dependabot-gradle 0.117.0 → 0.117.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2c733a1daafb722d508d9598de8c5e45320cb40871b8a5ea147a6ed026e59474
-  data.tar.gz: 35e5b70e71ab99d03d5da4ddd98f05538753daae0a96738fd7bb7a29ad219372
+  metadata.gz: b9734369adf8219da2f0a1d7322406c625de5c685cd8ddfddda2f49889341ac8
+  data.tar.gz: c57597740902be1e612a7674c04799ff7734bb606c235c0f181b0226638d40c2
 SHA512:
-  metadata.gz: 885c60e0985fba9d590bec1d3746f06fa0568ecf0775a0084af17d2a4206437b625760c1c9cd8ba082be0df7a932010e010b1548fe03cda29eb131528b2443e1
-  data.tar.gz: c8ba9b953a01e27a4966a10bb961b02c0ab15b949d70dad59fb09882b4d614efcc43e8324db55ac505717dcdb1a377545f9dbb7c4f89f8d09d1b255d2f5b64d5
+  metadata.gz: 6bbdb308737a9a91b4e4d1ebae70c343cfa9754acd619f44d3e74d3b1aef30ed3b2d3c395bd9f71a4046427b575b49a41312dc93e90dba9ae8375caffb574848
+  data.tar.gz: 120897fe73b023f1dcc760990ca65a858c665483a01086f4fd3ff48390a8225d13811c83801e1987705b8a8682e3f9163f3de338c26a9791caf945cbfe9ef062

data/lib/dependabot/gradle/update_checker.rb

@@ -115,6 +115,7 @@ module Dependabot
           VersionFinder.new(
             dependency: dependency,
             dependency_files: dependency_files,
+            credentials: credentials,
             ignored_versions: ignored_versions,
             security_advisories: security_advisories
           )
@@ -125,6 +126,7 @@ module Dependabot
           MultiDependencyUpdater.new(
             dependency: dependency,
             dependency_files: dependency_files,
+            credentials: credentials,
             target_version_details: latest_version_details,
             ignored_versions: ignored_versions
           )

data/lib/dependabot/gradle/update_checker/multi_dependency_updater.rb

@@ -10,10 +10,11 @@ module Dependabot
         require_relative "version_finder"
         require_relative "requirements_updater"
 
-        def initialize(dependency:, dependency_files:,
+        def initialize(dependency:, dependency_files:, credentials:,
                        target_version_details:, ignored_versions:)
           @dependency       = dependency
           @dependency_files = dependency_files
+          @credentials      = credentials
           @target_version   = target_version_details&.fetch(:version)
           @source_url       = target_version_details&.fetch(:source_url)
           @ignored_versions = ignored_versions
@@ -27,6 +28,7 @@ module Dependabot
               VersionFinder.new(
                 dependency: dep,
                 dependency_files: dependency_files,
+                credentials: credentials,
                 ignored_versions: ignored_versions,
                 security_advisories: []
               ).versions.
@@ -53,8 +55,8 @@ module Dependabot
 
         private
 
-        attr_reader :dependency, :dependency_files, :target_version,
-                    :source_url, :ignored_versions
+        attr_reader :dependency, :dependency_files, :credentials,
+                    :target_version, :source_url, :ignored_versions
 
         def dependencies_to_update
           @dependencies_to_update ||=

data/lib/dependabot/gradle/update_checker/version_finder.rb

@@ -15,12 +15,14 @@ module Dependabot
         GRADLE_PLUGINS_REPO = "https://plugins.gradle.org/m2"
         TYPE_SUFFICES = %w(jre android java).freeze
 
-        def initialize(dependency:, dependency_files:, ignored_versions:,
-                       security_advisories:)
+        def initialize(dependency:, dependency_files:, credentials:,
+                       ignored_versions:, security_advisories:)
           @dependency          = dependency
           @dependency_files    = dependency_files
+          @credentials         = credentials
           @ignored_versions    = ignored_versions
           @security_advisories = security_advisories
+          @forbidden_urls      = []
         end
 
         def latest_version_details
@@ -49,22 +51,27 @@ module Dependabot
 
         def versions
           version_details =
-            repository_urls.map do |url|
+            repositories.map do |repository_details|
+              url = repository_details.fetch("url")
               next google_version_details if url == GOOGLE_MAVEN_REPO
 
-              dependency_metadata(url).css("versions > version").
+              dependency_metadata(repository_details).css("versions > version").
                 select { |node| version_class.correct?(node.content) }.
                 map { |node| version_class.new(node.content) }.
                 map { |version| { version: version, source_url: url } }
             end.flatten.compact
 
+          if version_details.none? && forbidden_urls.any?
+            raise PrivateSourceAuthenticationFailure, forbidden_urls.first
+          end
+
           version_details.sort_by { |details| details.fetch(:version) }
         end
 
         private
 
-        attr_reader :dependency, :dependency_files, :ignored_versions,
-                    :security_advisories
+        attr_reader :dependency, :dependency_files, :credentials,
+                    :ignored_versions, :forbidden_urls, :security_advisories
 
         def filter_prereleases(possible_versions)
           return possible_versions if wants_prerelease?
@@ -160,47 +167,97 @@ module Dependabot
           nil
         end
 
-        def dependency_metadata(repository_url)
+        def dependency_metadata(repository_details)
           @dependency_metadata ||= {}
-          @dependency_metadata[repository_url] ||=
+          @dependency_metadata[repository_details.hash] ||=
             begin
               response = Excon.get(
-                dependency_metadata_url(repository_url),
+                dependency_metadata_url(repository_details.fetch("url")),
+                user: repository_details.fetch("username"),
+                password: repository_details.fetch("password"),
                 idempotent: true,
                 **SharedHelpers.excon_defaults
               )
+              check_response(response, repository_details.fetch("url"))
               Nokogiri::XML(response.body)
+            rescue URI::InvalidURIError
+              Nokogiri::XML("")
             rescue Excon::Error::Socket, Excon::Error::Timeout,
                    Excon::Error::TooManyRedirects
-              namespace = Gradle::FileParser::RepositoriesFinder
-              central = namespace::CENTRAL_REPO_URL
-              raise if repository_url == central
+              raise if central_repo_urls.include?(repository_details["url"])
 
               Nokogiri::XML("")
             end
         end
 
         def repository_urls
-          plugin? ? plugin_repository_urls : dependency_repository_urls
+          plugin? ? plugin_repository_details : dependency_repository_details
+        end
+
+        def check_response(response, repository_url)
+          return unless [401, 403].include?(response.status)
+          return if @forbidden_urls.include?(repository_url)
+          return if central_repo_urls.include?(repository_url)
+
+          @forbidden_urls << repository_url
+        end
+
+        def repositories
+          return @repositories if @repositories
+
+          details = if plugin?
+                      plugin_repository_details +
+                        credentials_repository_details
+                    else
+                      dependency_repository_details +
+                        credentials_repository_details
+                    end
+
+          @repositories =
+            details.reject do |repo|
+              next if repo["password"]
+
+              # Reject this entry if an identical one with a password exists
+              details.any? { |r| r["url"] == repo["url"] && r["password"] }
+            end
         end
 
-        def dependency_repository_urls
+        def credentials_repository_details
+          credentials.
+            select { |cred| cred["type"] == "maven_repository" }.
+            map do |cred|
+            {
+              "url" => cred.fetch("url").gsub(%r{/+$}, ""),
+              "username" => cred.fetch("username", nil),
+              "password" => cred.fetch("password", nil)
+            }
+          end
+        end
+
+        def dependency_repository_details
           requirement_files =
             dependency.requirements.
             map { |r| r.fetch(:file) }.
             map { |nm| dependency_files.find { |f| f.name == nm } }
 
-          @dependency_repository_urls ||=
+          @dependency_repository_details ||=
             requirement_files.flat_map do |target_file|
               Gradle::FileParser::RepositoriesFinder.new(
                 dependency_files: dependency_files,
                 target_dependency_file: target_file
-              ).repository_urls
+              ).repository_urls.
+                map do |url|
+                  { "url" => url, "username" => nil, "password" => nil }
+                end
             end.uniq
         end
 
-        def plugin_repository_urls
-          [GRADLE_PLUGINS_REPO] + dependency_repository_urls
+        def plugin_repository_details
+          [{
+            "url" => GRADLE_PLUGINS_REPO,
+            "username" => nil,
+            "password" => nil
+          }] + dependency_repository_details
         end
 
         def matches_dependency_version_type?(comparison_version)
@@ -243,6 +300,14 @@ module Dependabot
           dependency.requirements.any? { |r| r.fetch(:groups) == ["plugins"] }
         end
 
+        def central_repo_urls
+          central_url_without_protocol =
+            Gradle::FileParser::RepositoriesFinder::CENTRAL_REPO_URL.
+            gsub(%r{^.*://}, "")
+
+          %w(http:// https://).map { |p| p + central_url_without_protocol }
+        end
+
         def version_class
           Gradle::Version
         end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-gradle
 version: !ruby/object:Gem::Version
-  version: 0.117.0
+  version: 0.117.1
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-03 00:00:00.000000000 Z
+date: 2020-03-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.0
+        version: 0.117.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.117.0
+        version: 0.117.1
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement