dependabot-core 0.76.1

data/lib/dependabot/utils/docker/credentials_finder.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "aws-sdk-ecr"
+require "base64"
+
+require "dependabot/errors"
+
+module Dependabot
+  module Utils
+    module Docker
+      class CredentialsFinder
+        AWS_ECR_URL = /dkr\.ecr\.(?<region>[^.]+).amazonaws\.com/.freeze
+
+        def initialize(credentials)
+          @credentials = credentials
+        end
+
+        def credentials_for_registry(registry_hostname)
+          registry_details =
+            credentials.
+            select { |cred| cred["type"] == "docker_registry" }.
+            find { |cred| cred.fetch("registry") == registry_hostname }
+          return unless registry_details
+          return registry_details unless registry_hostname.match?(AWS_ECR_URL)
+
+          build_aws_credentials(registry_details)
+        end
+
+        private
+
+        attr_reader :credentials
+
+        def build_aws_credentials(registry_details)
+          # If credentials have been generated from AWS we can just return them
+          return registry_details if registry_details.fetch("username") == "AWS"
+
+          # Otherwise, we need to use the provided Access Key ID and secret to
+          # generate a temporary username and password
+          aws_credentials = Aws::Credentials.new(
+            registry_details.fetch("username"),
+            registry_details.fetch("password")
+          )
+
+          registry_hostname = registry_details.fetch("registry")
+          region = registry_hostname.match(AWS_ECR_URL).
+                   named_captures.fetch("region")
+
+          @authorization_tokens ||= {}
+          @authorization_tokens[registry_hostname] ||=
+            Aws::ECR::Client.new(region: region, credentials: aws_credentials).
+            get_authorization_token.authorization_data.first.
+            authorization_token
+
+          username, password =
+            Base64.decode64(@authorization_tokens[registry_hostname]).split(":")
+
+          registry_details.merge("username" => username, "password" => password)
+        rescue Aws::Errors::MissingCredentialsError,
+               Aws::ECR::Errors::UnrecognizedClientException
+          raise PrivateSourceAuthenticationFailure, registry_hostname
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/dotnet/requirement.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "dependabot/utils/dotnet/version"
+
+# For details on .NET version constraints see:
+# https://docs.microsoft.com/en-us/nuget/reference/package-versioning
+module Dependabot
+  module Utils
+    module Dotnet
+      class Requirement < Gem::Requirement
+        def self.parse(obj)
+          if obj.is_a?(Gem::Version)
+            return ["=", Utils::Dotnet::Version.new(obj.to_s)]
+          end
+
+          unless (matches = PATTERN.match(obj.to_s))
+            msg = "Illformed requirement [#{obj.inspect}]"
+            raise BadRequirementError, msg
+          end
+
+          return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
+
+          [matches[1] || "=", Utils::Dotnet::Version.new(matches[2])]
+        end
+
+        # For consistency with other langauges, we define a requirements array.
+        # Dotnet doesn't have an `OR` separator for requirements, so it always
+        # contains a single element.
+        def self.requirements_array(requirement_string)
+          [new(requirement_string)]
+        end
+
+        def initialize(*requirements)
+          requirements = requirements.flatten.flat_map do |req_string|
+            convert_dotnet_constraint_to_ruby_constraint(req_string)
+          end
+
+          super(requirements)
+        end
+
+        def satisfied_by?(version)
+          version = Utils::Dotnet::Version.new(version.to_s)
+          super
+        end
+
+        private
+
+        def convert_dotnet_constraint_to_ruby_constraint(req_string)
+          return unless req_string
+
+          if req_string&.start_with?("(", "[")
+            return convert_dotnet_range_to_ruby_range(req_string)
+          end
+
+          return req_string.split(",").map(&:strip) if req_string.include?(",")
+          return req_string unless req_string.include?("*")
+
+          convert_wildcard_req(req_string)
+        end
+
+        def convert_dotnet_range_to_ruby_range(req_string)
+          lower_b, upper_b = req_string.split(",").map(&:strip)
+
+          lower_b =
+            if ["(", "["].include?(lower_b) then nil
+            elsif lower_b.start_with?("(") then "> #{lower_b.sub(/\(\s*/, '')}"
+            else ">= #{lower_b.sub(/\[\s*/, '').strip}"
+            end
+
+          upper_b =
+            if [")", "]"].include?(upper_b) then nil
+            elsif upper_b.end_with?(")") then "< #{upper_b.sub(/\s*\)/, '')}"
+            else "<= #{upper_b.sub(/\s*\]/, '').strip}"
+            end
+
+          [lower_b, upper_b].compact
+        end
+
+        def convert_wildcard_req(req_string)
+          return ">= 0" if req_string.start_with?("*")
+
+          defined_part = req_string.split("*").first
+          suffix = defined_part.end_with?(".") ? "0" : "a"
+          version = defined_part + suffix
+          "~> #{version}"
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/dotnet/version.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# Dotnet pre-release versions use 1.0.1-rc1 syntax, which Gem::Version
+# converts into 1.0.1.pre.rc1. We override the `to_s` method to stop that
+# alteration.
+
+module Dependabot
+  module Utils
+    module Dotnet
+      class Version < Gem::Version
+        def initialize(version)
+          @version_string = version.to_s
+          super
+        end
+
+        def to_s
+          @version_string
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/elixir/requirement.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "dependabot/utils/elixir/version"
+
+module Dependabot
+  module Utils
+    module Elixir
+      class Requirement < Gem::Requirement
+        AND_SEPARATOR = /\s+and\s+/.freeze
+        OR_SEPARATOR = /\s+or\s+/.freeze
+
+        # Add the double-equality matcher to the list of allowed operations
+        OPS["=="] = ->(v, r) { v == r }
+
+        # Override the version pattern to allow local versions
+        quoted = OPS.keys.map { |k| Regexp.quote k }.join "|"
+        PATTERN_RAW =
+          "\\s*(#{quoted})?\\s*(#{Utils::Elixir::Version::VERSION_PATTERN})\\s*"
+        PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+
+        # Returns an array of requirements. At least one requirement from the
+        # returned array must be satisfied for a version to be valid.
+        def self.requirements_array(requirement_string)
+          requirement_string.strip.split(OR_SEPARATOR).map do |req_string|
+            requirements = req_string.strip.split(AND_SEPARATOR)
+            new(requirements)
+          end
+        end
+
+        # Override the parser to create Utils::Elixir::Versions
+        def self.parse(obj)
+          if obj.is_a?(Gem::Version)
+            return ["=", Utils::Elixir::Version.new(obj.to_s)]
+          end
+
+          unless (matches = PATTERN.match(obj.to_s))
+            msg = "Illformed requirement [#{obj.inspect}]"
+            raise BadRequirementError, msg
+          end
+
+          return DefaultRequirement if matches[1] == ">=" && matches[2] == "0"
+
+          [matches[1] || "=", Utils::Elixir::Version.new(matches[2])]
+        end
+
+        def satisfied_by?(version)
+          version = Utils::Elixir::Version.new(version.to_s)
+          super
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/elixir/version.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+# Elixir versions can include build information, which Ruby can't parse.
+# This class augments Gem::Version with build information.
+# See https://hexdocs.pm/elixir/Version.html for details.
+
+module Dependabot
+  module Utils
+    module Elixir
+      class Version < Gem::Version
+        attr_reader :build_info
+
+        VERSION_PATTERN = Gem::Version::VERSION_PATTERN +
+                          '(\+[0-9a-zA-Z\-.]+)?'
+
+        def self.correct?(version)
+          super(version.to_s.split("+").first)
+        end
+
+        def initialize(version)
+          @version_string = version.to_s
+          version, @build_info = version.split("+")
+          super
+        end
+
+        def to_s
+          @version_string
+        end
+
+        def inspect # :nodoc:
+          "#<#{self.class} #{@version_string}>"
+        end
+
+        def <=>(other)
+          version_comparison = super(other)
+          return version_comparison unless version_comparison.zero?
+
+          unless other.is_a?(Utils::Elixir::Version)
+            return build_info.nil? ? 0 : 1
+          end
+
+          # Build information comparison
+          lhsegments = build_info.to_s.split(".").map(&:downcase)
+          rhsegments = other.build_info.to_s.split(".").map(&:downcase)
+          limit = [lhsegments.count, rhsegments.count].min
+
+          lhs = ["1", *lhsegments.first(limit)].join(".")
+          rhs = ["1", *rhsegments.first(limit)].join(".")
+
+          local_comparison = Gem::Version.new(lhs) <=> Gem::Version.new(rhs)
+
+          return local_comparison unless local_comparison.zero?
+
+          lhsegments.count <=> rhsegments.count
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/elm/requirement.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "dependabot/utils/elm/version"
+
+module Dependabot
+  module Utils
+    module Elm
+      class Requirement < Gem::Requirement
+        # Override the version pattern to allow local versions
+        PATTERN_RAW =
+          "(#{Utils::Elm::Version::VERSION_PATTERN}) (<=?) v (<=?) " \
+          "(#{Utils::Elm::Version::VERSION_PATTERN})"
+        PATTERN = /\A#{PATTERN_RAW}\z/.freeze
+        EXACT_PATTERN = /\A#{Utils::Elm::Version::VERSION_PATTERN}\z/.freeze
+
+        # Returns an array of requirements. At least one requirement from the
+        # returned array must be satisfied for a version to be valid.
+        def self.requirements_array(requirement_string)
+          [new(requirement_string)]
+        end
+
+        # Override the parser to create Utils::Elm::Versions and return an
+        # array of parsed requirements
+        def self.parse(obj)
+          # If a version is given this is an equals requirement
+          if EXACT_PATTERN.match?(obj.to_s)
+            return [["=", Utils::Elm::Version.new(obj.to_s)]]
+          end
+
+          unless (matches = PATTERN.match(obj.to_s))
+            msg = "Illformed requirement #{obj.inspect}"
+            raise BadRequirementError, msg
+          end
+
+          # If the two versions specified are identical this is an equals
+          # requirement
+          if matches[1] == matches[4] && matches[3] == "<="
+            return [["=", Utils::Elm::Version.new(matches[4])]]
+          end
+
+          [
+            [matches[2].tr("<", ">"), Utils::Elm::Version.new(matches[1])],
+            [matches[3], Utils::Elm::Version.new(matches[4])]
+          ]
+        end
+
+        # Overwrite superclass method to use `flat_map`
+        def initialize(*requirements)
+          if requirements.any?(&:nil?)
+            raise BadRequirementError, "Nil requirement not supported in Elm"
+          end
+
+          requirements = requirements.flatten
+          requirements.compact!
+          requirements.uniq!
+
+          if requirements.empty?
+            @requirements = [DefaultRequirement]
+          else
+            @requirements = requirements.flat_map { |r| self.class.parse(r) }
+            sort_requirements!
+          end
+        end
+
+        # Overwrite superclass method to use `flat_map`
+        def concat(new)
+          new = new.flatten
+          new.compact!
+          new.uniq!
+          new = new.flat_map { |r| self.class.parse(r) }
+
+          @requirements.concat new
+          sort_requirements!
+        end
+
+        def sort_requirements!
+          @requirements.sort! do |l, r|
+            comp = l.last <=> r.last # first, sort by the requirement's version
+            next comp unless comp.zero?
+
+            l.first <=> r.first # then, sort by the operator (for stability)
+          end
+        end
+
+        def satisfied_by?(version)
+          version = Utils::Elm::Version.new(version.to_s)
+          super
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/elm/version.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# Elm versions require major, minor and patch to be present
+# They don't allow any letters
+
+module Dependabot
+  module Utils
+    module Elm
+      class Version < Gem::Version
+        VERSION_PATTERN = "[0-9]+\.[0-9]+\.[0-9]+"
+        VERSION_PATTERN_REGEX = /\A#{VERSION_PATTERN}\Z/.freeze
+
+        def self.correct?(version)
+          version.to_s.match?(VERSION_PATTERN_REGEX)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/utils/go/path_converter.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "excon"
+require "nokogiri"
+
+require "dependabot/shared_helpers"
+require "dependabot/source"
+require "dependabot/utils/go/shared_helper"
+
+module Dependabot
+  module Utils
+    module Go
+      module PathConverter
+        def self.git_url_for_path(path)
+          # Save a query by manually converting golang.org/x names
+          import_path = path.gsub(%r{^golang\.org/x}, "github.com/golang")
+
+          SharedHelpers.run_helper_subprocess(
+            command: Go::SharedHelper.path,
+            function: "getVcsRemoteForImport",
+            args: { import: import_path }
+          )
+        end
+
+        # Used in dependabot-backend, which doesn't have access to any Go
+        # helpers.
+        # TODO: remove the need for this.
+        def self.git_url_for_path_without_go_helper(path)
+          # Save a query by manually converting golang.org/x names
+          tmp_path = path.gsub(%r{^golang\.org/x}, "github.com/golang")
+
+          # Currently, Dependabot::Source.new will return `nil` if it can't
+          # find a git SCH associated with a path. If it is ever extended to
+          # handle non-git sources we'll need to add an additional check here.
+          return Source.from_url(tmp_path).url if Source.from_url(tmp_path)
+          return "https://#{tmp_path}" if tmp_path.end_with?(".git")
+          return unless (metadata_response = fetch_path_metadata(path))
+
+          # Look for a GitHub, Bitbucket or GitLab URL in the response
+          metadata_response.scan(Dependabot::Source::SOURCE_REGEX) do
+            source_url = Regexp.last_match.to_s
+            return Source.from_url(source_url).url
+          end
+
+          # If none are found, parse the response and return the go-import path
+          doc = Nokogiri::XML(metadata_response)
+          doc.remove_namespaces!
+          import_details =
+            doc.xpath("//meta").
+            find { |n| n.attributes["name"]&.value == "go-import" }&.
+            attributes&.fetch("content")&.value&.split(/\s+/)
+          return unless import_details && import_details[1] == "git"
+
+          import_details[2]
+        end
+
+        def self.fetch_path_metadata(path)
+          # TODO: This is not robust! Instead, we should shell out to Go and
+          # use https://github.com/Masterminds/vcs.
+          response = Excon.get(
+            "https://#{path}?go-get=1",
+            idempotent: true,
+            **SharedHelpers.excon_defaults
+          )
+
+          return unless response.status == 200
+
+          response.body
+        end
+        private_class_method :fetch_path_metadata
+      end
+    end
+  end
+end