dependabot-gradle 0.116.4 → 0.117.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b9b6a44ec8dd24144a9e0f4d9b227a8aa02eb8b0deb62baea836eb6a162072b
-  data.tar.gz: 9ba2fe1812949fca81bb1f2a414980f6dfc56dac53f6dc748a8a9a965292080b
+  metadata.gz: af14030f83982d915389ba18f0a00f6b5f125927939098e1dc327de40c9b0d8d
+  data.tar.gz: 93dc930271b9aaa0ef6c1e8bc314569f86635c4c79956737f07edf31cce8a036
 SHA512:
-  metadata.gz: b6b1479def76f0b0e0997f8be2afb2d96910d84e58bbe446b184209a597fb6ad03b32aec6fc5be5e7437c0f17920ff113cb8aaefdf42194d1418ac925aee9124
-  data.tar.gz: bea511c449a4b4090eb7b4a702996bbce1d92b2a58599dcbc7883dcf80e3985db9cf998b911243df1c10f7d24a26c61e0170bb626919911bb34f2cfc9c2c9b28
+  metadata.gz: a141590f583b0caf370fc3fefad5494f892f2bd88cd13854408be0d7bbb45105476ddb6498b091887048bd8982b375124d85673c8605ddd04325ffdb77e0f935
+  data.tar.gz: dc3ca9f1afe6b1f583275305d34d52e673a0365d30cf19eabc4c02eda8b45f8c1dc786d4ed9d3a89d96e8fb77a47db22e3ed535aa5f3790a17364e8b29038dc7

data/lib/dependabot/gradle/update_checker.rb

@@ -115,6 +115,7 @@ module Dependabot
           VersionFinder.new(
             dependency: dependency,
             dependency_files: dependency_files,
+            credentials: credentials,
             ignored_versions: ignored_versions,
             security_advisories: security_advisories
           )
@@ -125,6 +126,7 @@ module Dependabot
           MultiDependencyUpdater.new(
             dependency: dependency,
             dependency_files: dependency_files,
+            credentials: credentials,
             target_version_details: latest_version_details,
             ignored_versions: ignored_versions
           )

data/lib/dependabot/gradle/update_checker/multi_dependency_updater.rb

@@ -10,10 +10,11 @@ module Dependabot
         require_relative "version_finder"
         require_relative "requirements_updater"
 
-        def initialize(dependency:, dependency_files:,
+        def initialize(dependency:, dependency_files:, credentials:,
                        target_version_details:, ignored_versions:)
           @dependency       = dependency
           @dependency_files = dependency_files
+          @credentials      = credentials
           @target_version   = target_version_details&.fetch(:version)
           @source_url       = target_version_details&.fetch(:source_url)
           @ignored_versions = ignored_versions
@@ -27,6 +28,7 @@ module Dependabot
               VersionFinder.new(
                 dependency: dep,
                 dependency_files: dependency_files,
+                credentials: credentials,
                 ignored_versions: ignored_versions,
                 security_advisories: []
               ).versions.
@@ -53,8 +55,8 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :target_version,
-                    :source_url, :ignored_versions
+        attr_reader :dependency, :dependency_files, :credentials,
+                    :target_version, :source_url, :ignored_versions
 
         def dependencies_to_update
           @dependencies_to_update ||=

data/lib/dependabot/gradle/update_checker/version_finder.rb

@@ -15,12 +15,14 @@ module Dependabot
         GRADLE_PLUGINS_REPO = "https://plugins.gradle.org/m2"
         TYPE_SUFFICES = %w(jre android java).freeze
 
-        def initialize(dependency:, dependency_files:, ignored_versions:,
-                       security_advisories:)
+        def initialize(dependency:, dependency_files:, credentials:,
+                       ignored_versions:, security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
+          @credentials         = credentials
           @ignored_versions    = ignored_versions
           @security_advisories = security_advisories
+          @forbidden_urls      = []
         end
 
         def latest_version_details
@@ -49,22 +51,27 @@ module Dependabot
 
         def versions
           version_details =
-            repository_urls.map do |url|
+            repositories.map do |repository_details|
+              url = repository_details.fetch("url")
               next google_version_details if url == GOOGLE_MAVEN_REPO
 
-              dependency_metadata(url).css("versions > version").
+              dependency_metadata(repository_details).css("versions > version").
                 select { |node| version_class.correct?(node.content) }.
                 map { |node| version_class.new(node.content) }.
                 map { |version| { version: version, source_url: url } }
             end.flatten.compact
 
+          if version_details.none? && forbidden_urls.any?
+            raise PrivateSourceAuthenticationFailure, forbidden_urls.first
+          end
+
           version_details.sort_by { |details| details.fetch(:version) }
         end
 
         private
 
-        attr_reader :dependency, :dependency_files, :ignored_versions,
-                    :security_advisories
+        attr_reader :dependency, :dependency_files, :credentials,
+                    :ignored_versions, :forbidden_urls, :security_advisories
 
         def filter_prereleases(possible_versions)
           return possible_versions if wants_prerelease?
@@ -160,47 +167,97 @@ module Dependabot
           nil
         end
 
-        def dependency_metadata(repository_url)
+        def dependency_metadata(repository_details)
           @dependency_metadata ||= {}
-          @dependency_metadata[repository_url] ||=
+          @dependency_metadata[repository_details.hash] ||=
             begin
               response = Excon.get(
-                dependency_metadata_url(repository_url),
+                dependency_metadata_url(repository_details.fetch("url")),
+                user: repository_details.fetch("username"),
+                password: repository_details.fetch("password"),
                 idempotent: true,
                 **SharedHelpers.excon_defaults
               )
+              check_response(response, repository_details.fetch("url"))
               Nokogiri::XML(response.body)
+            rescue URI::InvalidURIError
+              Nokogiri::XML("")
             rescue Excon::Error::Socket, Excon::Error::Timeout,
                    Excon::Error::TooManyRedirects
-              namespace = Gradle::FileParser::RepositoriesFinder
-              central = namespace::CENTRAL_REPO_URL
-              raise if repository_url == central
+              raise if central_repo_urls.include?(repository_details["url"])
 
               Nokogiri::XML("")
             end
         end
 
         def repository_urls
-          plugin? ? plugin_repository_urls : dependency_repository_urls
+          plugin? ? plugin_repository_details : dependency_repository_details
+        end
+
+        def check_response(response, repository_url)
+          return unless [401, 403].include?(response.status)
+          return if @forbidden_urls.include?(repository_url)
+          return if central_repo_urls.include?(repository_url)
+
+          @forbidden_urls << repository_url
+        end
+
+        def repositories
+          return @repositories if @repositories
+
+          details = if plugin?
+                      plugin_repository_details +
+                        credentials_repository_details
+                    else
+                      dependency_repository_details +
+                        credentials_repository_details
+                    end
+
+          @repositories =
+            details.reject do |repo|
+              next if repo["password"]
+
+              # Reject this entry if an identical one with a password exists
+              details.any? { |r| r["url"] == repo["url"] && r["password"] }
+            end
         end
 
-        def dependency_repository_urls
+        def credentials_repository_details
+          credentials.
+            select { |cred| cred["type"] == "maven_repository" }.
+            map do |cred|
+            {
+              "url" => cred.fetch("url").gsub(%r{/+$}, ""),
+              "username" => cred.fetch("username", nil),
+              "password" => cred.fetch("password", nil)
+            }
+          end
+        end
+
+        def dependency_repository_details
           requirement_files =
             dependency.requirements.
             map { |r| r.fetch(:file) }.
             map { |nm| dependency_files.find { |f| f.name == nm } }
 
-          @dependency_repository_urls ||=
+          @dependency_repository_details ||=
             requirement_files.flat_map do |target_file|
               Gradle::FileParser::RepositoriesFinder.new(
                 dependency_files: dependency_files,
                 target_dependency_file: target_file
-              ).repository_urls
+              ).repository_urls.
+                map do |url|
+                  { "url" => url, "username" => nil, "password" => nil }
+                end
             end.uniq
         end
 
-        def plugin_repository_urls
-          [GRADLE_PLUGINS_REPO] + dependency_repository_urls
+        def plugin_repository_details
+          [{
+            "url" => GRADLE_PLUGINS_REPO,
+            "username" => nil,
+            "password" => nil
+          }] + dependency_repository_details
         end
 
         def matches_dependency_version_type?(comparison_version)
@@ -243,6 +300,14 @@ module Dependabot
           dependency.requirements.any? { |r| r.fetch(:groups) == ["plugins"] }
         end
 
+        def central_repo_urls
+          central_url_without_protocol =
+            Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL.
+            gsub(%r{^.*://}, "")
+
+          %w(http:// https://).map { |p| p + central_url_without_protocol }
+        end
+
         def version_class
           Gradle::Version
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.116.4
+  version: 0.117.2
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-29 00:00:00.000000000 Z
+date: 2020-03-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.116.4
+        version: 0.117.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.116.4
+        version: 0.117.2
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -114,26 +114,26 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.79.0
+        version: 0.80.1
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.79.0
+        version: 0.80.1
 - !ruby/object:Gem::Dependency
   name: vcr
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
         version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - '='
       - !ruby/object:Gem::Version
         version: '5.0'
 - !ruby/object:Gem::Dependency