fastlane-security-patched 2.216.0

data/fastlane_core/lib/fastlane_core/configuration/configuration.rb

@@ -0,0 +1,338 @@
+require_relative '../helper'
+require_relative '../globals'
+require_relative 'config_item'
+require_relative 'commander_generator'
+require_relative 'configuration_file'
+
+module FastlaneCore
+  class Configuration
+    attr_accessor :available_options
+
+    attr_accessor :values
+
+    # @return [Array] An array of symbols which are all available keys
+    attr_reader :all_keys
+
+    # @return [String] The name of the configuration file (not the path). Optional!
+    attr_accessor :config_file_name
+
+    # @return [Hash] Options that were set from a config file using load_configuration_file. Optional!
+    attr_accessor :config_file_options
+
+    def self.create(available_options, values)
+      UI.user_error!("values parameter must be a hash") unless values.kind_of?(Hash)
+      v = values.dup
+      v.each do |key, val|
+        v[key] = val.dup if val.kind_of?(String) # this is necessary when fetching a value from an environment variable
+      end
+
+      if v.kind_of?(Hash) && available_options.kind_of?(Array) # we only want to deal with the new configuration system
+        # Now see if --verbose would be a valid input
+        # If not, it might be because it's an action and not a tool
+        unless available_options.find { |a| a.kind_of?(ConfigItem) && a.key == :verbose }
+          v.delete(:verbose) # as this is being processed by commander
+        end
+      end
+      Configuration.new(available_options, v)
+    end
+
+    #####################################################
+    # @!group Setting up the configuration
+    #####################################################
+
+    # collect sensitive strings
+    def self.sensitive_strings
+      @sensitive_strings ||= []
+    end
+
+    def initialize(available_options, values)
+      self.available_options = available_options || []
+      self.values = values || {}
+      self.config_file_options = {}
+
+      # used for pushing and popping values to provide nesting configuration contexts
+      @values_stack = []
+
+      # if we are in captured output mode - keep a array of sensitive option values
+      # those will be later - replaced by ####
+      if FastlaneCore::Globals.capture_output?
+        available_options.each do |element|
+          next unless element.sensitive
+          self.class.sensitive_strings << values[element.key]
+        end
+      end
+
+      verify_input_types
+      verify_value_exists
+      verify_no_duplicates
+      verify_conflicts
+      verify_default_value_matches_verify_block
+    end
+
+    def verify_input_types
+      UI.user_error!("available_options parameter must be an array of ConfigItems but is #{@available_options.class}") unless @available_options.kind_of?(Array)
+      @available_options.each do |item|
+        UI.user_error!("available_options parameter must be an array of ConfigItems. Found #{item.class}.") unless item.kind_of?(ConfigItem)
+      end
+      UI.user_error!("values parameter must be a hash") unless @values.kind_of?(Hash)
+    end
+
+    def verify_value_exists
+      # Make sure the given value keys exist
+      @values.each do |key, value|
+        next if key == :trace # special treatment
+        option = self.verify_options_key!(key)
+        @values[key] = option.auto_convert_value(value)
+        UI.deprecated("Using deprecated option: '--#{key}' (#{option.deprecated})") if option.deprecated
+        option.verify!(@values[key]) # Call the verify block for it too
+      end
+    end
+
+    def verify_no_duplicates
+      # Make sure a key was not used multiple times
+      @available_options.each do |current|
+        count = @available_options.count { |option| option.key == current.key }
+        UI.user_error!("Multiple entries for configuration key '#{current.key}' found!") if count > 1
+
+        unless current.short_option.to_s.empty?
+          count = @available_options.count { |option| option.short_option == current.short_option }
+          UI.user_error!("Multiple entries for short_option '#{current.short_option}' found!") if count > 1
+        end
+      end
+    end
+
+    def verify_conflicts
+      option_keys = @values.keys
+
+      option_keys.each do |current|
+        index = @available_options.find_index { |item| item.key == current }
+        current = @available_options[index]
+
+        # ignore conflicts because option value is nil
+        next if @values[current.key].nil?
+
+        next if current.conflicting_options.nil?
+
+        conflicts = current.conflicting_options & option_keys
+        next if conflicts.nil?
+
+        conflicts.each do |conflicting_option_key|
+          index = @available_options.find_index { |item| item.key == conflicting_option_key }
+          conflicting_option = @available_options[index]
+
+          # ignore conflicts because value of conflict option is nil
+          next if @values[conflicting_option.key].nil?
+
+          if current.conflict_block
+            begin
+              current.conflict_block.call(conflicting_option)
+            rescue => ex
+              UI.error("Error resolving conflict between options: '#{current.key}' and '#{conflicting_option.key}'")
+              raise ex
+            end
+          else
+            UI.user_error!("Unresolved conflict between options: '#{current.key}' and '#{conflicting_option.key}'")
+          end
+        end
+      end
+    end
+
+    # Verifies the default value is also valid
+    def verify_default_value_matches_verify_block
+      @available_options.each do |item|
+        next unless item.verify_block && item.default_value
+
+        begin
+          unless @values[item.key] # this is important to not verify if there already is a value there
+            item.verify_block.call(item.default_value)
+          end
+        rescue => ex
+          UI.error(ex)
+          UI.user_error!("Invalid default value for #{item.key}, doesn't match verify_block")
+        end
+      end
+    end
+
+    # This method takes care of parsing and using the configuration file as values
+    # Call this once you know where the config file might be located
+    # Take a look at how `gym` uses this method
+    #
+    # @param config_file_name [String] The name of the configuration file to use (optional)
+    # @param block_for_missing [Block] A ruby block that is called when there is an unknown method
+    #   in the configuration file
+    def load_configuration_file(config_file_name = nil, block_for_missing = nil, skip_printing_values = false)
+      return unless config_file_name
+
+      self.config_file_name = config_file_name
+
+      path = FastlaneCore::Configuration.find_configuration_file_path(config_file_name: config_file_name)
+      return if path.nil?
+
+      begin
+        configuration_file = ConfigurationFile.new(self, path, block_for_missing, skip_printing_values)
+        options = configuration_file.options
+      rescue FastlaneCore::ConfigurationFile::ExceptionWhileParsingError => e
+        options = e.recovered_options
+        wrapped_exception = e.wrapped_exception
+      end
+
+      # Make sure all the values set in the config file pass verification
+      options.each do |key, val|
+        option = self.verify_options_key!(key)
+        option.verify!(val)
+      end
+
+      # Merge the new options into the old ones, keeping all previously set keys
+      self.config_file_options = options.merge(self.config_file_options)
+
+      verify_conflicts # important, since user can set conflicting options in configuration file
+
+      # Now that everything is verified, re-raise an exception that was raised in the config file
+      raise wrapped_exception unless wrapped_exception.nil?
+
+      configuration_file
+    end
+
+    def self.find_configuration_file_path(config_file_name: nil)
+      paths = []
+      paths += Dir["./fastlane/#{config_file_name}"]
+      paths += Dir["./.fastlane/#{config_file_name}"]
+      paths += Dir["./#{config_file_name}"]
+      paths += Dir["./fastlane_core/spec/fixtures/#{config_file_name}"] if Helper.test?
+      return nil if paths.count == 0
+      return paths.first
+    end
+
+    #####################################################
+    # @!group Actually using the class
+    #####################################################
+
+    # Returns the value for a certain key. fastlane_core tries to fetch the value from different sources
+    # if 'ask' is true and the value is not present, the user will be prompted to provide a value if optional
+    # if 'force_ask' is true, the option is not required to be optional to ask
+    # rubocop:disable Metrics/PerceivedComplexity
+    def fetch(key, ask: true, force_ask: false)
+      UI.crash!("Key '#{key}' must be a symbol. Example :#{key}") unless key.kind_of?(Symbol)
+
+      option = verify_options_key!(key)
+
+      # Same order as https://docs.fastlane.tools/advanced/#priorities-of-parameters-and-options
+      value = if @values.key?(key) && !@values[key].nil?
+                @values[key]
+              elsif (env_value = option.fetch_env_value)
+                env_value
+              elsif self.config_file_options.key?(key)
+                self.config_file_options[key]
+              else
+                option.default_value
+              end
+
+      value = option.auto_convert_value(value)
+      value = nil if value.nil? && !option.string? # by default boolean flags are false
+      return value unless value.nil? && (!option.optional || force_ask) && ask
+
+      # fallback to asking
+      if Helper.test? || !UI.interactive?
+        # Since we don't want to be asked on tests, we'll just call the verify block with no value
+        # to raise the exception that is shown when the user passes an invalid value
+        set(key, '')
+        # If this didn't raise an exception, just raise a default one
+        UI.user_error!("No value found for '#{key}'")
+      end
+
+      while value.nil?
+        UI.important("To not be asked about this value, you can specify it using '#{option.key}'") if ENV["FASTLANE_ONBOARDING_IN_PROCESS"].to_s.length == 0
+        value = option.sensitive ? UI.password("#{option.description}: ") : UI.input("#{option.description}: ")
+
+        # ConfigItem allows to specify a type for the item but UI.password and
+        # UI.input return String values. Try to convert the String input to
+        # the option's type before passing it along.
+        value = option.auto_convert_value(value)
+
+        # Also store this value to use it from now on
+        begin
+          set(key, value)
+        rescue => ex
+          UI.error(ex)
+          value = nil
+        end
+      end
+
+      # It's very, very important to use the self[:my_key] notation
+      # as this will make sure to use the `fetch` method
+      # that is responsible for auto converting the values into the right
+      # data type
+      # Found out via https://github.com/fastlane/fastlane/issues/11243
+      return self[key]
+    end
+    # rubocop:enable Metrics/PerceivedComplexity
+
+    # Overwrites or sets a new value for a given key
+    # @param key [Symbol] Must be a symbol
+    def set(key, value)
+      UI.crash!("Key '#{key}' must be a symbol. Example :#{key}.") unless key.kind_of?(Symbol)
+      option = option_for_key(key)
+
+      unless option
+        UI.user_error!("Could not find option '#{key}' in the list of available options: #{@available_options.collect(&:key).join(', ')}")
+      end
+
+      option.verify!(value)
+
+      @values[key] = value
+      true
+    end
+
+    # see fetch
+    def values(ask: true)
+      # As the user accesses all values, we need to iterate through them to receive all the values
+      @available_options.each do |option|
+        @values[option.key] = fetch(option.key, ask: ask) unless @values[option.key]
+      end
+      @values
+    end
+
+    # Direct access to the values, without iterating through all items
+    def _values
+      @values
+    end
+
+    # Clears away any current configuration values by pushing them onto a stack.
+    # Values set after calling push_values! will be merged with the previous
+    # values after calling pop_values!
+    #
+    # see: pop_values!
+    def push_values!
+      @values_stack.push(@values)
+      @values = {}
+    end
+
+    # Restores a previous set of configuration values by merging any current
+    # values on top of them
+    #
+    # see: push_values!
+    def pop_values!
+      return if @values_stack.empty?
+      @values = @values_stack.pop.merge(@values)
+    end
+
+    def all_keys
+      @available_options.collect(&:key)
+    end
+
+    # Returns the config_item object for a given key
+    def option_for_key(key)
+      @available_options.find { |o| o.key == key }
+    end
+
+    # Aliases `[key]` to `fetch(key)` because Ruby can do it.
+    alias [] fetch
+    alias []= set
+
+    def verify_options_key!(key)
+      option = option_for_key(key)
+      UI.user_error!("Could not find option '#{key}' in the list of available options: #{@available_options.collect(&:key).join(', ')}") unless option
+      option
+    end
+  end
+end

data/fastlane_core/lib/fastlane_core/configuration/configuration_file.rb

@@ -0,0 +1,182 @@
+require_relative '../print_table'
+require_relative '../ui/ui'
+
+module FastlaneCore
+  # Responsible for loading configuration files
+  class ConfigurationFile
+    class ExceptionWhileParsingError < RuntimeError
+      attr_reader :wrapped_exception
+      attr_reader :recovered_options
+
+      def initialize(wrapped_ex, options)
+        @wrapped_exception = wrapped_ex
+        @recovered_options = options
+      end
+    end
+
+    # Available keys from the config file
+    attr_accessor :available_keys
+
+    # After loading, contains all the found options
+    attr_accessor :options
+
+    # Path to the config file represented by the current object
+    attr_accessor :configfile_path
+
+    # @param config [FastlaneCore::Configuration] is used to gather required information about the configuration
+    # @param path [String] The path to the configuration file to use
+    def initialize(config, path, block_for_missing, skip_printing_values = false)
+      self.available_keys = config.all_keys
+      self.configfile_path = path
+      self.options = {}
+
+      @block_for_missing = block_for_missing
+      content = File.read(path, encoding: "utf-8")
+
+      # From https://github.com/orta/danger/blob/master/lib/danger/Dangerfile.rb
+      if content.tr!('“”‘’‛', %(""'''))
+        UI.error("Your #{File.basename(path)} has had smart quotes sanitised. " \
+                  'To avoid issues in the future, you should not use ' \
+                  'TextEdit for editing it. If you are not using TextEdit, ' \
+                  'you should turn off smart quotes in your editor of choice.')
+      end
+
+      begin
+        # rubocop:disable Security/Eval
+        eval(content) # this is okay in this case
+        # rubocop:enable Security/Eval
+
+        print_resulting_config_values unless skip_printing_values # only on success
+      rescue SyntaxError => ex
+        line = ex.to_s.match(/\(eval\):(\d+)/)[1]
+        UI.error("Error in your #{File.basename(path)} at line #{line}")
+        UI.content_error(content, line)
+        UI.user_error!("Syntax error in your configuration file '#{path}' on line #{line}: #{ex}")
+      rescue => ex
+        raise ExceptionWhileParsingError.new(ex, self.options), "Error while parsing config file at #{path}"
+      end
+    end
+
+    def print_resulting_config_values
+      require 'terminal-table'
+      UI.success("Successfully loaded '#{File.expand_path(self.configfile_path)}' 📄")
+
+      # Show message when self.modified_values is empty
+      if self.modified_values.empty?
+        UI.important("No values defined in '#{self.configfile_path}'")
+        return
+      end
+
+      rows = self.modified_values.collect do |key, value|
+        [key, value] if value.to_s.length > 0
+      end.compact
+
+      puts("")
+      puts(Terminal::Table.new(rows: FastlaneCore::PrintTable.transform_output(rows),
+                              title: "Detected Values from '#{self.configfile_path}'"))
+      puts("")
+    end
+
+    # This is used to display only the values that have changed in the summary table
+    def modified_values
+      @modified_values ||= {}
+    end
+
+    def method_missing(method_sym, *arguments, &block)
+      # First, check if the key is actually available
+      return if self.options.key?(method_sym)
+
+      if self.available_keys.include?(method_sym)
+
+        value = arguments.first
+        value = yield if value.nil? && block_given?
+
+        if value.nil?
+          unless block_given?
+            # The config file has something like this:
+            #
+            #   clean
+            #
+            # without specifying a value for the method call
+            # or a block. This is most likely a user error
+            # So we tell the user that they can provide a value
+            warning = ["In the config file '#{self.configfile_path}'"]
+            warning << "you have the line #{method_sym}, but didn't provide"
+            warning << "any value. Make sure to append a value right after the"
+            warning << "option name. Make sure to check the docs for more information"
+            UI.important(warning.join(" "))
+          end
+          return
+        end
+
+        self.modified_values[method_sym] = value
+
+        # to support frozen strings (e.g. ENV variables) too
+        # we have to dupe the value
+        # in < Ruby 2.4.0 `.dup` is not support by boolean values
+        # and there is no good way to check if a class actually
+        # responds to `dup`, so we have to rescue the exception
+        begin
+          value = value.dup
+        rescue TypeError
+          # Nothing specific to do here, if we can't dupe, we just
+          # deal with it (boolean values can't be from env variables anyway)
+        end
+        self.options[method_sym] = value
+      else
+        # We can't set this value, maybe the tool using this configuration system has its own
+        # way of handling this block, as this might be a special block (e.g. ipa block) that's only
+        # executed on demand
+        if @block_for_missing
+          @block_for_missing.call(method_sym, arguments, block)
+        else
+          self.options[method_sym] = '' # important, since this will raise a good exception for free
+        end
+      end
+    end
+
+    # Override configuration for a specific lane. If received lane name does not
+    # match the lane name available as environment variable, no changes will
+    # be applied.
+    #
+    # @param lane_name Symbol representing a lane name.
+    # @yield Block to run for overriding configuration values.
+    #
+    def for_lane(lane_name)
+      if ENV["FASTLANE_LANE_NAME"] == lane_name.to_s
+        with_a_clean_config_merged_when_complete do
+          yield
+        end
+      end
+    end
+
+    # Override configuration for a specific platform. If received platform name
+    # does not match the platform name available as environment variable, no
+    # changes will be applied.
+    #
+    # @param platform_name Symbol representing a platform name.
+    # @yield Block to run for overriding configuration values.
+    #
+    def for_platform(platform_name)
+      if ENV["FASTLANE_PLATFORM_NAME"] == platform_name.to_s
+        with_a_clean_config_merged_when_complete do
+          yield
+        end
+      end
+    end
+
+    # Allows a configuration block (for_lane, for_platform) to get a clean
+    # configuration for applying values, so that values can be overridden
+    # (once) again. Those values are then merged into the surrounding
+    # configuration as the block completes
+    def with_a_clean_config_merged_when_complete
+      previous_config = self.options.dup
+      self.options = {}
+      begin
+        yield
+      ensure
+        self.options = previous_config.merge(self.options)
+      end
+    end
+  end
+end

data/fastlane_core/lib/fastlane_core/core_ext/cfpropertylist.rb

@@ -0,0 +1,23 @@
+# To be used instead of require "cfpropertylist". Restores extensions from
+# Plist overwritten by CFPropertyList.
+
+require "cfpropertylist"
+require "plist"
+
+# Brute-force solution to conflict between #to_plist introduced by
+# CFPropertyList and plist. Remove the method added by CFPropertyList
+# and restore the method from Plist::Emit. Each class gains a
+# #to_binary_plist method equivalent to #to_plist from CFPropertyList.
+#
+# CFPropertyList also adds Enumerator#to_plist, but there is no such
+# method from Plist, so leave it.
+[Array, Hash].each do |c|
+  if c.method_defined?(:to_plist)
+    begin
+      c.send(:alias_method, :to_binary_plist, :to_plist)
+      c.send(:remove_method, :to_plist)
+    rescue NameError
+    end
+  end
+  c.module_eval("include Plist::Emit")
+end

data/fastlane_core/lib/fastlane_core/core_ext/shellwords.rb

@@ -0,0 +1,63 @@
+require_relative '../helper'
+require 'shellwords'
+
+# Here be monkey patches
+
+class String
+  # CrossplatformShellwords
+  def shellescape
+    CrossplatformShellwords.shellescape(self)
+  end
+end
+
+class Array
+  def shelljoin
+    CrossplatformShellwords.shelljoin(self)
+  end
+end
+
+# Here be helper
+
+module CrossplatformShellwords
+  # handle switching between implementations of shellescape
+  def shellescape(str)
+    if FastlaneCore::Helper.windows?
+      WindowsShellwords.shellescape(str)
+    else
+      # using `escape` instead of expected `shellescape` here
+      # which corresponds to Shellword's `String.shellescape` implementation
+      # https://github.com/ruby/ruby/blob/1cf2bb4b2085758112503e7da7414d1ef52d4f48/lib/shellwords.rb#L216
+      Shellwords.escape(str)
+    end
+  end
+  module_function :shellescape
+
+  # make sure local implementation is also used in shelljoin
+  def shelljoin(array)
+    array.map { |arg| shellescape(arg) }.join(' ')
+  end
+  module_function :shelljoin
+end
+
+# Windows implementation
+module WindowsShellwords
+  def shellescape(str)
+    str = str.to_s
+
+    # An empty argument will be skipped, so return empty quotes.
+    # https://github.com/ruby/ruby/blob/a6413848153e6c37f6b0fea64e3e871460732e34/lib/shellwords.rb#L142-L143
+    return '""'.dup if str.empty?
+
+    str = str.dup
+
+    # wrap in double quotes if contains space
+    if str =~ /\s/
+      # double quotes have to be doubled if will be quoted
+      str.gsub!('"', '""')
+      return '"' + str + '"'
+    else
+      return str
+    end
+  end
+  module_function :shellescape
+end

data/fastlane_core/lib/fastlane_core/core_ext/string.rb

@@ -0,0 +1,17 @@
+class String
+  def fastlane_class
+    split('_').collect!(&:capitalize).join
+  end
+
+  def fastlane_module
+    self == "pem" ? 'PEM' : self.fastlane_class
+  end
+
+  def fastlane_underscore
+    self.gsub(/::/, '/').
+      gsub(/([A-Z]+)([A-Z][a-z])/, '\1_\2').
+      gsub(/([a-z\d])([A-Z])/, '\1_\2').
+      tr("-", "_").
+      downcase
+  end
+end