable, msg
+            elsif error.message.include?("package requires php") ||
+                  error.message.include?("cannot require itself")
+              raise Dependabot::DependencyFileNotResolvable, error.message
+            elsif error.message.include?("requirements could not be resolved")
+              # We should raise a Dependabot::DependencyFileNotResolvable error
+              # here, but can't confidently distinguish between cases where we
+              # can't install and cases where we can't update. For now, we
+              # therefore just ignore the dependency.
+              nil
+            elsif error.message.include?("URL required authentication") ||
+                  error.message.include?("403 Forbidden")
+              source =
+                error.message.match(%r{https?://(?<source>[^/]+)/}).
+                named_captures.fetch("source")
+              raise Dependabot::PrivateSourceAuthenticationFailure, source
+            elsif error.message.match?(SOURCE_TIMED_OUT_REGEX)
+              url = error.message.match(SOURCE_TIMED_OUT_REGEX).
+                    named_captures.fetch("url")
+              raise if url.include?("packagist.org")
+
+              source = url.gsub(%r{/packages.json$}, "")
+              raise Dependabot::PrivateSourceTimedOut, source
+            elsif error.message.start_with?("Allowed memory size")
+              raise Dependabot::OutOfMemory
+            elsif error.message.start_with?("Package not found in updated") &&
+                  !dependency.top_level?
+              # If we can't find the dependency in the composer.lock after an
+              # update, but it was originally a sub-dependency, it's because the
+              # dependency is no longer required and is just cruft in the
+              # composer.json. In this case we just ignore the dependency.
+              nil
+            else
+              raise error
+            end
+          end
+          # rubocop:enable Metrics/PerceivedComplexity
+          # rubocop:enable Metrics/AbcSize
+          # rubocop:enable Metrics/CyclomaticComplexity
+          # rubocop:enable Metrics/MethodLength
+
+          def php_helper_path
+            project_root = File.join(File.dirname(__FILE__), "../../../../..")
+            File.join(project_root, "helpers/php/bin/run.php")
+          end
+
+          def composer_file
+            @composer_file ||=
+              dependency_files.find { |f| f.name == "composer.json" }
+          end
+
+          def lockfile
+            @lockfile ||=
+              dependency_files.find { |f| f.name == "composer.lock" }
+          end
+
+          def git_credentials
+            credentials.select { |cred| cred["type"] == "git_source" }
+          end
+
+          def registry_credentials
+            credentials.select { |cred| cred["type"] == "composer_repository" }
+          end
+        end
+      end
+    end
+  end
+end