neetob 0.5.78 → 0.5.80

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7da97075695cc96152e94c9d95cbd8001747a5998c471784ab83323fe46a00a1
-  data.tar.gz: a3fc70f6b2312afa6b38b0614be2e9b34b39f50ffb1aa758a15fa548ed0fd775
+  metadata.gz: 72c4fda7b0a63934743c86ea9c318d249f03363e95b842bfbc037a5140501df5
+  data.tar.gz: 8fa0bb5da4de2bd950651979aa1b74b4045e6d890eb8cbb4339f6a5ff8ace1fc
 SHA512:
-  metadata.gz: fcc00a4bd233a820eaccf2b95599a8551a9adfc0f167b6de801f49af508f9ef445e6785ca808a2678578a9c489741ca3c1b0c6630695d74ba2c0ad7dc8313e00
-  data.tar.gz: 879c8a22258b9fbf75a68ce388331df1b432916830ebe11f6a2e59533b146092570626d5c7f24de8b663835544a46a92c17d692b92c6ed65214493e8d1d8d135
+  metadata.gz: c68a711f36a47c1066fe0b0200fd4d900f324b4992305aa91b2d3570b3d7a6b5395c1bc393fbb7b19f5c510ab4ed38b1b618ac29ac9618eb208ec49795abf3b5
+  data.tar.gz: e7c0f16354008c8b3d27af875451194fc5d488f2a10313f6551cff3199a1190f5d355d46c2ac697c2ebbe0ccbebcaaee3fa363ae788c8019f90d218e81233b5b

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    neetob (0.5.78)
+    neetob (0.5.80)
       actionview
       activesupport
       brakeman (~> 5.0)
@@ -472,7 +472,7 @@ GEM
     unicode (0.4.4.5)
     unicode-display_width (2.6.0)
     uniform_notifier (1.16.0)
-    uri (1.0.3)
+    uri (1.0.4)
     version_gem (1.1.4)
     webmock (3.24.0)
       addressable (>= 2.8.0)

data/lib/neetob/cli/github/unused_assets_audit.rb

@@ -6,6 +6,11 @@ module Neetob
     module Github
       class UnusedAssetsAudit < MakePr::Base
         DESCRIPTION = "Fix security vulnerabilities reported by unused assets audit"
+        TEXT_FILE_EXTENSIONS = %w[
+          .rb .rake .js .jsx .ts .tsx .css .scss .sass .less
+          .html .erb .haml .slim .json .yml .yaml .md .txt
+        ].freeze
+
         attr_accessor :repos, :sandbox
 
         def initialize(repos, sandbox = false)
@@ -21,10 +26,9 @@ module Neetob
             begin
               ui.info("\nWorking on repo #{repo}", print_to_audit_log: false)
               clone_repo_in_tmp_dir(repo)
-              image_dir = "/tmp/neetob/#{repo_name_without_org_suffix(repo)}/app/assets/images"
-              src_dir = "/tmp/neetob/#{repo_name_without_org_suffix(repo)}/app/javascript/src"
-              views_dir = "/tmp/neetob/#{repo_name_without_org_suffix(repo)}/app/views"
-              report = find_unused_images(image_dir, src_dir, views_dir)
+              repo_root = "/tmp/neetob/#{repo_name_without_org_suffix(repo)}"
+              image_dir = "#{repo_root}/app/assets/images"
+              report = find_unused_images(repo_root, image_dir)
               ui.success("Successfully executed unused assets audit for #{repo}", print_to_audit_log: false)
             rescue StandardError => e
               ExceptionHandler.new(e).process
@@ -42,46 +46,114 @@ module Neetob
             Dir.glob("#{dir_path}/**/*").select { |file| File.file?(file) }
           end
 
-          def find_unused_images(image_dir, src_dir, views_dir)
+          def directories_to_scan(repo_root)
+            [
+              "#{repo_root}/app/javascript/src",
+              "#{repo_root}/app/javascript/stylesheets",
+              "#{repo_root}/app/views",
+              "#{repo_root}/app/services",
+              "#{repo_root}/test",
+              "#{repo_root}/lib/tasks"
+            ].select { |dir| Dir.exist?(dir) }
+          end
+
+          def find_unused_images(repo_root, image_dir)
             images = Set.new(list_image_files(image_dir))
-            images = filter_used_images(src_dir, images)
-            images = filter_used_images(views_dir, images, true)
+            directories_to_scan(repo_root).each do |dir|
+              images = filter_used_images(dir, images)
+            end
             images.to_a
           end
 
-          def filter_used_images(dir, images, is_views_path = false)
+          def filter_used_images(dir, images)
             new_images_set = Set.new(images)
             Dir.glob("#{dir}/**/*") do |file|
               next unless File.file?(file)
+              next unless text_file?(file)
+
+              file_content = read_file_safely(file)
+              next if file_content.nil?
 
-              File.open(file, "r") do |file_content|
-                new_images_set.each do |image_file_path|
-                  destructured_image_path = split_image_path(is_views_path, image_file_path)
-                  if image_file_imported(file_content.read, destructured_image_path, is_views_path)
-                    new_images_set.delete(image_file_path)
-                  end
-                  file_content.rewind
+              new_images_set.each do |image_file_path|
+                if image_used_in_file?(file_content, image_file_path)
+                  new_images_set.delete(image_file_path)
                 end
               end
             end
             new_images_set
           end
 
-          def image_file_imported(file, image_path, is_views_path)
-            if is_views_path
-              regex = /"#{Regexp.escape(image_path)}"/
-            else
-              regex = /import .* from ".*#{Regexp.escape(image_path)}.*";/
-            end
-            file.match(regex)
+          def text_file?(file)
+            TEXT_FILE_EXTENSIONS.include?(File.extname(file).downcase)
           end
 
-          def split_image_path(is_views_path, image_file_path)
-            if is_views_path
-              image_file_path.split("images/").last
-            else
-              image_file_path[image_file_path.index("images")..image_file_path.rindex(".") - 1]
+          def read_file_safely(file)
+            File.read(file, encoding: "UTF-8", invalid: :replace, undef: :replace)
+          rescue StandardError
+            nil
+          end
+
+          def image_used_in_file?(file_content, image_file_path)
+            # Extract relative path from images directory (e.g., "sample_data/camel.jpeg")
+            relative_path = image_file_path.split("images/").last
+            filename = File.basename(image_file_path)
+            filename_without_ext = File.basename(image_file_path, ".*")
+            extension = File.extname(image_file_path)
+            parent_dir = File.dirname(relative_path)
+
+            # Pattern 1: Direct filename reference (e.g., "camel.jpeg", "landingBg.png")
+            return true if file_content.include?(filename)
+
+            # Pattern 2: Relative path reference (e.g., "sample_data/camel.jpeg")
+            return true if file_content.include?(relative_path)
+
+            # Pattern 3: Import statement without extension (e.g., import from "images/sample_data/camel")
+            # Skip for short numeric filenames (like "1", "2", "3") to avoid false positives with paths like "i18next"
+            # The filename must be at the end of the path (after a "/" or at the start) to avoid matching substrings
+            # e.g., "user" should not match "UserContext" in import paths
+            unless filename_without_ext.match?(/^\d{1,2}$/)
+              return true if file_content.match?(/import .* from "(.*\/)?#{Regexp.escape(filename_without_ext)}";/)
             end
+
+            # Pattern 4: CSS url() with relative path containing the filename
+            return true if file_content.match?(/url\(["']?[^)"']*#{Regexp.escape(filename)}["']?\)/)
+
+            # Pattern 5: Rails.root.join with split arguments (e.g., Rails.root.join("app", "assets", "images", "sample_data"))
+            # Check if the parent directory or filename is referenced in Rails.root.join calls
+            if parent_dir != "."
+              return true if file_content.match?(/Rails\.root\.join\([^)]*["']#{Regexp.escape(parent_dir)}["'][^)]*\)/)
+            end
+            return true if file_content.match?(/Rails\.root\.join\([^)]*["']#{Regexp.escape(filename)}["'][^)]*\)/)
+
+            # Pattern 6: Rails.root.join with single path argument containing the path
+            rails_join_path_regex = /Rails\.root\.join\(["'][^"']*#{Regexp.escape(relative_path)}[^"']*["']\)/
+            return true if file_content.match?(rails_join_path_regex)
+
+            # Pattern 7: File.read/File.open with path containing the filename or relative path
+            return true if file_content.match?(/File\.(read|open)\(["'][^"']*#{Regexp.escape(filename)}[^"']*["']/)
+            return true if file_content.match?(/File\.(read|open)\([^)]*#{Regexp.escape(relative_path)}/)
+
+            # Pattern 8: Dynamic path construction with interpolation
+            # e.g., "app/assets/images/sample/#{[1, 2, 3].sample}.jpg" should match "sample/1.jpg"
+            # Check if parent directory is referenced with string interpolation for numbered files
+            if parent_dir != "." && filename_without_ext.match?(/^\d+$/)
+              # For files like "1.jpg", "2.jpg" in a directory, check for interpolation patterns
+              # Allow any path prefix before the parent directory (e.g., "app/assets/images/sample/...")
+              escaped_dir = Regexp.escape(parent_dir)
+              escaped_ext = Regexp.escape(extension)
+              interpolation_with_prefix = /["'][^"']*\/#{escaped_dir}\/\#\{.*\}#{escaped_ext}["']/
+              return true if file_content.match?(interpolation_with_prefix)
+
+              # Also match when parent_dir is at the start of the path (e.g., "sample/#{...}.jpg")
+              interpolation_at_start = /["']#{escaped_dir}\/\#\{.*\}#{escaped_ext}["']/
+              return true if file_content.match?(interpolation_at_start)
+            end
+
+            # Pattern 9: image_path.join with filename (used in sample data loaders)
+            # e.g., image_path.join("camel.jpeg")
+            return true if file_content.match?(/\.join\(["']#{Regexp.escape(filename)}["']\)/)
+
+            false
           end
       end
     end

data/lib/neetob/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Neetob
-  VERSION = "0.5.78"
+  VERSION = "0.5.80"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: neetob
 version: !ruby/object:Gem::Version
-  version: 0.5.78
+  version: 0.5.80
 platform: ruby
 authors:
 - Udai Gupta
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-01-23 00:00:00.000000000 Z
+date: 2026-01-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: thor