dependabot-hex 0.168.0 → 0.169.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 31eed84814d21be36a3ee3800ddfe37c4210f61d3e99429fe197e8fad0967928
-  data.tar.gz: c70922e59169f29d6ecadddec26284480dac9e6e7740769a2c0eae97b368eebf
+  metadata.gz: 9bb53aa83d265af13686986714c35c98e49f3ef32b136651abc8c42b5ccd97c1
+  data.tar.gz: 3ce3b23b5d2b1e5e201dad6ab334b0e3a15dee7d94301b5dc8e24ba8d9bfe63c
 SHA512:
-  metadata.gz: 2fa72370bd499519a7bb528c2fbfb0796a032c8dbc903049385835d4f0eaac435821493eb25e72607bb25f4ddef10be232eeb1442e4f7c66c673f14248bcb570
-  data.tar.gz: b85011d88ebb83acbb5fdb2ee556c774854cf87ff190ab39c0e469a97f62150af896f1f9564608be01e7e0056ba7cb1fa955bddd0dff5c099de8e09d215cde91
+  metadata.gz: 83f5c4ce8098e0b5dc1264217af357f64de44d0f168d551e92597b9ba6850fe42bfa7b6354f964b086cbb0322a2ff29743bd54579cb66c3476f10f86fd70ab52
+  data.tar.gz: 7bcb9073ec1848e5395a44f0eab013179fd66525ecb91fa8b41d9a8c25b97a8217786c6ca21ff156b19a0c3651bc196b892dde8954c32181da666a2e54660ee0

data/lib/dependabot/hex/file_updater/mixfile_sanitizer.rb

@@ -11,16 +11,40 @@ module Dependabot
           @mixfile_content = mixfile_content
         end
 
+        FILE_READ      = /File.read\(.*?\)/.freeze
+        FILE_READ_BANG = /File.read!\(.*?\)/.freeze
+        PIPE           = Regexp.escape("|>").freeze
+        VERSION_FILE   = /"VERSION"/i.freeze
+
+        NESTED_VERSION_FILE_READ = /String\.trim\(#{FILE_READ}\)/.freeze
+        NESTED_VERSION_FILE_READ_BANG = /String\.trim\(#{FILE_READ_BANG}\)/.freeze
+        PIPED_VERSION_FILE_READ =
+          /#{VERSION_FILE}[[:space:]]+#{PIPE}[[:space:]]+#{FILE_READ}/.freeze
+        PIPED_VERSION_FILE_READ_BANG =
+          /#{VERSION_FILE}[[:space:]]+#{PIPE}[[:space:]]+#{FILE_READ_BANG}/.freeze
+
         def sanitized_content
           mixfile_content.
-            gsub(/File\.read!\(.*?\)/, '"0.0.1"').
-            gsub(/File\.read\(.*?\)/, '{:ok, "0.0.1"}').
-            gsub(/^\s*config_path:.*(?:,|$)/, "")
+            yield_self(&method(:prevent_version_file_loading)).
+            yield_self(&method(:prevent_config_path_loading))
         end
 
         private
 
         attr_reader :mixfile_content
+
+        def prevent_version_file_loading(configuration)
+          configuration.
+            gsub(NESTED_VERSION_FILE_READ_BANG, 'String.trim("0.0.1")').
+            gsub(NESTED_VERSION_FILE_READ, 'String.trim({:ok, "0.0.1"})').
+            gsub(PIPED_VERSION_FILE_READ, '{:ok, "0.0.1"}').
+            gsub(PIPED_VERSION_FILE_READ_BANG, '"0.0.1"')
+        end
+
+        def prevent_config_path_loading(configuration)
+          configuration.
+            gsub(/^\s*config_path:.*(?:,|$)/, "")
+        end
       end
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-hex
 version: !ruby/object:Gem::Version
-  version: 0.168.0
+  version: 0.169.3
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-11-23 00:00:00.000000000 Z
+date: 2021-12-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.168.0
+        version: 0.169.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.168.0
+        version: 0.169.3
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -228,7 +228,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.2.22
+rubygems_version: 3.2.32
 signing_key: 
 specification_version: 4
 summary: Elixir (Hex) support for dependabot