dependabot-maven 0.85.0

data/lib/dependabot/maven/file_parser.rb

@@ -0,0 +1,253 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+
+require "dependabot/dependency"
+require "dependabot/file_parsers"
+require "dependabot/file_parsers/base"
+require "dependabot/errors"
+
+# The best Maven documentation is at:
+# - http://maven.apache.org/pom.html
+module Dependabot
+  module Maven
+    class FileParser < Dependabot::FileParsers::Base
+      require "dependabot/file_parsers/base/dependency_set"
+      require_relative "file_parser/property_value_finder"
+
+      # The following "dependencies" are candidates for updating:
+      # - The project's parent
+      # - Any dependencies (incl. those in dependencyManagement or plugins)
+      # - Any plugins (incl. those in pluginManagement)
+      # - Any extensions
+      DEPENDENCY_SELECTOR = "project > parent, "\
+                            "dependencies > dependency, "\
+                            "extensions > extension"
+      PLUGIN_SELECTOR     = "plugins > plugin"
+
+      # Regex to get the property name from a declaration that uses a property
+      PROPERTY_REGEX      = /\$\{(?<property>.*?)\}/.freeze
+
+      def parse
+        dependency_set = DependencySet.new
+        pomfiles.each { |pom| dependency_set += pomfile_dependencies(pom) }
+        dependency_set.dependencies
+      end
+
+      private
+
+      def pomfile_dependencies(pom)
+        dependency_set = DependencySet.new
+
+        errors = []
+        doc = Nokogiri::XML(pom.content)
+        doc.remove_namespaces!
+
+        doc.css(DEPENDENCY_SELECTOR).each do |dependency_node|
+          dep = dependency_from_dependency_node(pom, dependency_node)
+          dependency_set << dep if dep
+        rescue DependencyFileNotEvaluatable => error
+          errors << error
+        end
+
+        doc.css(PLUGIN_SELECTOR).each do |dependency_node|
+          dep = dependency_from_plugin_node(pom, dependency_node)
+          dependency_set << dep if dep
+        rescue DependencyFileNotEvaluatable => error
+          errors << error
+        end
+
+        raise errors.first if errors.any? && dependency_set.dependencies.none?
+
+        dependency_set
+      end
+
+      def dependency_from_dependency_node(pom, dependency_node)
+        return unless (name = dependency_name(dependency_node, pom))
+        return if internal_dependency_names.include?(name)
+
+        build_dependency(pom, dependency_node, name)
+      end
+
+      def dependency_from_plugin_node(pom, dependency_node)
+        return unless (name = plugin_name(dependency_node, pom))
+        return if internal_dependency_names.include?(name)
+
+        build_dependency(pom, dependency_node, name)
+      end
+
+      def build_dependency(pom, dependency_node, name)
+        property_details =
+          {
+            property_name: version_property_name(dependency_node),
+            property_source: property_source(dependency_node, pom)
+          }.compact
+
+        Dependency.new(
+          name: name,
+          version: dependency_version(pom, dependency_node),
+          package_manager: "maven",
+          requirements: [{
+            requirement: dependency_requirement(pom, dependency_node),
+            file: pom.name,
+            groups: [],
+            source: nil,
+            metadata: {
+              packaging_type: packaging_type(pom, dependency_node)
+            }.merge(property_details)
+          }]
+        )
+      end
+
+      def dependency_name(dependency_node, pom)
+        return unless dependency_node.at_xpath("./groupId")
+        return unless dependency_node.at_xpath("./artifactId")
+
+        [
+          evaluated_value(
+            dependency_node.at_xpath("./groupId").content.strip,
+            pom
+          ),
+          evaluated_value(
+            dependency_node.at_xpath("./artifactId").content.strip,
+            pom
+          )
+        ].join(":")
+      end
+
+      def plugin_name(dependency_node, pom)
+        return unless plugin_group_id(pom, dependency_node)
+        return unless dependency_node.at_xpath("./artifactId")
+
+        [
+          plugin_group_id(pom, dependency_node),
+          evaluated_value(
+            dependency_node.at_xpath("./artifactId").content.strip,
+            pom
+          )
+        ].join(":")
+      end
+
+      def plugin_group_id(pom, node)
+        return "org.apache.maven.plugins" unless node.at_xpath("./groupId")
+
+        evaluated_value(
+          node.at_xpath("./groupId").content.strip,
+          pom
+        )
+      end
+
+      def dependency_version(pom, dependency_node)
+        requirement = dependency_requirement(pom, dependency_node)
+        return nil unless requirement
+
+        # If a range is specified then we can't tell the exact version
+        return nil if requirement.include?(",")
+
+        # Remove brackets if present (and not denoting a range)
+        requirement.gsub(/[\(\)\[\]]/, "").strip
+      end
+
+      def dependency_requirement(pom, dependency_node)
+        return unless dependency_node.at_xpath("./version")
+
+        version_content = dependency_node.at_xpath("./version").content.strip
+        version_content = evaluated_value(version_content, pom)
+
+        version_content.empty? ? nil : version_content
+      end
+
+      def packaging_type(pom, dependency_node)
+        return "pom" if dependency_node.node_name == "parent"
+        return "jar" unless dependency_node.at_xpath("./type")
+
+        packaging_type_content = dependency_node.at_xpath("./type").
+                                 content.strip
+
+        evaluated_value(packaging_type_content, pom)
+      end
+
+      def version_property_name(dependency_node)
+        return unless dependency_node.at_xpath("./version")
+
+        version_content = dependency_node.at_xpath("./version").content.strip
+
+        return unless version_content.match?(PROPERTY_REGEX)
+
+        version_content.
+          match(PROPERTY_REGEX).
+          named_captures.fetch("property")
+      end
+
+      def evaluated_value(value, pom)
+        return value unless value.match?(PROPERTY_REGEX)
+
+        property_name = value.match(PROPERTY_REGEX).
+                        named_captures.fetch("property")
+        property_value = value_for_property(property_name, pom)
+
+        value.gsub(PROPERTY_REGEX, property_value)
+      end
+
+      def property_source(dependency_node, pom)
+        property_name = version_property_name(dependency_node)
+        return unless property_name
+
+        declaring_pom =
+          property_value_finder.
+          property_details(property_name: property_name, callsite_pom: pom)&.
+          fetch(:file)
+
+        return declaring_pom if declaring_pom
+
+        msg = "Property not found: #{property_name}"
+        raise DependencyFileNotEvaluatable, msg
+      end
+
+      def value_for_property(property_name, pom)
+        value =
+          property_value_finder.
+          property_details(property_name: property_name, callsite_pom: pom)&.
+          fetch(:value)
+
+        return value if value
+
+        msg = "Property not found: #{property_name}"
+        raise DependencyFileNotEvaluatable, msg
+      end
+
+      # Cached, since this can makes calls to the registry (to get property
+      # values from parent POMs)
+      def property_value_finder
+        @property_value_finder ||=
+          PropertyValueFinder.new(dependency_files: dependency_files)
+      end
+
+      def pomfiles
+        # Note: this (correctly) excludes any parent POMs that were downloaded
+        @pomfiles ||=
+          dependency_files.select { |f| f.name.end_with?("pom.xml") }
+      end
+
+      def internal_dependency_names
+        @internal_dependency_names ||=
+          dependency_files.map do |pom|
+            doc = Nokogiri::XML(pom.content)
+            group_id    = doc.at_css("project > groupId") ||
+                          doc.at_css("project > parent > groupId")
+            artifact_id = doc.at_css("project > artifactId")
+
+            next unless group_id && artifact_id
+
+            [group_id.content.strip, artifact_id.content.strip].join(":")
+          end.compact
+      end
+
+      def check_required_files
+        raise "No pom.xml!" unless get_original_file("pom.xml")
+      end
+    end
+  end
+end
+
+Dependabot::FileParsers.register("maven", Dependabot::Maven::FileParser)

data/lib/dependabot/maven/file_updater/declaration_finder.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/maven/file_updater"
+require "dependabot/maven/file_parser"
+require "dependabot/maven/file_parser/property_value_finder"
+
+module Dependabot
+  module Maven
+    class FileUpdater
+      class DeclarationFinder
+        DECLARATION_REGEX =
+          %r{<parent>.*?</parent>|<dependency>.*?</dependency>|
+             <plugin>.*?</plugin>|<extension>.*?</extension>}mx.freeze
+
+        attr_reader :dependency, :declaring_requirement, :dependency_files
+
+        def initialize(dependency:, dependency_files:, declaring_requirement:)
+          @dependency            = dependency
+          @dependency_files      = dependency_files
+          @declaring_requirement = declaring_requirement
+        end
+
+        def declaration_strings
+          @declaration_strings ||= fetch_pom_declaration_strings
+        end
+
+        def declaration_nodes
+          declaration_strings.map do |declaration_string|
+            Nokogiri::XML(declaration_string)
+          end
+        end
+
+        private
+
+        def declaring_pom
+          filename = declaring_requirement.fetch(:file)
+          declaring_pom = dependency_files.find { |f| f.name == filename }
+          return declaring_pom if declaring_pom
+
+          raise "No pom found with name #{filename}!"
+        end
+
+        def dependency_name
+          dependency.name
+        end
+
+        def fetch_pom_declaration_strings
+          deep_find_declarations(declaring_pom.content).select do |nd|
+            node = Nokogiri::XML(nd)
+            node.remove_namespaces!
+            next false unless node_group_id(node)
+            next false unless node.at_xpath("./*/artifactId")
+
+            node_name = [
+              node_group_id(node),
+              evaluated_value(node.at_xpath("./*/artifactId").content.strip)
+            ].compact.join(":")
+
+            next false unless node_name == dependency_name
+            next false unless packaging_type_matches?(node)
+
+            declaring_requirement_matches?(node)
+          end
+        end
+
+        def node_group_id(node)
+          unless node.at_xpath("./*/groupId") || node.at_xpath("./plugin")
+            return
+          end
+          return "org.apache.maven.plugins" unless node.at_xpath("./*/groupId")
+
+          evaluated_value(node.at_xpath("./*/groupId").content.strip)
+        end
+
+        def deep_find_declarations(string)
+          string.scan(DECLARATION_REGEX).flat_map do |matching_node|
+            [matching_node, *deep_find_declarations(matching_node[1..-1])]
+          end
+        end
+
+        def declaring_requirement_matches?(node)
+          node_requirement = node.at_css("version")&.content&.strip
+
+          if declaring_requirement.dig(:metadata, :property_name)
+            return false unless node_requirement
+
+            property_name =
+              node_requirement.
+              match(Maven::FileParser::PROPERTY_REGEX)&.
+              named_captures&.
+              fetch("property")
+
+            property_name == declaring_requirement[:metadata][:property_name]
+          else
+            node_requirement == declaring_requirement.fetch(:requirement)
+          end
+        end
+
+        def packaging_type_matches?(node)
+          type = declaring_requirement.dig(:metadata, :packaging_type)
+          type == packaging_type(node)
+        end
+
+        def packaging_type(dependency_node)
+          return "pom" if dependency_node.child.node_name == "parent"
+          return "jar" unless dependency_node.at_xpath("./*/type")
+
+          packaging_type_content = dependency_node.at_xpath("./*/type").
+                                   content.strip
+
+          evaluated_value(packaging_type_content)
+        end
+
+        def evaluated_value(value)
+          return value unless value.match?(Maven::FileParser::PROPERTY_REGEX)
+
+          property_name =
+            value.match(Maven::FileParser::PROPERTY_REGEX).
+            named_captures.fetch("property")
+
+          property_value =
+            property_value_finder.
+            property_details(
+              property_name: property_name,
+              callsite_pom: declaring_pom
+            )&.fetch(:value)
+
+          return value unless property_value
+
+          value.gsub(Maven::FileParser::PROPERTY_REGEX, property_value)
+        end
+
+        def property_value_finder
+          @property_value_finder ||=
+            Maven::FileParser::PropertyValueFinder.
+            new(dependency_files: dependency_files)
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/maven/file_updater/property_value_updater.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+
+require "dependabot/dependency_file"
+require "dependabot/maven/file_updater"
+require "dependabot/maven/file_parser/property_value_finder"
+
+module Dependabot
+  module Maven
+    class FileUpdater
+      class PropertyValueUpdater
+        def initialize(dependency_files:)
+          @dependency_files = dependency_files
+        end
+
+        def update_pomfiles_for_property_change(property_name:, callsite_pom:,
+                                                updated_value:)
+          declaration_details = property_value_finder.property_details(
+            property_name: property_name,
+            callsite_pom: callsite_pom
+          )
+          node = declaration_details.fetch(:node)
+          filename = declaration_details.fetch(:file)
+
+          pom_to_update = dependency_files.find { |f| f.name == filename }
+          updated_content = pom_to_update.content.sub(
+            %r{<#{Regexp.quote(node.name)}>
+               \s*#{Regexp.quote(node.content)}\s*
+               </#{Regexp.quote(node.name)}>}xm,
+            "<#{node.name}>#{updated_value}</#{node.name}>"
+          )
+
+          updated_pomfiles = dependency_files.dup
+          updated_pomfiles[updated_pomfiles.index(pom_to_update)] =
+            update_file(file: pom_to_update, content: updated_content)
+
+          updated_pomfiles
+        end
+
+        private
+
+        attr_reader :dependency_files
+
+        def property_value_finder
+          @property_value_finder ||=
+            Maven::FileParser::PropertyValueFinder.
+            new(dependency_files: dependency_files)
+        end
+
+        def update_file(file:, content:)
+          updated_file = file.dup
+          updated_file.content = content
+          updated_file
+        end
+      end
+    end
+  end
+end

data/lib/dependabot/maven/file_updater.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+require "nokogiri"
+require "dependabot/file_updaters"
+require "dependabot/file_updaters/base"
+
+module Dependabot
+  module Maven
+    class FileUpdater < Dependabot::FileUpdaters::Base
+      require_relative "file_updater/declaration_finder"
+      require_relative "file_updater/property_value_updater"
+
+      def self.updated_files_regex
+        [/^pom\.xml$/, %r{/pom\.xml$}]
+      end
+
+      def updated_dependency_files
+        updated_files = dependency_files.dup
+
+        # Loop through each of the changed requirements, applying changes to
+        # all pomfiles for that change. Note that the logic is different here
+        # to other languages because Java has property inheritance across
+        # files
+        dependencies.each do |dependency|
+          updated_files = update_pomfiles_for_dependency(
+            pomfiles: updated_files,
+            dependency: dependency
+          )
+        end
+
+        updated_files.select! { |f| f.name.end_with?("pom.xml") }
+        updated_files.reject! { |f| original_pomfiles.include?(f) }
+
+        raise "No files changed!" if updated_files.none?
+        if updated_files.any? { |f| f.name.end_with?("pom_parent.xml") }
+          raise "Updated a supporting POM!"
+        end
+
+        updated_files
+      end
+
+      private
+
+      def check_required_files
+        raise "No pom.xml!" unless get_original_file("pom.xml")
+      end
+
+      def update_pomfiles_for_dependency(pomfiles:, dependency:)
+        files = pomfiles.dup
+
+        # The UpdateChecker ensures the order of requirements is preserved
+        # when updating, so we can zip them together in new/old pairs.
+        reqs = dependency.requirements.zip(dependency.previous_requirements).
+               reject { |new_req, old_req| new_req == old_req }
+
+        # Loop through each changed requirement and update the pomfiles
+        reqs.each do |new_req, old_req|
+          raise "Bad req match" unless new_req[:file] == old_req[:file]
+          next if new_req[:requirement] == old_req[:requirement]
+
+          if new_req.dig(:metadata, :property_name)
+            files = update_pomfiles_for_property_change(files, new_req)
+            pom = files.find { |f| f.name == new_req.fetch(:file) }
+            files[files.index(pom)] =
+              remove_property_suffix_in_pom(dependency, pom, old_req)
+          else
+            pom = files.find { |f| f.name == new_req.fetch(:file) }
+            files[files.index(pom)] =
+              update_version_in_pom(dependency, pom, old_req, new_req)
+          end
+        end
+
+        files
+      end
+
+      def update_pomfiles_for_property_change(pomfiles, req)
+        property_name = req.fetch(:metadata).fetch(:property_name)
+
+        PropertyValueUpdater.new(dependency_files: pomfiles).
+          update_pomfiles_for_property_change(
+            property_name: property_name,
+            callsite_pom: pomfiles.find { |f| f.name == req.fetch(:file) },
+            updated_value: req.fetch(:requirement)
+          )
+      end
+
+      def update_version_in_pom(dependency, pom, previous_req, requirement)
+        updated_content = pom.content
+
+        original_pom_declarations(dependency, previous_req).each do |old_dec|
+          updated_content = updated_content.gsub(
+            old_dec,
+            updated_pom_declaration(old_dec, previous_req, requirement)
+          )
+        end
+
+        raise "Expected content to change!" if updated_content == pom.content
+
+        updated_file(file: pom, content: updated_content)
+      end
+
+      def remove_property_suffix_in_pom(dep, pom, req)
+        updated_content = pom.content
+
+        original_pom_declarations(dep, req).each do |old_declaration|
+          updated_content = updated_content.gsub(old_declaration) do |old_dec|
+            version_string =
+              old_dec.match(%r{(?<=\<version\>).*(?=\</version\>)})
+            cleaned_version_string = version_string.to_s.gsub(/(?<=\}).*/, "")
+
+            old_dec.gsub(
+              "<version>#{version_string}</version>",
+              "<version>#{cleaned_version_string}</version>"
+            )
+          end
+        end
+
+        updated_file(file: pom, content: updated_content)
+      end
+
+      def original_pom_declarations(dependency, requirement)
+        declaration_finder(dependency, requirement).declaration_strings
+      end
+
+      # The declaration finder may need to make remote calls (to get parent
+      # POMs if it's searching for the value of a property), so we cache it.
+      def declaration_finder(dependency, requirement)
+        @declaration_finders ||= {}
+        @declaration_finders[dependency.hash + requirement.hash] ||=
+          begin
+            DeclarationFinder.new(
+              dependency: dependency,
+              declaring_requirement: requirement,
+              dependency_files: dependency_files
+            )
+          end
+      end
+
+      def updated_pom_declaration(old_declaration, previous_req, requirement)
+        original_req_string = previous_req.fetch(:requirement)
+
+        old_declaration.gsub(
+          %r{<version>\s*#{Regexp.quote(original_req_string)}\s*</version>},
+          "<version>#{requirement.fetch(:requirement)}</version>"
+        )
+      end
+
+      def original_pomfiles
+        @original_pomfiles ||=
+          dependency_files.select { |f| f.name.end_with?("pom.xml") }
+      end
+    end
+  end
+end
+
+Dependabot::FileUpdaters.register("maven", Dependabot::Maven::FileUpdater)