dependabot-maven 0.140.3 → 0.143.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: faa01084789ce9d35656ae869fec4869cca61e2df243e1ddaeb74b2282c8c314
-  data.tar.gz: 665edebdc3fbdd17a11e19952df56a2e9025f3e93ff13bdab68a53f11c2676d0
+  metadata.gz: ceef68bb9cd96abacaebefb8f54a6a0aa493f1cf01eb6abef56f05c68a15aeeb
+  data.tar.gz: 0b83dd0fabb5c31cc1eca98ca4688dd0a450eb3082719b434534a6bb4776a615
 SHA512:
-  metadata.gz: 53fc158fc5e63b88681d89a3561167331012accf9765a8be2d49840679ac654eb7116058155d5ccc4f32732979c7dcdf8f67cbdfcbf898fdd9e8eb8d4edc8c5e
-  data.tar.gz: 3dc3738180ca20c9894b915dde558c49830fef8f93ea9de75604e46bf360662d6fe7a4b880218fee3abf57ccebdb440b7e6873d8e2a3655a85c7f02b06f57626
+  metadata.gz: 277181d30fddd6aebc0d2f7493b0aca2a0d7590a18a1edf42ee56277ab3d529a3f8d02c79f58e15a063a8d6a43d81554acbc5a6fe1c37a15ce00a3b36211045f
+  data.tar.gz: 25d7d938d1fece4c7a0d0b3ba6a04166a46aa61c8f9ffce43f5aa10014e8791c43a8dd69a533c3426a19820eb9133d84daed6ac71b023ad4e1a5021fbe7461cc

data/lib/dependabot/maven/metadata_finder.rb

@@ -6,6 +6,7 @@ require "dependabot/metadata_finders/base"
 require "dependabot/file_fetchers/base"
 require "dependabot/maven/file_parser"
 require "dependabot/maven/file_parser/repositories_finder"
+require "dependabot/maven/utils/auth_headers_finder"
 
 module Dependabot
   module Maven
@@ -104,7 +105,7 @@ module Dependabot
           "#{dependency.version}/"\
           "#{dependency_artifact_id}-#{dependency.version}.pom",
           idempotent: true,
-          **SharedHelpers.excon_defaults(headers: auth_details)
+          **SharedHelpers.excon_defaults(headers: auth_headers)
         )
 
         @dependency_pom_file = Nokogiri::XML(response.body)
@@ -135,7 +136,7 @@ module Dependabot
         response = Excon.get(
           substitute_properties_in_source_url(url, pom),
           idempotent: true,
-          **SharedHelpers.excon_defaults(headers: auth_details)
+          **SharedHelpers.excon_defaults(headers: auth_headers)
         )
 
         Nokogiri::XML(response.body)
@@ -156,21 +157,8 @@ module Dependabot
         "#{maven_repo_url}/#{group_id.tr('.', '/')}/#{artifact_id}"
       end
 
-      def auth_details
-        cred =
-          credentials.select { |c| c["type"] == "maven_repository" }.
-          find do |c|
-            cred_url = c.fetch("url").gsub(%r{/+$}, "")
-            next false unless cred_url == maven_repo_url
-
-            c.fetch("username", nil)
-          end
-
-        return {} unless cred
-
-        token = cred.fetch("username") + ":" + cred.fetch("password")
-        encoded_token = Base64.encode64(token).delete("\n")
-        { "Authorization" => "Basic #{encoded_token}" }
+      def auth_headers
+        @auth_headers ||= Utils::AuthHeadersFinder.new(credentials).auth_headers(maven_repo_url)
       end
     end
   end

data/lib/dependabot/maven/requirement.rb

@@ -7,6 +7,7 @@ module Dependabot
   module Maven
     class Requirement < Gem::Requirement
       quoted = OPS.keys.map { |k| Regexp.quote k }.join("|")
+      OR_SYNTAX = /(?<=\]|\)),/.freeze
       PATTERN_RAW =
         "\\s*(#{quoted})?\\s*(#{Maven::Version::VERSION_PATTERN})\\s*"
       PATTERN = /\A#{PATTERN_RAW}\z/.freeze
@@ -32,7 +33,14 @@ module Dependabot
 
       def initialize(*requirements)
         requirements = requirements.flatten.flat_map do |req_string|
-          convert_java_constraint_to_ruby_constraint(req_string)
+          # NOTE: Support ruby-style version requirements that are created from
+          # PR ignore conditions
+          version_reqs = req_string.split(",").map(&:strip)
+          if version_reqs.all? { |s| Gem::Requirement::PATTERN.match?(s) }
+            version_reqs
+          else
+            convert_java_constraint_to_ruby_constraint(req_string)
+          end
         end
 
         super(requirements)
@@ -46,7 +54,9 @@ module Dependabot
       private
 
       def self.split_java_requirement(req_string)
-        req_string.split(/(?<=\]|\)),/).flat_map do |str|
+        return [req_string] unless req_string.match?(OR_SYNTAX)
+
+        req_string.split(OR_SYNTAX).flat_map do |str|
           next str if str.start_with?("(", "[")
 
           exacts, *rest = str.split(/,(?=\[|\()/)

data/lib/dependabot/maven/update_checker/version_finder.rb

@@ -6,6 +6,7 @@ require "dependabot/maven/file_parser/repositories_finder"
 require "dependabot/maven/update_checker"
 require "dependabot/maven/version"
 require "dependabot/maven/requirement"
+require "dependabot/maven/utils/auth_headers_finder"
 
 module Dependabot
   module Maven
@@ -13,8 +14,6 @@ module Dependabot
       class VersionFinder
         TYPE_SUFFICES = %w(jre android java).freeze
 
-        MAVEN_RANGE_REGEX = /[\(\[].*,.*[\)\]]/.freeze
-
         def initialize(dependency:, dependency_files:, credentials:,
                        ignored_versions:, security_advisories:,
                        raise_on_ignored: false)
@@ -94,10 +93,10 @@ module Dependabot
           filtered = possible_versions
 
           ignored_versions.each do |req|
-            ignore_req = Maven::Requirement.new(parse_requirement_string(req))
+            ignore_requirements = Maven::Requirement.requirements_array(req)
             filtered =
               filtered.
-              reject { |v| ignore_req.satisfied_by?(v.fetch(:version)) }
+              reject { |v| ignore_requirements.any? { |r| r.satisfied_by?(v.fetch(:version)) } }
           end
 
           raise AllVersionsIgnored if @raise_on_ignored && filtered.empty? && possible_versions.any?
@@ -105,12 +104,6 @@ module Dependabot
           filtered
         end
 
-        def parse_requirement_string(string)
-          return string if string.match?(MAVEN_RANGE_REGEX)
-
-          string.split(",").map(&:strip)
-        end
-
         def filter_vulnerable_versions(possible_versions)
           versions_array = possible_versions
 
@@ -152,10 +145,8 @@ module Dependabot
               url = repository_details.fetch("url")
               response = Excon.head(
                 dependency_files_url(url, version),
-                user: repository_details.fetch("username"),
-                password: repository_details.fetch("password"),
                 idempotent: true,
-                **SharedHelpers.excon_defaults
+                **SharedHelpers.excon_defaults(headers: repository_details.fetch("auth_headers"))
               )
 
               response.status < 400
@@ -173,10 +164,8 @@ module Dependabot
             begin
               response = Excon.get(
                 dependency_metadata_url(repository_details.fetch("url")),
-                user: repository_details.fetch("username"),
-                password: repository_details.fetch("password"),
                 idempotent: true,
-                **Dependabot::SharedHelpers.excon_defaults
+                **Dependabot::SharedHelpers.excon_defaults(headers: repository_details.fetch("auth_headers"))
               )
               check_response(response, repository_details.fetch("url"))
 
@@ -206,10 +195,10 @@ module Dependabot
 
           @repositories =
             details.reject do |repo|
-              next if repo["password"]
+              next if repo["auth_headers"]
 
-              # Reject this entry if an identical one with a password exists
-              details.any? { |r| r["url"] == repo["url"] && r["password"] }
+              # Reject this entry if an identical one with non-empty auth_headers exists
+              details.any? { |r| r["url"] == repo["url"] && r["auth_headers"] != {} }
             end
         end
 
@@ -219,7 +208,7 @@ module Dependabot
             new(dependency_files: dependency_files).
             repository_urls(pom: pom).
             map do |url|
-              { "url" => url, "username" => nil, "password" => nil }
+              { "url" => url, "auth_headers" => {} }
             end
         end
 
@@ -229,8 +218,7 @@ module Dependabot
             map do |cred|
               {
                 "url" => cred.fetch("url").gsub(%r{/+$}, ""),
-                "username" => cred.fetch("username", nil),
-                "password" => cred.fetch("password", nil)
+                "auth_headers" => auth_headers(cred.fetch("url").gsub(%r{/+$}, ""))
               }
             end
         end
@@ -287,6 +275,14 @@ module Dependabot
 
           %w(http:// https://).map { |p| p + central_url_without_protocol }
         end
+
+        def auth_headers_finder
+          @auth_headers_finder ||= Utils::AuthHeadersFinder.new(credentials)
+        end
+
+        def auth_headers(maven_repo_url)
+          auth_headers_finder.auth_headers(maven_repo_url)
+        end
       end
     end
   end

data/lib/dependabot/maven/utils/auth_headers_finder.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Dependabot
+  module Maven
+    module Utils
+      class AuthHeadersFinder
+        def initialize(credentials)
+          @credentials = credentials
+        end
+
+        def auth_headers(maven_repo_url)
+          cred =
+            credentials.select { |c| c["type"] == "maven_repository" }.
+            find do |c|
+              cred_url = c.fetch("url").gsub(%r{/+$}, "")
+              next false unless cred_url == maven_repo_url
+
+              c.fetch("username", nil)
+            end
+
+          return gitlab_auth_headers(maven_repo_url) unless cred
+
+          token = cred.fetch("username") + ":" + cred.fetch("password")
+          encoded_token = Base64.strict_encode64(token)
+          { "Authorization" => "Basic #{encoded_token}" }
+        end
+
+        private
+
+        attr_reader :credentials
+
+        def gitlab_auth_headers(maven_repo_url)
+          return {} unless gitlab_maven_repo?(URI(maven_repo_url).path)
+
+          cred =
+            credentials.select { |c| c["type"] == "git_source" }.
+            find do |c|
+              cred_host = c.fetch("host").gsub(%r{/+$}, "")
+              next false unless URI(maven_repo_url).host == cred_host
+
+              c.fetch("password", nil)
+            end
+
+          return {} unless cred
+
+          { "Private-Token" => cred.fetch("password") }
+        end
+
+        def gitlab_maven_repo?(maven_repo_path)
+          gitlab_maven_repo_reg = %r{^/api/v4.*/packages/maven/?$}.freeze
+          maven_repo_path.match?(gitlab_maven_repo_reg)
+        end
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.140.3
+  version: 0.143.0
 platform: ruby
 authors:
 - Dependabot
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-04-12 00:00:00.000000000 Z
+date: 2021-04-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dependabot-common
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.140.3
+        version: 0.143.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.140.3
+        version: 0.143.0
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -100,14 +100,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.13.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.12.0
+        version: 1.13.0
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -199,6 +199,7 @@ files:
 - lib/dependabot/maven/update_checker/property_updater.rb
 - lib/dependabot/maven/update_checker/requirements_updater.rb
 - lib/dependabot/maven/update_checker/version_finder.rb
+- lib/dependabot/maven/utils/auth_headers_finder.rb
 - lib/dependabot/maven/version.rb
 homepage: https://github.com/dependabot/dependabot-core
 licenses:
@@ -219,7 +220,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.5.0
 requirements: []
-rubygems_version: 3.2.3
+rubygems_version: 3.2.15
 signing_key: 
 specification_version: 4
 summary: Maven support for dependabot