rail_verdict 1.2.0 → 1.4.0

data/lib/rail_verdict/analyzers/simplecov.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require "pathname"
 
 require_relative "_shared"
 
@@ -18,9 +19,9 @@ module RailVerdict
 
       def probe(repository_root, runner: nil, timeout_seconds: 5.0)
         config = load_config(repository_root)
-        coverage_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
-        full_path = File.expand_path(coverage_path, repository_root)
-        return Probe.new(status: "unavailable", message: "coverage file is absent: #{coverage_path}") unless File.file?(full_path)
+        raw_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
+        full_path = resolve_contained_coverage_path(repository_root, raw_path)
+        return Probe.new(status: "unavailable", message: "coverage file is absent: #{raw_path}") unless File.file?(full_path)
 
         text = File.binread(full_path).force_encoding(Encoding::UTF_8)
         return Probe.new(status: "parse_failed", message: "coverage file is not valid UTF-8") unless text.valid_encoding?
@@ -30,11 +31,18 @@ module RailVerdict
         case detected
         when :coverage_v1
           version = document["version"].to_s
-          return Probe.new(status: "unsupported", message: "unsupported SimpleCov version #{version}") unless version.start_with?("1")
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return Probe.new(status: "unsupported", version: version, message: "unsupported SimpleCov version #{version}")
+          end
           Probe.new(status: "succeeded", version: version)
         when :native_simplecov
           version = extract_native_version(document)
-          # Accept any native simplecov version >=0.20 with coverage hash; version check is permissive.
+          return Probe.new(status: "unsupported", message: "native SimpleCov version could not be determined") unless version
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return Probe.new(status: "unsupported", version: version, message: "unsupported SimpleCov version #{version}")
+          end
           Probe.new(status: "succeeded", version: version)
         when :unsupported
           Probe.new(status: "unsupported", message: "unsupported coverage document shape")
@@ -51,13 +59,18 @@ module RailVerdict
 
       def run(repository_root, runner: nil, timeout_seconds: 10.0, probe_result: nil, configuration: nil)
         config = load_config(repository_root, configuration: configuration)
-        coverage_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
+        raw_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
         freshness_window = config.fetch("freshness_window_seconds") { DEFAULT_FRESHNESS_WINDOW_SECONDS }
-        invocation = { "executable" => "simplecov", "argv" => ["read", coverage_path] }
-        full_path = File.expand_path(coverage_path, repository_root)
+        invocation = { "executable" => "simplecov", "argv" => ["read", raw_path] }
+
+        begin
+          full_path = resolve_contained_coverage_path(repository_root, raw_path)
+        rescue MalformedOutput => error
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message)), []]
+        end
 
         unless File.file?(full_path)
-          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unavailable", message: "coverage file is absent: #{coverage_path}"), []]
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unavailable", message: "coverage file is absent: #{raw_path}"), []]
         end
 
         begin
@@ -92,24 +105,29 @@ module RailVerdict
         version = nil
         if detected == :coverage_v1
           version = document["version"].to_s
-          probe_result ||= probe(repository_root, timeout_seconds: timeout_seconds)
-          unless version.start_with?("1")
-            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "unsupported SimpleCov version #{version}", tool_version: probe_result.version || version), []]
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "unsupported SimpleCov version #{version}", tool_version: version), []]
           end
           errors = validate_coverage_schema(document)
           unless errors.empty?
-            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: errors.first, tool_version: probe_result.version || version), []]
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: errors.first, tool_version: version), []]
           end
           normalized = normalize_coverage_v1(document)
-          version = document["version"].to_s
         elsif detected == :native_simplecov
+          version = extract_native_version(document)
+          unless version
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "native SimpleCov version could not be determined", tool_version: nil), []]
+          end
+          v = Gem::Version.new(version) rescue nil
+          if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "unsupported SimpleCov version #{version}", tool_version: version), []]
+          end
           begin
             normalized = normalize_native_document(document, repository_root)
-            version = extract_native_version(document)
           rescue MalformedOutput => error
-            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: probe_result&.version), []]
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: version), []]
           end
-          # Validate normalized shape via same schema
           errors = validate_coverage_schema(normalized)
           unless errors.empty?
             return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: errors.first, tool_version: version), []]
@@ -129,7 +147,7 @@ module RailVerdict
           "percent" => executable == 0 ? 100.0 : ((covered.to_f / executable) * 100).round(2),
           "stale" => stale,
           "freshness_window_seconds" => Integer(freshness_window),
-          "coverage_path" => coverage_path.to_s[0, 512],
+          "coverage_path" => raw_path.to_s[0, 512],
           "files" => normalized["files"],
           "_coverage_document" => normalized
         }
@@ -150,47 +168,38 @@ module RailVerdict
 
       private
 
-      def detect_format(document)
-        return :malformed unless document.is_a?(Hash)
+      def resolve_contained_coverage_path(repository_root, configured_path)
+        rel_path = configured_path.to_s.strip
+        rel_path = DEFAULT_COVERAGE_PATH if rel_path.empty?
 
-        # coverage-v1 has version starting with "1" and files array
-        if document["version"].is_a?(String) && document["files"].is_a?(Array)
-          return :coverage_v1
-        end
+        root = File.realpath(repository_root) rescue File.expand_path(repository_root)
+        full_path = File.expand_path(rel_path, root)
 
-        # Native SimpleCov JSON: has "coverage" hash where values contain lines
-        if document["coverage"].is_a?(Hash) && !document["coverage"].empty?
-          sample = document["coverage"].values.first
-          # Native values are hashes with "lines" key
-          if sample.is_a?(Hash) && sample.key?("lines")
-            return :native_simplecov
-          end
+        rel = Pathname.new(full_path).relative_path_from(Pathname.new(root)).to_s rescue nil
+        if rel.nil? || rel.start_with?("..")
+          raise MalformedOutput, "configured coverage_path escapes repository root: #{configured_path}"
         end
 
-        # Native may have empty coverage hash (empty file)
-        if document.key?("coverage") && document["coverage"].is_a?(Hash) && document["meta"].is_a?(Hash)
-          return :native_simplecov
-        end
+        full_path
+      end
 
-        # Also consider empty coverage hash without meta but with groups
-        if document.key?("coverage") && document["coverage"].is_a?(Hash) && document["coverage"].empty?
-          # Could be native empty or malformed; treat as native if meta or groups present
-          return :native_simplecov if document.key?("meta") || document.key?("groups")
-          # Fallback: if no files and no version, it's unsupported rather than malformed
+      def detect_format(document)
+        return :malformed unless document.is_a?(Hash)
+
+        if document.key?("version") && document.key?("timestamp") && document.key?("files")
+          return :coverage_v1 if document["files"].is_a?(Array)
+          return :malformed if document.key?("files")
           return :unsupported
         end
 
-        # If document has no recognizable shape but is Hash with coverage key mismatched
         if document.key?("coverage") || document.key?("meta") || document.key?("groups")
           return :native_simplecov if document["coverage"].is_a?(Hash)
         end
 
-        # If it has version but not files, or files but wrong shape => unsupported/malformed via validator
         if document.key?("version") || document.key?("files") || document.key?("timestamp")
-          # Let schema validation decide malformed vs unsupported
-          # If version exists but not starting 1 => unsupported
-          if document["version"].is_a?(String) && !document["version"].start_with?("1")
-            return :unsupported
+          if document["version"].is_a?(String)
+            v = Gem::Version.new(document["version"]) rescue nil
+            return :unsupported if v.nil? || !SUPPORTED_VERSION_RANGE.satisfied_by?(v)
           end
           return :malformed if document.key?("files") || document.key?("version")
         end
@@ -206,8 +215,7 @@ module RailVerdict
         if document["version"].is_a?(String) && !document["version"].empty?
           return document["version"].to_s[0, 64]
         end
-        # Default for native without explicit version
-        "1.0"
+        nil
       end
 
       def normalize_native_document(document, repository_root)
@@ -229,7 +237,6 @@ module RailVerdict
             when NilClass
               nil
             when String
-              # SimpleCov uses "ignored" for skipped lines
               hit == "ignored" ? nil : (raise MalformedOutput, "unexpected string in coverage lines: #{hit.inspect}")
             else
               raise MalformedOutput, "coverage lines must be integers, null, or \"ignored\""
@@ -237,8 +244,6 @@ module RailVerdict
           end
 
           filename = normalize_native_path(raw_path, repository_root)
-
-          # Skip empty paths after normalization
           raise MalformedOutput, "normalized path is empty for #{raw_path}" if filename.empty?
           unless filename.match?(RailVerdict::Finding::LOCATION_PATH_PATTERN)
             raise MalformedOutput, "coverage filename is not a clean repository-relative path: #{filename.inspect}"
@@ -251,7 +256,7 @@ module RailVerdict
 
         {
           "version" => "1.0",
-          "timestamp" => document["timestamp"].is_a?(Integer) ? document["timestamp"] : Time.now.to_i,
+          "timestamp" => document["timestamp"].is_a?(Integer) ? document["timestamp"] : 0,
           "files" => files
         }
       end
@@ -259,33 +264,24 @@ module RailVerdict
       def normalize_native_path(raw_path, repository_root)
         str = raw_path.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "?").scrub("?").strip
         str = str.delete("\u0000")
-        # Remove leading ./ 
-        str = str.delete_prefix("./")
-        # If absolute, make relative to repository_root if possible
-        if str.start_with?("/")
-          begin
-            root = File.realpath(repository_root)
-            abs = File.expand_path(str)
-            # Use Pathname relative if inside root
-            require "pathname"
-            rel = Pathname.new(abs).relative_path_from(Pathname.new(root)).to_s rescue nil
-            if rel && !rel.start_with?("..") && rel.match?(RailVerdict::Finding::LOCATION_PATH_PATTERN)
-              return rel
-            end
-          rescue StandardError
-            nil
-          end
-          # Fallback: strip leading slash
-          str = str.delete_prefix("/")
+        raise MalformedOutput, "coverage path is empty" if str.empty?
+
+        root = File.realpath(repository_root) rescue File.expand_path(repository_root)
+        full = File.expand_path(str, root)
+
+        rel = Pathname.new(full).relative_path_from(Pathname.new(root)).to_s rescue nil
+        if rel.nil? || rel.start_with?("..")
+          raise MalformedOutput, "coverage path is outside repository root: #{str}"
         end
-        # Normalize redundant separators and strip
-        str = str.gsub(%r{//+}, "/")
-        str = str.strip
-        str
+
+        unless rel.match?(RailVerdict::Finding::LOCATION_PATH_PATTERN)
+          raise MalformedOutput, "coverage path is not a clean repository-relative path: #{rel}"
+        end
+
+        rel
       end
 
       def normalize_coverage_v1(document)
-        # Already validated; ensure deterministic ordering by filename
         files = document["files"].map do |f|
           { "filename" => f["filename"].to_s, "coverage" => { "lines" => f.dig("coverage", "lines") } }
         end.sort_by { |f| f["filename"] }

data/lib/rail_verdict/check.rb

@@ -499,7 +499,7 @@ module RailVerdict
         adapter = build_adapter(name, rubocop_command_resolver)
         next unless adapter
 
-        timeout_seconds = resolve_timeout_seconds(configuration, name, default_timeout_seconds)
+        timeout_seconds = [[resolve_timeout_seconds(configuration, name, default_timeout_seconds).to_f, 5.0].min, 1.0].max
         probes[name] = adapter.probe(root, runner: runner, timeout_seconds: timeout_seconds)
       end
       probes