dependabot-maven 0.361.2 → 0.362.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 87e639c848738f466a5c3a503c4506c601d10db84b99a766585e75f799b5514c
-  data.tar.gz: c1deca188041924a4946ad4b33012c31a237e9a5432bd01968bed1a89f34d723
+  metadata.gz: 6b2d3206a58a6877d490d4f996f43d1703de69920e76511741966fbc7272a5c2
+  data.tar.gz: 31322a8a1dccaaf04a38233d9b3f767469aebd741dfd0081131fde8e94b8ad06
 SHA512:
-  metadata.gz: 5277a91613aec8e220e7be4f6dd949ce8fa3f4b17b979072b164c7f93ba252888b751bb9b29d8c796dcb9e8e805b11ac13578d6e138c7a1876038bd9cc09a3d9
-  data.tar.gz: f91ad820a970652221fa8cf621b7978ff6db67f79d1763b8bd562a9012388c59c2c1cb0ab47ed1c4deb338d3e56aaa823e7d36a81fe212e0ebfcb14ab9e950fe
+  metadata.gz: c5ac97434660ab394d413523feb11dbd898478bf92d9eca00834b474a896f26e70db3fbe2d3a74b110042376eac57590c4d722d717c306ca02db7e86d9a47f29
+  data.tar.gz: 1f280b0cc45b41fed7f5831338df860add33a7b003e44c3568522955f32cfc9ccfb679640859c1e84b3d888ef623a70a371620cba031034ce03958524894e6a7

data/lib/dependabot/maven/file_parser/property_value_finder.rb

@@ -20,6 +20,7 @@ module Dependabot
         require_relative "pom_fetcher"
 
         DOT_SEPARATOR_REGEX = %r{\.(?!\d+([.\/_\-]|$)+)}
+        MAVEN_PROPERTY_REGEX = /\$\{.+?/
 
         sig do
           params(
@@ -37,10 +38,15 @@ module Dependabot
           )
         end
 
+        # rubocop:disable Metrics/PerceivedComplexity
         sig do
-          params(property_name: String, callsite_pom: DependencyFile).returns(T.nilable(T::Hash[Symbol, T.untyped]))
+          params(
+            property_name: String,
+            callsite_pom: DependencyFile,
+            seen_properties: T::Set[String]
+          ).returns(T.nilable(T::Hash[Symbol, T.untyped]))
         end
-        def property_details(property_name:, callsite_pom:)
+        def property_details(property_name:, callsite_pom:, seen_properties: Set.new)
           pom = callsite_pom
           doc = Nokogiri::XML(pom.content)
           doc.remove_namespaces!
@@ -63,53 +69,73 @@ module Dependabot
               raise DependencyFileNotEvaluatable, e.message
             end
 
-          # and value is an expression
-          if node && /\$\{(?<expression>.+)\}/.match(node.content.strip)
-            return extract_value_from_expression(
-              expression: node.content.strip,
+          if node.nil? && parent_pom(pom)
+            return property_details(
               property_name: property_name,
-              callsite_pom: callsite_pom
+              callsite_pom: T.must(parent_pom(pom)),
+              seen_properties: seen_properties
+            )
+          end
+          # If the property can’t be resolved for any reason, we return nil which
+          # causes Dependabot to skip the dependency.
+          # This differs from Maven’s behavior, where an unresolved property would fail the entire build.
+          # We intentionally choose this as a compromise so Dependabot can continue parsing the rest of the project,
+          # rather than failing completely due to a single unknown property.
+          # The trade-off is that some dependencies may not be updated as expected.
+          Dependabot.logger.warn "Could not resolve property '#{property_name}'" unless node
+          return nil unless node
+
+          content = node.content.strip
+
+          # Detect infinite recursion such as ${property1} where property1=${property1}
+          if seen_properties.include?(property_name)
+            raise Dependabot::DependencyFileNotParseable.new(
+              callsite_pom.name,
+              "Error trying to resolve recursive expression '${#{property_name}}'."
             )
           end
 
-          # If we found a property, return it
-          return { file: pom.name, node: node, value: node.content.strip } if node
+          seen_properties << property_name
 
-          # Otherwise, look for a value in this pom's parent
-          return unless (parent = parent_pom(pom))
+          # If the content has no placeholders, return it as-is
+          return { file: pom.name, node: node, value: content } unless content.match?(MAVEN_PROPERTY_REGEX)
 
-          property_details(
-            property_name: property_name,
-            callsite_pom: parent
-          )
+          resolve_property_placeholder(content, callsite_pom, pom, node, seen_properties)
         end
+        # rubocop:enable Metrics/PerceivedComplexity
 
         private
 
-        sig { returns(T::Array[DependencyFile]) }
-        attr_reader :dependency_files
-
+        # Extract property placeholders from a string and resolve them
+        # These properties can be simple properties such as ${project.version}
+        # or more complex such as ${my.property.${other.property}} or constant.${property}
+        # See https://maven.apache.org/pom.html#properties
         sig do
           params(
-            expression: String,
-            property_name: String,
-            callsite_pom: DependencyFile
-          )
-            .returns(T.nilable(T::Hash[Symbol, String]))
+            content: String,
+            callsite_pom: DependencyFile,
+            pom: DependencyFile,
+            node: T.untyped,
+            seen_properties: T::Set[String]
+          ).returns(T.nilable(T::Hash[Symbol, T.untyped]))
         end
-        def extract_value_from_expression(expression:, property_name:, callsite_pom:)
-          # and the expression is pointing to self then raise the error
-          if expression.eql?("${#{property_name}}")
-            raise Dependabot::DependencyFileNotParseable.new(
-              callsite_pom.name,
-              "Error trying to resolve recursive expression '#{expression}'."
+        def resolve_property_placeholder(content, callsite_pom, pom, node, seen_properties)
+          resolved_value = content.gsub(/\$\{(.+?)}/) do
+            inner_name = Regexp.last_match(1)
+            resolved = property_details(
+              property_name: T.must(inner_name),
+              callsite_pom: callsite_pom,
+              seen_properties: seen_properties
             )
+            T.must(resolved)[:value]
           end
 
-          # and the expression is pointing to another tag, then get the value of that tag
-          property_details(property_name: T.must(expression.slice(2..-2)), callsite_pom: callsite_pom)
+          { file: pom.name, node: node, value: resolved_value }
         end
 
+        sig { returns(T::Array[DependencyFile]) }
+        attr_reader :dependency_files
+
         sig { params(property_name: String).returns(String) }
         def sanitize_property_name(property_name)
           property_name.sub(/^pom\./, "").sub(/^project\./, "")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-maven
 version: !ruby/object:Gem::Version
-  version: 0.361.2
+  version: 0.362.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.361.2
+        version: 0.362.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.361.2
+        version: 0.362.0
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.361.2
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.362.0
 rdoc_options: []
 require_paths:
 - lib