dependabot-core 0.79.4 → 0.80.0

data/lib/dependabot/file_updaters/dotnet/nuget.rb

@@ -1,151 +0,0 @@
-# frozen_string_literal: true
-
-require "dependabot/file_updaters/base"
-
-module Dependabot
-  module FileUpdaters
-    module Dotnet
-      class Nuget < Dependabot::FileUpdaters::Base
-        require_relative "nuget/packages_config_declaration_finder"
-        require_relative "nuget/project_file_declaration_finder"
-        require_relative "nuget/property_value_updater"
-
-        def self.updated_files_regex
-          [
-            %r{^[^/]*\.[a-z]{2}proj$},
-            /^packages\.config$/i
-          ]
-        end
-
-        def updated_dependency_files
-          updated_files = dependency_files.dup
-
-          # Loop through each of the changed requirements, applying changes to
-          # all files for that change. Note that the logic is different here
-          # to other languages because donet has property inheritance across
-          # files
-          dependencies.each do |dependency|
-            updated_files = update_files_for_dependency(
-              files: updated_files,
-              dependency: dependency
-            )
-          end
-
-          updated_files.reject! { |f| dependency_files.include?(f) }
-
-          raise "No files changed!" if updated_files.none?
-
-          updated_files
-        end
-
-        private
-
-        def project_files
-          dependency_files.select { |df| df.name.match?(/\.[a-z]{2}proj$/) }
-        end
-
-        def packages_config_files
-          dependency_files.select do |f|
-            f.name.split("/").last.casecmp("packages.config").zero?
-          end
-        end
-
-        def check_required_files
-          return if project_files.any? || packages_config_files.any?
-
-          raise "No project file or packages.config!"
-        end
-
-        def update_files_for_dependency(files:, dependency:)
-          # The UpdateChecker ensures the order of requirements is preserved
-          # when updating, so we can zip them together in new/old pairs.
-          reqs = dependency.requirements.zip(dependency.previous_requirements).
-                 reject { |new_req, old_req| new_req == old_req }
-
-          # Loop through each changed requirement and update the files
-          reqs.each do |new_req, old_req|
-            raise "Bad req match" unless new_req[:file] == old_req[:file]
-            next if new_req[:requirement] == old_req[:requirement]
-
-            file = files.find { |f| f.name == new_req.fetch(:file) }
-
-            files =
-              if new_req.dig(:metadata, :property_name)
-                update_property_value(files, file, new_req)
-              else
-                update_declaration(files, dependency, file, old_req, new_req)
-              end
-          end
-
-          files
-        end
-
-        def update_property_value(files, file, req)
-          files = files.dup
-          property_name = req.fetch(:metadata).fetch(:property_name)
-
-          PropertyValueUpdater.
-            new(dependency_files: files).
-            update_files_for_property_change(
-              property_name: property_name,
-              updated_value: req.fetch(:requirement),
-              callsite_file: file
-            )
-        end
-
-        def update_declaration(files, dependency, file, old_req, new_req)
-          files = files.dup
-
-          updated_content = file.content
-
-          original_declarations(dependency, old_req).each do |old_dec|
-            updated_content = updated_content.gsub(
-              old_dec,
-              updated_declaration(old_dec, old_req, new_req)
-            )
-          end
-
-          raise "Expected content to change!" if updated_content == file.content
-
-          files[files.index(file)] =
-            updated_file(file: file, content: updated_content)
-          files
-        end
-
-        def original_declarations(dependency, requirement)
-          declaration_finder(dependency, requirement).declaration_strings
-        end
-
-        def declaration_finder(dependency, requirement)
-          @declaration_finders ||= {}
-
-          requirement_fn = requirement.fetch(:file)
-          @declaration_finders[dependency.hash + requirement.hash] ||=
-            if requirement_fn.split("/").last.casecmp("packages.config").zero?
-              PackagesConfigDeclarationFinder.new(
-                dependency_name: dependency.name,
-                declaring_requirement: requirement,
-                packages_config:
-                  packages_config_files.find { |f| f.name == requirement_fn }
-              )
-            else
-              ProjectFileDeclarationFinder.new(
-                dependency_name: dependency.name,
-                declaring_requirement: requirement,
-                dependency_files: dependency_files
-              )
-            end
-        end
-
-        def updated_declaration(old_declaration, previous_req, requirement)
-          original_req_string = previous_req.fetch(:requirement)
-
-          old_declaration.gsub(
-            original_req_string,
-            requirement.fetch(:requirement)
-          )
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/file_updaters/dotnet/nuget/packages_config_declaration_finder.rb

@@ -1,69 +0,0 @@
-# frozen_string_literal: true
-
-require "nokogiri"
-require "dependabot/file_updaters/dotnet/nuget"
-
-module Dependabot
-  module FileUpdaters
-    module Dotnet
-      class Nuget
-        class PackagesConfigDeclarationFinder
-          DECLARATION_REGEX =
-            %r{<package [^>]*?/>|
-               <package [^>]*?[^/]>.*?</package>}mx.freeze
-
-          attr_reader :dependency_name, :declaring_requirement,
-                      :packages_config
-
-          def initialize(dependency_name:, packages_config:,
-                         declaring_requirement:)
-            @dependency_name        = dependency_name
-            @packages_config        = packages_config
-            @declaring_requirement  = declaring_requirement
-
-            if declaring_requirement[:file].split("/").last.
-               casecmp("packages.config").zero?
-              return
-            end
-
-            raise "Requirement not from packages.config!"
-          end
-
-          def declaration_strings
-            @declaration_strings ||= fetch_declaration_strings
-          end
-
-          def declaration_nodes
-            declaration_strings.map do |declaration_string|
-              Nokogiri::XML(declaration_string)
-            end
-          end
-
-          private
-
-          def fetch_declaration_strings
-            deep_find_declarations(packages_config.content).select do |nd|
-              node = Nokogiri::XML(nd)
-              node.remove_namespaces!
-              node = node.at_xpath("/package")
-
-              node_name = node.attribute("id")&.value&.strip ||
-                          node.at_xpath("./id")&.content&.strip
-              next false unless node_name == dependency_name
-
-              node_requirement = node.attribute("version")&.value&.strip ||
-                                 node.at_xpath("./version")&.content&.strip
-              node_requirement == declaring_requirement.fetch(:requirement)
-            end
-          end
-
-          def deep_find_declarations(string)
-            string.scan(DECLARATION_REGEX).flat_map do |matching_node|
-              [matching_node, *deep_find_declarations(matching_node[0..-2])]
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/file_updaters/dotnet/nuget/project_file_declaration_finder.rb

@@ -1,78 +0,0 @@
-# frozen_string_literal: true
-
-require "nokogiri"
-require "dependabot/file_updaters/dotnet/nuget"
-
-module Dependabot
-  module FileUpdaters
-    module Dotnet
-      class Nuget
-        class ProjectFileDeclarationFinder
-          DECLARATION_REGEX =
-            %r{
-              <PackageReference [^>]*?/>|
-              <PackageReference [^>]*?[^/]>.*?</PackageReference>|
-              <Dependency [^>]*?/>|
-              <Dependency [^>]*?[^/]>.*?</Dependency>|
-              <DevelopmentDependency [^>]*?/>|
-              <DevelopmentDependency [^>]*?[^/]>.*?</DevelopmentDependency>
-            }mx.freeze
-
-          attr_reader :dependency_name, :declaring_requirement,
-                      :dependency_files
-
-          def initialize(dependency_name:, dependency_files:,
-                         declaring_requirement:)
-            @dependency_name       = dependency_name
-            @dependency_files      = dependency_files
-            @declaring_requirement = declaring_requirement
-          end
-
-          def declaration_strings
-            @declaration_strings ||= fetch_declaration_strings
-          end
-
-          def declaration_nodes
-            declaration_strings.map do |declaration_string|
-              Nokogiri::XML(declaration_string)
-            end
-          end
-
-          private
-
-          def fetch_declaration_strings
-            deep_find_declarations(declaring_file.content).select do |nd|
-              node = Nokogiri::XML(nd)
-              node.remove_namespaces!
-              node = node.at_xpath("/PackageReference") ||
-                     node.at_xpath("/Dependency") ||
-                     node.at_xpath("/DevelopmentDependency")
-
-              node_name = node.attribute("Include")&.value&.strip ||
-                          node.at_xpath("./Include")&.content&.strip
-              next false unless node_name == dependency_name
-
-              node_requirement = node.attribute("Version")&.value&.strip ||
-                                 node.at_xpath("./Version")&.content&.strip
-              node_requirement == declaring_requirement.fetch(:requirement)
-            end
-          end
-
-          def deep_find_declarations(string)
-            string.scan(DECLARATION_REGEX).flat_map do |matching_node|
-              [matching_node, *deep_find_declarations(matching_node[0..-2])]
-            end
-          end
-
-          def declaring_file
-            filename = declaring_requirement.fetch(:file)
-            declaring_file = dependency_files.find { |f| f.name == filename }
-            return declaring_file if declaring_file
-
-            raise "No file found with name #{filename}!"
-          end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/file_updaters/dotnet/nuget/property_value_updater.rb

@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-require "nokogiri"
-
-require "dependabot/dependency_file"
-require "dependabot/file_updaters/dotnet/nuget"
-require "dependabot/file_parsers/dotnet/nuget/property_value_finder"
-
-module Dependabot
-  module FileUpdaters
-    module Dotnet
-      class Nuget
-        class PropertyValueUpdater
-          def initialize(dependency_files:)
-            @dependency_files = dependency_files
-          end
-
-          def update_files_for_property_change(property_name:, updated_value:,
-                                               callsite_file:)
-            declaration_details =
-              property_value_finder.
-              property_details(
-                property_name: property_name,
-                callsite_file: callsite_file
-              )
-
-            declaration_file = dependency_files.find do |f|
-              declaration_details.fetch(:file) == f.name
-            end
-            node = declaration_details.fetch(:node)
-
-            updated_content = declaration_file.content.sub(
-              %r{<#{Regexp.quote(node.name)}>
-                 \s*#{Regexp.quote(node.content)}\s*
-                 </#{Regexp.quote(node.name)}>}xm,
-              "<#{node.name}>#{updated_value}</#{node.name}>"
-            )
-
-            files = dependency_files.dup
-            files[files.index(declaration_file)] =
-              update_file(file: declaration_file, content: updated_content)
-            files
-          end
-
-          private
-
-          attr_reader :dependency_files
-
-          def property_value_finder
-            @property_value_finder ||=
-              FileParsers::Dotnet::Nuget::PropertyValueFinder.
-              new(dependency_files: dependency_files)
-          end
-
-          def update_file(file:, content:)
-            updated_file = file.dup
-            updated_file.content = content
-            updated_file
-          end
-        end
-      end
-    end
-  end
-end

data/lib/dependabot/metadata_finders/dotnet/nuget.rb

@@ -1,116 +0,0 @@
-# frozen_string_literal: true
-
-require "nokogiri"
-require "dependabot/metadata_finders/base"
-
-module Dependabot
-  module MetadataFinders
-    module Dotnet
-      class Nuget < Dependabot::MetadataFinders::Base
-        private
-
-        def look_up_source
-          return Source.from_url(dependency_source_url) if dependency_source_url
-
-          look_up_source_in_nuspec(dependency_nuspec_file)
-        end
-
-        def look_up_source_in_nuspec(nuspec)
-          potential_source_urls = [
-            nuspec.at_css("package > metadata > repository")&.
-              attribute("url")&.value,
-            nuspec.at_css("package > metadata > repository > url")&.content,
-            nuspec.at_css("package > metadata > projectUrl")&.content,
-            nuspec.at_css("package > metadata > licenseUrl")&.content
-          ].compact
-
-          source_url = potential_source_urls.find { |url| Source.from_url(url) }
-          source_url ||= source_from_anywhere_in_nuspec(nuspec)
-
-          Source.from_url(source_url)
-        end
-
-        def source_from_anywhere_in_nuspec(nuspec)
-          github_urls = []
-          nuspec.to_s.scan(Source::SOURCE_REGEX) do
-            github_urls << Regexp.last_match.to_s
-          end
-
-          github_urls.find do |url|
-            repo = Source.from_url(url).repo
-            repo.downcase.end_with?(dependency.name.downcase)
-          end
-        end
-
-        def dependency_nuspec_file
-          return @dependency_nuspec_file unless @dependency_nuspec_file.nil?
-
-          response = Excon.get(
-            dependency_nuspec_url,
-            headers: auth_header,
-            idempotent: true,
-            **SharedHelpers.excon_defaults
-          )
-
-          @dependency_nuspec_file = Nokogiri::XML(response.body)
-        end
-
-        # rubocop:disable Metrics/AbcSize
-        def dependency_nuspec_url
-          source = dependency.requirements.
-                   find { |r| r&.fetch(:source) }&.fetch(:source)
-
-          if source&.key?(:nuspec_url)
-            source.fetch(:nuspec_url) ||
-              "https://api.nuget.org/v3-flatcontainer/"\
-              "#{dependency.name.downcase}/#{dependency.version}/"\
-              "#{dependency.name.downcase}.nuspec"
-          elsif source&.key?(:nuspec_url)
-            source.fetch("nuspec_url") ||
-              "https://api.nuget.org/v3-flatcontainer/"\
-              "#{dependency.name.downcase}/#{dependency.version}/"\
-              "#{dependency.name.downcase}.nuspec"
-          else
-            "https://api.nuget.org/v3-flatcontainer/"\
-            "#{dependency.name.downcase}/#{dependency.version}/"\
-            "#{dependency.name.downcase}.nuspec"
-          end
-        end
-        # rubocop:enable Metrics/AbcSize
-
-        def dependency_source_url
-          source = dependency.requirements.
-                   find { |r| r&.fetch(:source) }&.fetch(:source)
-
-          return unless source
-          return source.fetch(:source_url) if source.key?(:source_url)
-
-          source.fetch("source_url")
-        end
-
-        def auth_header
-          source = dependency.requirements.
-                   find { |r| r&.fetch(:source) }&.fetch(:source)
-          url = source&.fetch(:url, nil) || source&.fetch("url")
-
-          token = credentials.
-                  select { |cred| cred["type"] == "nuget_feed" }.
-                  find { |cred| cred["url"] == url }&.
-                  fetch("token", nil)
-
-          return {} unless token
-
-          if token.include?(":")
-            encoded_token = Base64.encode64(token).delete("\n")
-            { "Authorization" => "Basic #{encoded_token}" }
-          elsif Base64.decode64(token).ascii_only? &&
-                Base64.decode64(token).include?(":")
-            { "Authorization" => "Basic #{token.delete("\n")}" }
-          else
-            { "Authorization" => "Bearer #{token}" }
-          end
-        end
-      end
-    end
-  end
-end