dependabot-core 0.76.1

data/lib/dependabot/update_checkers/ruby/bundler/ruby_requirement_setter.rb

@@ -0,0 +1,115 @@
+# frozen_string_literal: true
+
+require "parser/current"
+require "dependabot/update_checkers/ruby/bundler"
+
+module Dependabot
+  module UpdateCheckers
+    module Ruby
+      class Bundler
+        class RubyRequirementSetter
+          RUBY_VERSIONS =
+            %w(1.8.7 1.9.3 2.0.0 2.1.10 2.2.10 2.3.7 2.4.4 2.5.1).freeze
+
+          attr_reader :gemspec
+
+          def initialize(gemspec:)
+            @gemspec = gemspec
+          end
+
+          def rewrite(content)
+            return content unless gemspec_declares_ruby_requirement?
+
+            buffer = Parser::Source::Buffer.new("(gemfile_content)")
+            buffer.source = content
+            ast = Parser::CurrentRuby.new.parse(buffer)
+
+            if declares_ruby_version?(ast)
+              GemfileRewriter.new(
+                ruby_version: ruby_version
+              ).rewrite(buffer, ast)
+            else
+              "ruby '#{ruby_version}'\n" + content
+            end
+          end
+
+          private
+
+          def gemspec_declares_ruby_requirement?
+            !ruby_requirement.nil?
+          end
+
+          def declares_ruby_version?(node)
+            return false unless node.is_a?(Parser::AST::Node)
+            return true if node.type == :send && node.children[1] == :ruby
+
+            node.children.any? { |cn| declares_ruby_version?(cn) }
+          end
+
+          def ruby_version
+            requirement = Gem::Requirement.new(ruby_requirement)
+
+            ruby_version =
+              RUBY_VERSIONS.
+              map { |v| Gem::Version.new(v) }.sort.
+              find { |v| requirement.satisfied_by?(v) }
+
+            raise "Couldn't find Ruby version!" unless ruby_version
+
+            ruby_version
+          end
+
+          # rubocop:disable Security/Eval
+          def ruby_requirement
+            ast = Parser::CurrentRuby.parse(gemspec.content)
+            requirement_node = find_ruby_requirement_node(ast)
+            return unless requirement_node
+
+            eval(requirement_node.children[2].loc.expression.source)
+          end
+          # rubocop:enable Security/Eval
+
+          def find_ruby_requirement_node(node)
+            return unless node.is_a?(Parser::AST::Node)
+            return node if declares_ruby_requirement?(node)
+
+            node.children.find do |cn|
+              requirement_node = find_ruby_requirement_node(cn)
+              break requirement_node if requirement_node
+            end
+          end
+
+          def declares_ruby_requirement?(node)
+            return false unless node.is_a?(Parser::AST::Node)
+
+            node.children[1] == :required_ruby_version=
+          end
+
+          class GemfileRewriter < Parser::TreeRewriter
+            def initialize(ruby_version:)
+              @ruby_version = ruby_version
+            end
+
+            def on_send(node)
+              return unless declares_ruby_version?(node)
+
+              assigned_version_node = node.children[2]
+              replace(assigned_version_node.loc.expression, "'#{ruby_version}'")
+            end
+
+            private
+
+            attr_reader :ruby_version
+
+            def declares_ruby_version?(node)
+              return false unless node.is_a?(Parser::AST::Node)
+              return false unless node.type == :send
+
+              node.children[1] == :ruby
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/ruby/bundler/shared_bundler_helpers.rb

@@ -0,0 +1,243 @@
+# frozen_string_literal: true
+
+require "bundler_definition_ruby_version_patch"
+require "bundler_definition_bundler_version_patch"
+require "bundler_git_source_patch"
+
+require "excon"
+
+require "dependabot/update_checkers/ruby/bundler"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+
+module Dependabot
+  module UpdateCheckers
+    module Ruby
+      class Bundler
+        module SharedBundlerHelpers
+          GIT_REGEX = /reset --hard [^\s]*` in directory (?<path>[^\s]*)/.freeze
+          GIT_REF_REGEX = /not exist in the repository (?<path>[^\s]*)\./.freeze
+          PATH_REGEX = /The path `(?<path>.*)` does not exist/.freeze
+          RETRYABLE_ERRORS = %w(
+            Bundler::HTTPError
+            Bundler::Fetcher::FallbackError
+          ).freeze
+          RETRYABLE_PRIVATE_REGISTRY_ERRORS = %w(
+            Bundler::GemNotFound
+            Gem::InvalidSpecificationException
+            Bundler::VersionConflict
+            Bundler::HTTPError
+            Bundler::Fetcher::FallbackError
+          ).freeze
+
+          attr_reader :dependency_files, :credentials
+
+          #########################
+          # Bundler context setup #
+          #########################
+
+          def in_a_temporary_bundler_context(error_handling: true)
+            base_directory = dependency_files.first.directory
+            SharedHelpers.in_a_temporary_directory(base_directory) do |tmp_dir|
+              write_temporary_dependency_files
+
+              SharedHelpers.in_a_forked_process do
+                # Set the path for path gemspec correctly
+                ::Bundler.instance_variable_set(:@root, tmp_dir)
+
+                # Remove installed gems from the default Rubygems index
+                ::Gem::Specification.all = []
+
+                # Set auth details
+                relevant_credentials.each do |cred|
+                  ::Bundler.settings.set_command_option(
+                    cred.fetch("host"),
+                    cred["token"] || "#{cred['username']}:#{cred['password']}"
+                  )
+                end
+
+                yield
+              end
+            end
+          rescue SharedHelpers::ChildProcessFailed => error
+            retry_count ||= 0
+            retry_count += 1
+            if retryable_error?(error) && retry_count <= 2
+              sleep(rand(1.0..5.0)) && retry
+            end
+
+            raise unless error_handling
+
+            # Raise more descriptive errors
+            handle_bundler_errors(error)
+          end
+
+          def retryable_error?(error)
+            return true if RETRYABLE_ERRORS.include?(error.error_class)
+
+            unless RETRYABLE_PRIVATE_REGISTRY_ERRORS.include?(error.error_class)
+              return false
+            end
+
+            private_registry_credentials.any?
+          end
+
+          # rubocop:disable Metrics/CyclomaticComplexity
+          # rubocop:disable Metrics/PerceivedComplexity
+          # rubocop:disable Metrics/AbcSize
+          # rubocop:disable Metrics/MethodLength
+          def handle_bundler_errors(error)
+            msg = error.error_class + " with message: " + error.error_message
+
+            case error.error_class
+            when "Bundler::Dsl::DSLError", "Bundler::GemspecError"
+              # We couldn't evaluate the Gemfile, let alone resolve it
+              raise Dependabot::DependencyFileNotEvaluatable, msg
+            when "Bundler::Source::Git::MissingGitRevisionError"
+              gem_name =
+                error.error_message.match(GIT_REF_REGEX).
+                named_captures["path"].
+                split("/").last
+              raise GitDependencyReferenceNotFound, gem_name
+            when "Bundler::PathError"
+              gem_name =
+                error.error_message.match(PATH_REGEX).
+                named_captures["path"].
+                split("/").last.split("-")[0..-2].join
+              raise Dependabot::PathDependenciesNotReachable, [gem_name]
+            when "Bundler::Source::Git::GitCommandError"
+              if error.error_message.match?(GIT_REGEX)
+                # We couldn't find the specified branch / commit (or the two
+                # weren't compatible).
+                gem_name =
+                  error.error_message.match(GIT_REGEX).
+                  named_captures["path"].
+                  split("/").last.split("-")[0..-2].join
+                raise GitDependencyReferenceNotFound, gem_name
+              end
+
+              bad_uris = inaccessible_git_dependencies.map { |s| s.source.uri }
+              raise unless bad_uris.any?
+
+              # We don't have access to one of repos required
+              raise Dependabot::GitDependenciesNotReachable, bad_uris
+            when "Bundler::GemNotFound", "Gem::InvalidSpecificationException",
+                 "Bundler::VersionConflict"
+              # Bundler threw an error during resolution. Any of:
+              # - the gem doesn't exist in any of the specified sources
+              # - the gem wasn't specified properly
+              # - the gem was specified at an incompatible version
+              raise Dependabot::DependencyFileNotResolvable, msg
+            when "Bundler::Fetcher::AuthenticationRequiredError"
+              regex = /bundle config (?<source>.*) username:password/
+              source = error.error_message.match(regex)[:source]
+              raise Dependabot::PrivateSourceAuthenticationFailure, source
+            when "Bundler::Fetcher::BadAuthenticationError"
+              regex = /Bad username or password for (?<source>.*)\.$/
+              source = error.error_message.match(regex)[:source]
+              raise Dependabot::PrivateSourceAuthenticationFailure, source
+            when "Bundler::Fetcher::CertificateFailureError"
+              regex = /verify the SSL certificate for (?<source>.*)\.$/
+              source = error.error_message.match(regex)[:source]
+              raise Dependabot::PrivateSourceCertificateFailure, source
+            when "Bundler::HTTPError"
+              regex = /Could not fetch specs from (?<source>.*)$/
+              if error.error_message.match?(regex)
+                source = error.error_message.match(regex)[:source]
+                raise if source.include?("rubygems.org")
+
+                raise Dependabot::PrivateSourceTimedOut, source
+              end
+
+              # JFrog can serve a 403 if the credentials provided are good but
+              # don't have access to a particular gem.
+              raise unless error.error_message.include?("permitted to deploy")
+              raise unless jfrog_source
+
+              raise Dependabot::PrivateSourceAuthenticationFailure, jfrog_source
+            else raise
+            end
+          end
+          # rubocop:enable Metrics/CyclomaticComplexity
+          # rubocop:enable Metrics/PerceivedComplexity
+          # rubocop:enable Metrics/AbcSize
+          # rubocop:enable Metrics/MethodLength
+
+          def inaccessible_git_dependencies
+            in_a_temporary_bundler_context(error_handling: false) do
+              ::Bundler::Definition.build(gemfile.name, nil, {}).dependencies.
+                reject do |spec|
+                  next true unless spec.source.is_a?(::Bundler::Source::Git)
+
+                  # Piggy-back off some private Bundler methods to configure the
+                  # URI with auth details in the same way Bundler does.
+                  git_proxy = spec.source.send(:git_proxy)
+                  uri = spec.source.uri.gsub("git://", "https://")
+                  uri = git_proxy.send(:configured_uri_for, uri)
+                  uri += ".git" unless uri.end_with?(".git")
+                  uri += "/info/refs?service=git-upload-pack"
+
+                  begin
+                    Excon.get(
+                      uri,
+                      idempotent: true,
+                      **SharedHelpers.excon_defaults
+                    ).status == 200
+                  rescue Excon::Error::Socket, Excon::Error::Timeout
+                    false
+                  end
+                end
+            end
+          end
+
+          def jfrog_source
+            in_a_temporary_bundler_context(error_handling: false) do
+              ::Bundler::Definition.build(gemfile.name, nil, {}).
+                send(:sources).
+                rubygems_remotes.
+                find { |uri| uri.host.include?("jfrog") }&.
+                host
+            end
+          end
+
+          def write_temporary_dependency_files
+            dependency_files.each do |file|
+              path = file.name
+              FileUtils.mkdir_p(Pathname.new(path).dirname)
+              File.write(path, file.content)
+            end
+
+            File.write(lockfile.name, sanitized_lockfile_body) if lockfile
+          end
+
+          def relevant_credentials
+            private_registry_credentials + git_source_credentials
+          end
+
+          def private_registry_credentials
+            credentials.select { |cred| cred["type"] == "rubygems_server" }
+          end
+
+          def git_source_credentials
+            credentials.select { |cred| cred["type"] == "git_source" }
+          end
+
+          def gemfile
+            dependency_files.find { |f| f.name == "Gemfile" } ||
+              dependency_files.find { |f| f.name == "gems.rb" }
+          end
+
+          def lockfile
+            dependency_files.find { |f| f.name == "Gemfile.lock" } ||
+              dependency_files.find { |f| f.name == "gems.locked" }
+          end
+
+          def sanitized_lockfile_body
+            re = FileUpdaters::Ruby::Bundler::LockfileUpdater::LOCKFILE_ENDING
+            lockfile.content.gsub(re, "")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/update_checkers/ruby/bundler/version_resolver.rb

@@ -0,0 +1,255 @@
+# frozen_string_literal: true
+
+require "bundler_definition_ruby_version_patch"
+require "bundler_definition_bundler_version_patch"
+require "bundler_git_source_patch"
+
+require "excon"
+
+require "dependabot/update_checkers/ruby/bundler"
+require "dependabot/file_updaters/ruby/bundler/lockfile_updater"
+require "dependabot/utils/ruby/requirement"
+require "dependabot/shared_helpers"
+require "dependabot/errors"
+
+module Dependabot
+  module UpdateCheckers
+    module Ruby
+      class Bundler
+        class VersionResolver
+          require_relative "file_preparer"
+          require_relative "latest_version_finder"
+          require_relative "shared_bundler_helpers"
+          include SharedBundlerHelpers
+
+          GEM_NOT_FOUND_ERROR_REGEX = /locked to (?<name>[^\s]+) \(/.freeze
+
+          def initialize(dependency:, unprepared_dependency_files:,
+                         credentials:, ignored_versions:,
+                         replacement_git_pin: nil, remove_git_source: false,
+                         unlock_requirement: true,
+                         latest_allowable_version: nil)
+            @dependency                  = dependency
+            @unprepared_dependency_files = unprepared_dependency_files
+            @credentials                 = credentials
+            @ignored_versions            = ignored_versions
+            @replacement_git_pin         = replacement_git_pin
+            @remove_git_source           = remove_git_source
+            @unlock_requirement          = unlock_requirement
+            @latest_allowable_version    = latest_allowable_version
+          end
+
+          def latest_resolvable_version_details
+            @latest_resolvable_version_details ||=
+              fetch_latest_resolvable_version_details
+          end
+
+          private
+
+          attr_reader :dependency, :unprepared_dependency_files, :credentials,
+                      :ignored_versions, :replacement_git_pin,
+                      :latest_allowable_version
+
+          def remove_git_source?
+            @remove_git_source
+          end
+
+          def unlock_requirement?
+            @unlock_requirement
+          end
+
+          def dependency_files
+            @dependency_files ||=
+              FilePreparer.new(
+                dependency: dependency,
+                dependency_files: unprepared_dependency_files,
+                replacement_git_pin: replacement_git_pin,
+                remove_git_source: remove_git_source?,
+                unlock_requirement: unlock_requirement?,
+                latest_allowable_version: latest_allowable_version
+              ).prepared_dependency_files
+          end
+
+          # rubocop:disable Metrics/CyclomaticComplexity
+          # rubocop:disable Metrics/PerceivedComplexity
+          def fetch_latest_resolvable_version_details
+            return latest_version_details unless gemfile
+
+            in_a_temporary_bundler_context do
+              dep = dependency_from_definition
+
+              # If the dependency wasn't found in the definition, it's because
+              # the Gemfile didn't import the gemspec. This is unusual, but
+              # the correct behaviour if/when it happens is to behave as if
+              # the repo was gemspec-only
+              next latest_version_details unless dep
+
+              # If the old Gemfile index was used then it won't have checked
+              # Ruby compatibility. Fix that by doing the check manually (and
+              # saying no update is possible if the Ruby version is a mismatch)
+              next nil if ruby_version_incompatible?(dep)
+
+              details = { version: dep.version }
+              if dep.source.instance_of?(::Bundler::Source::Git)
+                details[:commit_sha] = dep.source.revision
+              end
+              details
+            end
+          rescue Dependabot::DependencyFileNotResolvable => error
+            return if ignored_versions.any? && !dependency.appears_in_lockfile?
+            raise unless ruby_lock_error?(error)
+
+            @gemspec_ruby_unlocked = true
+            regenerate_dependency_files_without_ruby_lock && retry
+          end
+          # rubocop:enable Metrics/CyclomaticComplexity
+          # rubocop:enable Metrics/PerceivedComplexity
+
+          def ruby_lock_error?(error)
+            return false unless error.message.include?(" for gem \"ruby\0\"")
+            return false if @gemspec_ruby_unlocked
+
+            dependency_files.any? { |f| f.name.end_with?(".gemspec") }
+          end
+
+          def regenerate_dependency_files_without_ruby_lock
+            @dependency_files =
+              FilePreparer.new(
+                dependency: dependency,
+                dependency_files: unprepared_dependency_files,
+                replacement_git_pin: replacement_git_pin,
+                remove_git_source: remove_git_source?,
+                unlock_requirement: unlock_requirement?,
+                latest_allowable_version: latest_allowable_version,
+                lock_ruby_version: false
+              ).prepared_dependency_files
+          end
+
+          def dependency_from_definition
+            dependencies_to_unlock = [dependency.name, *subdependencies]
+            begin
+              definition = build_definition(dependencies_to_unlock)
+              definition.resolve_remotely!
+            rescue ::Bundler::GemNotFound => error
+              unlock_yanked_gem(dependencies_to_unlock, error) && retry
+            rescue ::Bundler::HTTPError => error
+              # Retry network errors
+              attempt ||= 1
+              attempt += 1
+              raise if attempt > 3 || !error.message.include?("Network error")
+
+              retry
+            end
+
+            definition.resolve.find { |d| d.name == dependency.name }
+          end
+
+          def unlock_yanked_gem(dependencies_to_unlock, error)
+            raise unless error.message.match?(GEM_NOT_FOUND_ERROR_REGEX)
+
+            gem_name = error.message.match(GEM_NOT_FOUND_ERROR_REGEX).
+                       named_captures["name"]
+            raise if dependencies_to_unlock.include?(gem_name)
+
+            dependencies_to_unlock << gem_name
+          end
+
+          def subdependencies
+            # If there's no lockfile we don't need to worry about
+            # subdependencies
+            return [] unless lockfile
+
+            all_deps =  ::Bundler::LockfileParser.new(sanitized_lockfile_body).
+                        specs.map(&:name).map(&:to_s)
+            top_level = build_definition([]).dependencies.
+                        map(&:name).map(&:to_s)
+
+            all_deps - top_level
+          end
+
+          def ruby_version_incompatible?(dep)
+            return false unless dep.source.is_a?(::Bundler::Source::Rubygems)
+
+            fetcher = dep.source.fetchers.first.fetchers.first
+
+            # It's only the old index we have a problem with
+            return false unless fetcher.is_a?(::Bundler::Fetcher::Dependency)
+
+            # If no Ruby version is specified, we don't have a problem
+            return false unless ruby_version
+
+            versions = Excon.get(
+              "#{fetcher.fetch_uri}api/v1/versions/#{dependency.name}.json",
+              idempotent: true,
+              **SharedHelpers.excon_defaults
+            )
+
+            # Give the benefit of the doubt if something goes wrong fetching
+            # version details (could be that it's a private index, etc.)
+            return false unless versions.status == 200
+
+            ruby_requirement =
+              JSON.parse(versions.body).
+              find { |details| details["number"] == dep.version.to_s }&.
+              fetch("ruby_version", nil)
+
+            # Give the benefit of the doubt if we can't find the version's
+            # required Ruby version.
+            return false unless ruby_requirement
+
+            ruby_requirement = Utils::Ruby::Requirement.new(ruby_requirement)
+
+            !ruby_requirement.satisfied_by?(ruby_version)
+          rescue JSON::ParserError, Excon::Error::Socket, Excon::Error::Timeout
+            # Give the benefit of the doubt if something goes wrong fetching
+            # version details (could be that it's a private index, etc.)
+            false
+          end
+
+          def build_definition(dependencies_to_unlock)
+            # Note: we lock shared dependencies to avoid any top-level
+            # dependencies getting unlocked (which would happen if they were
+            # also subdependencies of the dependency being unlocked)
+            ::Bundler::Definition.build(
+              gemfile.name,
+              lockfile&.name,
+              gems: dependencies_to_unlock,
+              lock_shared_dependencies: true
+            )
+          end
+
+          def ruby_version
+            return nil unless gemfile
+
+            @ruby_version ||= build_definition([]).ruby_version&.gem_version
+          end
+
+          def latest_version_details
+            @latest_version_details ||=
+              LatestVersionFinder.new(
+                dependency: dependency,
+                dependency_files: dependency_files,
+                credentials: credentials,
+                ignored_versions: ignored_versions
+              ).latest_version_details
+          end
+
+          def gemfile
+            dependency_files.find { |f| f.name == "Gemfile" } ||
+              dependency_files.find { |f| f.name == "gems.rb" }
+          end
+
+          def lockfile
+            dependency_files.find { |f| f.name == "Gemfile.lock" } ||
+              dependency_files.find { |f| f.name == "gems.locked" }
+          end
+
+          def sanitized_lockfile_body
+            re = FileUpdaters::Ruby::Bundler::LockfileUpdater::LOCKFILE_ENDING
+            lockfile.content.gsub(re, "")
+          end
+        end
+      end
+    end
+  end
+end