dependabot-nuget 0.242.0 → 0.243.0

data/lib/dependabot/nuget/file_updater.rb

@@ -5,10 +5,13 @@ require "dependabot/dependency_file"
 require "dependabot/file_updaters"
 require "dependabot/file_updaters/base"
 require "dependabot/nuget/native_helpers"
+require "sorbet-runtime"
 
 module Dependabot
   module Nuget
     class FileUpdater < Dependabot::FileUpdaters::Base
+      extend T::Sig
+
       require_relative "file_updater/property_value_updater"
       require_relative "file_parser/project_file_parser"
       require_relative "file_parser/dotnet_tools_json_parser"
@@ -54,6 +57,7 @@ module Dependabot
 
       def try_update_projects(dependency)
         update_ran = T.let(false, T::Boolean)
+        checked_files = Set.new
 
         # run update for each project file
         project_files.each do |project_file|
@@ -62,9 +66,17 @@ module Dependabot
 
           next unless project_dependencies.any? { |dep| dep.name.casecmp(dependency.name).zero? }
 
-          NativeHelpers.run_nuget_updater_tool(repo_root: repo_contents_path, proj_path: proj_path,
-                                               dependency: dependency, is_transitive: !dependency.top_level?,
-                                               credentials: credentials)
+          next unless repo_contents_path
+
+          checked_key = "#{project_file.name}-#{dependency.name}#{dependency.version}"
+          call_nuget_updater_tool(dependency, proj_path) unless checked_files.include?(checked_key)
+
+          checked_files.add(checked_key)
+          # We need to check the downstream references even though we're already evaluated the file
+          downstream_files = project_file_parser.downstream_file_references(project_file: project_file)
+          downstream_files.each do |downstream_file|
+            checked_files.add("#{downstream_file}-#{dependency.name}#{dependency.version}")
+          end
           update_ran = true
         end
 
@@ -79,15 +91,39 @@ module Dependabot
           project_file = project_files.first
           proj_path = dependency_file_path(project_file)
 
-          NativeHelpers.run_nuget_updater_tool(repo_root: repo_contents_path, proj_path: proj_path,
-                                               dependency: dependency, is_transitive: !dependency.top_level?,
-                                               credentials: credentials)
+          return false unless repo_contents_path
+
+          call_nuget_updater_tool(dependency, proj_path)
           return true
         end
 
         false
       end
 
+      sig { params(dependency: Dependency, proj_path: String).void }
+      def call_nuget_updater_tool(dependency, proj_path)
+        NativeHelpers.run_nuget_updater_tool(repo_root: T.must(repo_contents_path), proj_path: proj_path,
+                                             dependency: dependency, is_transitive: !dependency.top_level?,
+                                             credentials: credentials)
+
+        # Tests need to track how many times we call the tooling updater to ensure we don't recurse needlessly
+        # Ideally we should find a way to not run this code in prod
+        # (or a better way to track calls made to NativeHelpers)
+        @update_tooling_calls ||= {}
+        key = proj_path + dependency.name
+        if @update_tooling_calls[key]
+          @update_tooling_calls[key] += 1
+        else
+          @update_tooling_calls[key] = 1
+        end
+      end
+
+      # Don't call this from outside tests, we're only checking that we aren't recursing needlessly
+      sig { returns(T.nilable(T::Hash[String, Integer])) }
+      def testonly_update_tooling_calls
+        @update_tooling_calls
+      end
+
       def project_dependencies(project_file)
         # Collect all dependencies from the project file and associated packages.config
         dependencies = project_file_parser.dependency_set(project_file: project_file).dependencies

data/lib/dependabot/nuget/native_helpers.rb

@@ -1,11 +1,17 @@
-# typed: true
+# typed: strong
 # frozen_string_literal: true
 
+require "shellwords"
+require "sorbet-runtime"
+
 require_relative "nuget_config_credential_helpers"
 
 module Dependabot
   module Nuget
     module NativeHelpers
+      extend T::Sig
+
+      sig { returns(String) }
       def self.native_helpers_root
         helpers_root = ENV.fetch("DEPENDABOT_NATIVE_HELPERS_PATH", nil)
         return File.join(helpers_root, "nuget") unless helpers_root.nil?
@@ -13,9 +19,10 @@ module Dependabot
         File.expand_path("../../../helpers", __dir__)
       end
 
+      sig { params(project_tfms: T::Array[String], package_tfms: T::Array[String]).returns(T::Boolean) }
       def self.run_nuget_framework_check(project_tfms, package_tfms)
         exe_path = File.join(native_helpers_root, "NuGetUpdater", "NuGetUpdater.Cli")
-        command = [
+        command_parts = [
           exe_path,
           "framework-check",
           "--project-tfms",
@@ -23,7 +30,8 @@ module Dependabot
           "--package-tfms",
           *package_tfms,
           "--verbose"
-        ].join(" ")
+        ]
+        command = Shellwords.join(command_parts)
 
         fingerprint = [
           exe_path,
@@ -48,9 +56,18 @@ module Dependabot
       end
 
       # rubocop:disable Metrics/MethodLength
+      sig do
+        params(
+          repo_root: String,
+          proj_path: String,
+          dependency: Dependency,
+          is_transitive: T::Boolean,
+          credentials: T::Array[T.untyped]
+        ).void
+      end
       def self.run_nuget_updater_tool(repo_root:, proj_path:, dependency:, is_transitive:, credentials:)
         exe_path = File.join(native_helpers_root, "NuGetUpdater", "NuGetUpdater.Cli")
-        command = [
+        command_parts = [
           exe_path,
           "update",
           "--repo-root",
@@ -63,9 +80,11 @@ module Dependabot
           dependency.version,
           "--previous-version",
           dependency.previous_version,
-          is_transitive ? "--transitive" : "",
+          is_transitive ? "--transitive" : nil,
           "--verbose"
-        ].join(" ")
+        ].compact
+
+        command = Shellwords.join(command_parts)
 
         fingerprint = [
           exe_path,
@@ -80,9 +99,9 @@ module Dependabot
           "<new-version>",
           "--previous-version",
           "<previous-version>",
-          is_transitive ? "--transitive" : "",
+          is_transitive ? "--transitive" : nil,
           "--verbose"
-        ].join(" ")
+        ].compact.join(" ")
 
         puts "running NuGet updater:\n" + command
 

data/lib/dependabot/nuget/nuget_client.rb

@@ -1,13 +1,35 @@
-# typed: true
+# typed: strict
 # frozen_string_literal: true
 
 require "dependabot/nuget/cache_manager"
 require "dependabot/nuget/update_checker/repository_finder"
+require "sorbet-runtime"
 
 module Dependabot
   module Nuget
     class NugetClient
-      def self.get_package_versions_v3(dependency_name, repository_details)
+      extend T::Sig
+
+      sig do
+        params(dependency_name: String, repository_details: T::Hash[Symbol, String])
+          .returns(T.nilable(T::Set[String]))
+      end
+      def self.get_package_versions(dependency_name, repository_details)
+        repository_type = repository_details.fetch(:repository_type)
+        if repository_type == "v3"
+          get_package_versions_v3(dependency_name, repository_details)
+        elsif repository_type == "v2"
+          get_package_versions_v2(dependency_name, repository_details)
+        else
+          raise "Unknown repository type: #{repository_type}"
+        end
+      end
+
+      sig do
+        params(dependency_name: String, repository_details: T::Hash[Symbol, String])
+          .returns(T.nilable(T::Set[String]))
+      end
+      private_class_method def self.get_package_versions_v3(dependency_name, repository_details)
         # Use the registration URL if possible because it is fast and correct
         if repository_details[:registration_url]
           get_versions_from_registration_v3(repository_details)
@@ -17,37 +39,60 @@ module Dependabot
         # Otherwise, use the versions URL (fast but wrong because it includes unlisted versions)
         elsif repository_details[:versions_url]
           get_versions_from_versions_url_v3(repository_details)
+        else
+          raise "No version sources were available for #{dependency_name} in #{repository_details}"
+        end
+      end
+
+      sig do
+        params(dependency_name: String, repository_details: T::Hash[Symbol, String])
+          .returns(T.nilable(T::Set[String]))
+      end
+      private_class_method def self.get_package_versions_v2(dependency_name, repository_details)
+        doc = execute_xml_nuget_request(repository_details.fetch(:versions_url), repository_details)
+        return unless doc
+
+        id_nodes = doc.xpath("/feed/entry/properties/Id")
+        matching_versions = Set.new
+        id_nodes.each do |id_node|
+          return nil unless id_node.text
+
+          next unless id_node.text.casecmp?(dependency_name)
+
+          version_node = id_node.parent.xpath("Version")
+          matching_versions << version_node.text if version_node && version_node.text
         end
+
+        matching_versions
       end
 
+      sig { params(repository_details: T::Hash[Symbol, String]).returns(T.nilable(T::Set[String])) }
       private_class_method def self.get_versions_from_versions_url_v3(repository_details)
-        body = execute_search_for_dependency_url(repository_details[:versions_url], repository_details)
-        body&.fetch("versions")
+        body = execute_json_nuget_request(repository_details.fetch(:versions_url), repository_details)
+        ver_array = T.let(body&.fetch("versions"), T.nilable(T::Array[String]))
+        ver_array&.to_set
       end
 
+      sig { params(repository_details: T::Hash[Symbol, String]).returns(T.nilable(T::Set[String])) }
       private_class_method def self.get_versions_from_registration_v3(repository_details)
-        url = repository_details[:registration_url]
-        body = execute_search_for_dependency_url(url, repository_details)
+        url = repository_details.fetch(:registration_url)
+        body = execute_json_nuget_request(url, repository_details)
 
         return unless body
 
         pages = body.fetch("items")
-        versions = Set.new
+        versions = T.let(Set.new, T::Set[String])
         pages.each do |page|
           items = page["items"]
           if items
             # inlined entries
-            items.each do |item|
-              catalog_entry = item["catalogEntry"]
-              if catalog_entry["listed"] == true
-                vers = catalog_entry["version"]
-                versions << vers
-              end
-            end
+            get_versions_from_inline_page(items, versions)
           else
             # paged entries
             page_url = page["@id"]
-            page_body = execute_search_for_dependency_url(page_url, repository_details)
+            page_body = execute_json_nuget_request(page_url, repository_details)
+            next unless page_body
+
             items = page_body.fetch("items")
             items.each do |item|
               catalog_entry = item.fetch("catalogEntry")
@@ -59,9 +104,28 @@ module Dependabot
         versions
       end
 
+      sig { params(items: T::Array[T::Hash[String, T.untyped]], versions: T::Set[String]).void }
+      private_class_method def self.get_versions_from_inline_page(items, versions)
+        items.each do |item|
+          catalog_entry = item["catalogEntry"]
+
+          # a package is considered listed if the `listed` property is either `true` or missing
+          listed_property = catalog_entry["listed"]
+          is_listed = listed_property.nil? || listed_property == true
+          if is_listed
+            vers = catalog_entry["version"]
+            versions << vers
+          end
+        end
+      end
+
+      sig do
+        params(repository_details: T::Hash[Symbol, String], dependency_name: String)
+          .returns(T.nilable(T::Set[String]))
+      end
       private_class_method def self.get_versions_from_search_url_v3(repository_details, dependency_name)
-        search_url = repository_details[:search_url]
-        body = execute_search_for_dependency_url(search_url, repository_details)
+        search_url = repository_details.fetch(:search_url)
+        body = execute_json_nuget_request(search_url, repository_details)
 
         body&.fetch("data")
             &.find { |d| d.fetch("id").casecmp(dependency_name.downcase).zero? }
@@ -69,26 +133,68 @@ module Dependabot
             &.map { |d| d.fetch("version") }
       end
 
-      private_class_method def self.execute_search_for_dependency_url(url, repository_details)
-        cache = CacheManager.cache("dependency_url_search_cache")
-        cache[url] ||= Dependabot::RegistryClient.get(
+      sig do
+        params(url: String, repository_details: T::Hash[Symbol, T.untyped]).returns(T.nilable(Nokogiri::XML::Document))
+      end
+      private_class_method def self.execute_xml_nuget_request(url, repository_details)
+        response = execute_nuget_request_internal(
           url: url,
-          headers: repository_details[:auth_header]
+          auth_header: repository_details.fetch(:auth_header),
+          repository_url: repository_details.fetch(:repository_url)
         )
+        return unless response.status == 200
 
-        response = cache[url]
+        doc = Nokogiri::XML(response.body)
+        doc.remove_namespaces!
+        doc
+      end
 
+      sig do
+        params(url: String,
+               repository_details: T::Hash[Symbol, T.untyped])
+          .returns(T.nilable(T::Hash[T.untyped, T.untyped]))
+      end
+      private_class_method def self.execute_json_nuget_request(url, repository_details)
+        response = execute_nuget_request_internal(
+          url: url,
+          auth_header: repository_details.fetch(:auth_header),
+          repository_url: repository_details.fetch(:repository_url)
+        )
         return unless response.status == 200
 
         body = remove_wrapping_zero_width_chars(response.body)
         JSON.parse(body)
+      end
+
+      sig do
+        params(url: String, auth_header: T::Hash[Symbol, T.untyped], repository_url: String).returns(Excon::Response)
+      end
+      private_class_method def self.execute_nuget_request_internal(url:, auth_header:, repository_url:)
+        cache = CacheManager.cache("dependency_url_search_cache")
+        if cache[url].nil?
+          response = Dependabot::RegistryClient.get(
+            url: url,
+            headers: auth_header
+          )
+
+          if [401, 402, 403].include?(response.status)
+            raise Dependabot::PrivateSourceAuthenticationFailure, repository_url
+          end
+
+          cache[url] = response if !CacheManager.caching_disabled? && response.status == 200
+        else
+          response = cache[url]
+        end
+
+        response
       rescue Excon::Error::Timeout, Excon::Error::Socket
-        repo_url = repository_details[:repository_url]
-        raise if repo_url == Dependabot::Nuget::UpdateChecker::RepositoryFinder::DEFAULT_REPOSITORY_URL
+        repo_url = repository_url
+        raise if repo_url == Dependabot::Nuget::RepositoryFinder::DEFAULT_REPOSITORY_URL
 
         raise PrivateSourceTimedOut, repo_url
       end
 
+      sig { params(string: String).returns(String) }
       private_class_method def self.remove_wrapping_zero_width_chars(string)
         string.force_encoding("UTF-8").encode
               .gsub(/\A[\u200B-\u200D\uFEFF]/, "")

data/lib/dependabot/nuget/nuget_config_credential_helpers.rb

@@ -55,17 +55,21 @@ module Dependabot
         File.rename(temporary_nuget_config_path, user_nuget_config_path)
       end
 
-      # rubocop:disable Lint/SuppressedException
       def self.patch_nuget_config_for_action(credentials, &_block)
         add_credentials_to_nuget_config(credentials)
         begin
           yield
-        rescue StandardError
+        rescue StandardError => e
+          Dependabot.logger.error(
+            <<~LOG_MESSAGE
+              Block argument of NuGetConfigCredentialHelpers::patch_nuget_config_for_action causes an exception #{e}:
+              #{e.message}
+            LOG_MESSAGE
+          )
         ensure
           restore_user_nuget_config
         end
       end
-      # rubocop:enable Lint/SuppressedException
     end
   end
 end

data/lib/dependabot/nuget/update_checker/compatibility_checker.rb

@@ -5,80 +5,84 @@ require "dependabot/update_checkers/base"
 
 module Dependabot
   module Nuget
-    class UpdateChecker < Dependabot::UpdateCheckers::Base
-      class CompatibilityChecker
-        require_relative "nuspec_fetcher"
-        require_relative "nupkg_fetcher"
-        require_relative "tfm_finder"
-        require_relative "tfm_comparer"
-
-        def initialize(dependency_urls:, dependency:, tfm_finder:)
-          @dependency_urls = dependency_urls
-          @dependency = dependency
-          @tfm_finder = tfm_finder
-        end
+    class CompatibilityChecker
+      require_relative "nuspec_fetcher"
+      require_relative "nupkg_fetcher"
+      require_relative "tfm_finder"
+      require_relative "tfm_comparer"
+
+      def initialize(dependency_urls:, dependency:, tfm_finder:)
+        @dependency_urls = dependency_urls
+        @dependency = dependency
+        @tfm_finder = tfm_finder
+      end
 
-        def compatible?(version)
-          nuspec_xml = NuspecFetcher.fetch_nuspec(dependency_urls, dependency.name, version)
-          return false unless nuspec_xml
+      def compatible?(version)
+        nuspec_xml = NuspecFetcher.fetch_nuspec(dependency_urls, dependency.name, version)
+        return false unless nuspec_xml
 
-          # development dependencies are packages such as analyzers which need to be
-          # compatible with the compiler not the project itself.
-          return true if development_dependency?(nuspec_xml)
+        # development dependencies are packages such as analyzers which need to be compatible with the compiler not the
+        # project itself, but some packages that report themselves as development dependencies still contain target
+        # framework dependencies and should be checked for compatibility through the regular means
+        return true if pure_development_dependency?(nuspec_xml)
 
-          package_tfms = parse_package_tfms(nuspec_xml)
-          package_tfms = fetch_package_tfms(version) if package_tfms.empty?
-          # nil is a special return value that indicates that the package is likely a development dependency
-          return true if package_tfms.nil?
-          return false if package_tfms.empty?
+        package_tfms = parse_package_tfms(nuspec_xml)
+        package_tfms = fetch_package_tfms(version) if package_tfms.empty?
+        # nil is a special return value that indicates that the package is likely a development dependency
+        return true if package_tfms.nil?
+        return false if package_tfms.empty?
 
-          return false if project_tfms.nil? || project_tfms.empty?
+        return false if project_tfms.nil? || project_tfms.empty?
 
-          TfmComparer.are_frameworks_compatible?(project_tfms, package_tfms)
-        end
+        TfmComparer.are_frameworks_compatible?(project_tfms, package_tfms)
+      end
 
-        private
+      private
 
-        attr_reader :dependency_urls, :dependency, :tfm_finder
+      attr_reader :dependency_urls, :dependency, :tfm_finder
 
-        def development_dependency?(nuspec_xml)
-          contents = nuspec_xml.at_xpath("package/metadata/developmentDependency")&.content&.strip
-          return false unless contents
+      def pure_development_dependency?(nuspec_xml)
+        contents = nuspec_xml.at_xpath("package/metadata/developmentDependency")&.content&.strip
+        return false unless contents # no `developmentDependency` element
 
-          contents.casecmp("true").zero?
-        end
+        self_reports_as_development_dependency = contents.casecmp?("true")
+        return false unless self_reports_as_development_dependency
 
-        def parse_package_tfms(nuspec_xml)
-          nuspec_xml.xpath("//dependencies/group").map do |group|
-            group.attribute("targetFramework")
-          end
-        end
+        # even though a package self-reports as a development dependency, it might not be if it has dependency groups
+        # with a target framework
+        dependency_groups_with_target_framework =
+          nuspec_xml.at_xpath("/package/metadata/dependencies/group[@targetFramework]")
+        dependency_groups_with_target_framework.to_a.empty?
+      end
+
+      def parse_package_tfms(nuspec_xml)
+        nuspec_xml.xpath("//dependencies/group").filter_map { |group| group.attribute("targetFramework") }
+      end
 
-        def project_tfms
-          return @project_tfms if defined?(@project_tfms)
+      def project_tfms
+        return @project_tfms if defined?(@project_tfms)
 
-          @project_tfms = tfm_finder.frameworks(dependency)
-        end
+        @project_tfms = tfm_finder.frameworks(dependency)
+      end
 
-        def fetch_package_tfms(dependency_version)
-          nupkg_buffer = NupkgFetcher.fetch_nupkg_buffer(dependency_urls, dependency.name, dependency_version)
-          return [] unless nupkg_buffer
-
-          # Parse tfms from the folders beneath the lib folder
-          folder_name = "lib/"
-          tfms = Set.new
-          Zip::File.open_buffer(nupkg_buffer) do |zip|
-            lib_file_entries = zip.select { |entry| entry.name.start_with?(folder_name) }
-            # If there is no lib folder in this package, assume it is a development dependency
-            return nil if lib_file_entries.empty?
-
-            lib_file_entries.each do |entry|
-              _, tfm = entry.name.split("/").first(2)
-              tfms << tfm
-            end
+      def fetch_package_tfms(dependency_version)
+        nupkg_buffer = NupkgFetcher.fetch_nupkg_buffer(dependency_urls, dependency.name, dependency_version)
+        return [] unless nupkg_buffer
+
+        # Parse tfms from the folders beneath the lib folder
+        folder_name = "lib/"
+        tfms = Set.new
+        Zip::File.open_buffer(nupkg_buffer) do |zip|
+          lib_file_entries = zip.select { |entry| entry.name.start_with?(folder_name) }
+          # If there is no lib folder in this package, assume it is a development dependency
+          return nil if lib_file_entries.empty?
+
+          lib_file_entries.each do |entry|
+            _, tfm = entry.name.split("/").first(2)
+            tfms << tfm
           end
-          tfms.to_a
         end
+        tfms.to_a
       end
     end
   end

data/lib/dependabot/nuget/update_checker/dependency_finder.rb

@@ -121,12 +121,12 @@ module Dependabot
 
         def dependency_urls
           @dependency_urls ||=
-            UpdateChecker::RepositoryFinder.new(
+            RepositoryFinder.new(
               dependency: @dependency,
               credentials: @credentials,
               config_files: nuget_configs
             ).dependency_urls
-                                           .select { |url| url.fetch(:repository_type) == "v3" }
+                            .select { |url| url.fetch(:repository_type) == "v3" }
         end
 
         def fetch_transitive_dependencies(package_id, package_version)

data/lib/dependabot/nuget/update_checker/nupkg_fetcher.rb

@@ -73,7 +73,7 @@ module Dependabot
             response_block: response_block
           )
 
-          if response.status == 303
+          if response.status == 303 || response.status == 307
             current_redirects += 1
             return nil if current_redirects > max_redirects
 

data/lib/dependabot/nuget/update_checker/nuspec_fetcher.rb

@@ -26,17 +26,9 @@ module Dependabot
 
         nuspec_xml = nil
 
-        if azure_package_feed?(feed_url)
-          # this is an azure devops url we can extract the nuspec from the nupkg
-          package_data = NupkgFetcher.fetch_nupkg_buffer_from_repository(repository_details, package_id,
-                                                                         package_version)
-          return if package_data.nil?
-
-          nuspec_string = extract_nuspec(package_data, package_id)
-          nuspec_xml = Nokogiri::XML(nuspec_string)
-        else
+        if feed_supports_nuspec_download?(feed_url)
           # we can use the normal nuget apis to get the nuspec and list out the dependencies
-          base_url = feed_url.gsub("/index.json", "-flatcontainer")
+          base_url = repository_details[:base_url].delete_suffix("/")
           package_id_downcased = package_id.downcase
           nuspec_url = "#{base_url}/#{package_id_downcased}/#{package_version}/#{package_id_downcased}.nuspec"
 
@@ -47,22 +39,32 @@ module Dependabot
 
           return unless nuspec_response.status == 200
 
-          nuspec_response_body = remove_wrapping_zero_width_chars(nuspec_response.body)
+          nuspec_response_body = remove_invalid_characters(nuspec_response.body)
           nuspec_xml = Nokogiri::XML(nuspec_response_body)
+        else
+          # no guarantee we can directly query the .nuspec; fall back to extracting it from the .nupkg
+          package_data = NupkgFetcher.fetch_nupkg_buffer_from_repository(repository_details, package_id,
+                                                                         package_version)
+          return if package_data.nil?
+
+          nuspec_string = extract_nuspec(package_data, package_id)
+          nuspec_xml = Nokogiri::XML(nuspec_string)
         end
 
         nuspec_xml.remove_namespaces!
         nuspec_xml
       end
 
-      def self.azure_package_feed?(feed_url)
-        # if url is azure devops
-        azure_devops_regexs = [
+      def self.feed_supports_nuspec_download?(feed_url)
+        feed_regexs = [
+          # nuget
+          %r{https://api\.nuget\.org/v3/index\.json},
+          # azure devops
           %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/(?<project>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json},
           %r{https://pkgs\.dev\.azure\.com/(?<organization>[^/]+)/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)},
           %r{https://(?<organization>[^\.\/]+)\.pkgs\.visualstudio\.com/_packaging/(?<feedId>[^/]+)/nuget/v3/index\.json(?<project>)}
         ]
-        azure_devops_regexs.any? { |reg| reg.match(feed_url) }
+        feed_regexs.any? { |reg| reg.match(feed_url) }
       end
 
       def self.extract_nuspec(zip_stream, package_id)
@@ -73,8 +75,11 @@ module Dependabot
         nil
       end
 
-      def self.remove_wrapping_zero_width_chars(string)
-        string.force_encoding("UTF-8").encode
+      def self.remove_invalid_characters(string)
+        string.dup
+              .force_encoding(Encoding::UTF_8)
+              .encode
+              .scrub("")
               .gsub(/\A[\u200B-\u200D\uFEFF]/, "")
               .gsub(/[\u200B-\u200D\uFEFF]\Z/, "")
       end