Class: Dependabot::Maven::Shared::SharedPackageDetailsFetcher

Inherits:
Object
  • Object
show all
Extended by:
T::Helpers, T::Sig
Defined in:
lib/dependabot/maven/shared/shared_package_details_fetcher.rb

Direct Known Subclasses

Package::PackageDetailsFetcher

Constant Summary collapse

MAVEN_METADATA_XML = 
"maven-metadata.xml"
REPOSITORY_TYPE = 
"maven_repository"
URL_KEY = 
"url"
AUTH_HEADERS_KEY = 
"auth_headers"
DEFAULT_CENTRAL_REPO_URL = 
"https://repo.maven.apache.org/maven2"
RepositoryDetails = 
T.type_alias { T::Hash[String, T.any(String, T::Hash[String, String])] }
VersionDetails = 
T.type_alias do
  {
    version: Dependabot::Version,
    source_url: String,
    release_date: T.nilable(Time)
  }
end
HtmlVersionDetails = 
T.type_alias { { release_date: T.nilable(Time) } }

Instance Method Summary collapse

Instance Method Details

#auth_headers(maven_repo_url) ⇒ Object 



407
408
409
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 407

def auth_headers(maven_repo_url)
  auth_headers_finder.auth_headers(maven_repo_url)
end

#auth_headers_finder ⇒ Object 



428
429
430
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 428

def auth_headers_finder
  @auth_headers_finder ||= T.let(Utils::AuthHeadersFinder.new(credentials), T.nilable(Utils::AuthHeadersFinder))
end

#central_repo_url ⇒ Object 



388
389
390
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 388

def central_repo_url
  DEFAULT_CENTRAL_REPO_URL
end

#central_repo_urls ⇒ Object 



394
395
396
397
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 394

def central_repo_urls
  central_url_without_protocol = central_repo_url.gsub(%r{^.*://}, "")
  %w(http:// https://).map { |p| p + central_url_without_protocol }
end

#check_response(response, repository_url) ⇒ Object 



218
219
220
221
222
223
224
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 218

def check_response(response, repository_url)
  return unless [401, 403].include?(response.status)
  return if forbidden_urls.include?(repository_url)
  return if central_repo_urls.include?(repository_url)

  forbidden_urls << repository_url
end

#credentials ⇒ Object 



39
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 39

def credentials; end

#credentials_repository_details ⇒ Object 



373
374
375
376
377
378
379
380
381
382
383
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 373

def credentials_repository_details
  credentials
    .select { |cred| cred["type"] == REPOSITORY_TYPE && cred[URL_KEY] }
    .map do |cred|
      url_value = cred.fetch(URL_KEY).gsub(%r{/+$}, "")
      {
        URL_KEY => url_value,
        AUTH_HEADERS_KEY => auth_headers(url_value)
      }
    end
end

#dependency ⇒ Object 



36
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 36

def dependency; end

#dependency_base_url(repository_url) ⇒ Object 



67
68
69
70
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 67

def dependency_base_url(repository_url)
  group_path, artifact_id = dependency_parts
  "#{repository_url}/#{group_path}/#{artifact_id}"
end

#dependency_files_url(repository_url, version) ⇒ Object 



83
84
85
86
87
88
89
90
91
92
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 83

def dependency_files_url(repository_url, version)
  _, artifact_id = dependency_parts
  base_url = dependency_base_url(repository_url)
  requirement = dependency.requirements.first
  type = requirement&.metadata_string("packaging_type") || "jar"
  classifier = requirement&.metadata_string("classifier")
  actual_classifier = classifier.nil? ? "" : "-#{classifier}"

  "#{base_url}/#{version}/#{artifact_id}-#{version}#{actual_classifier}.#{type}"
end

#dependency_metadata(repository_details) ⇒ Object 



436
437
438
439
440
441
442
443
444
445
446
447
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 436

def dependency_metadata(repository_details)
  @dependency_metadata = T.let(
    @dependency_metadata, T.nilable(T::Hash[Integer, Nokogiri::XML::Document])
  )
  @dependency_metadata ||= {}
  repository_key = repository_details.hash
  return @dependency_metadata[repository_key] if @dependency_metadata.key?(repository_key)

  xml_document = fetch_dependency_metadata(repository_details)
  @dependency_metadata[repository_key] ||= xml_document if xml_document
  @dependency_metadata[repository_key]
end

#dependency_metadata_from_html(repository_details) ⇒ Object 



451
452
453
454
455
456
457
458
459
460
461
462
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 451

def dependency_metadata_from_html(repository_details)
  @dependency_metadata_from_html = T.let(
    @dependency_metadata_from_html, T.nilable(T::Hash[Integer, Nokogiri::HTML::Document])
  )
  @dependency_metadata_from_html ||= {}
  repository_key = repository_details.hash
  return @dependency_metadata_from_html[repository_key] if @dependency_metadata_from_html.key?(repository_key)

  html_document = fetch_dependency_metadata_from_html(repository_details)
  @dependency_metadata_from_html[repository_key] ||= html_document if html_document
  @dependency_metadata_from_html[repository_key]
end

#dependency_metadata_url(repository_url) ⇒ Object 



74
75
76
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 74

def dependency_metadata_url(repository_url)
  "#{dependency_base_url(repository_url)}/#{MAVEN_METADATA_XML}"
end

#dependency_parts ⇒ Object 



53
54
55
56
57
58
59
60
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 53

def dependency_parts
  @dependency_parts = T.let(@dependency_parts, T.nilable([String, String]))
  return @dependency_parts if @dependency_parts

  group_id, artifact_id = dependency.name.split(":")
  group_path = T.must(group_id).tr(".", "/")
  @dependency_parts = [group_path, T.must(artifact_id)]
end

#dependency_pom_url(repository_url, version) ⇒ Object 



97
98
99
100
101
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 97

def dependency_pom_url(repository_url, version)
  _, artifact_id = dependency_parts
  base_url = dependency_base_url(repository_url)
  "#{base_url}/#{version}/#{artifact_id}-#{version}.pom"
end

#extract_metadata_from_xml(xml, url) ⇒ Object 



133
134
135
136
137
138
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 133

def extract_metadata_from_xml(xml, url)
  xml.css("versions > version")
     .select { |node| version_class.correct?(node.content) }
     .map { |node| version_class.new(node.content) }
     .map { |version| { version: version, source_url: url, release_date: nil } }
end

#extract_release_date_from_link(link) ⇒ Object 



203
204
205
206
207
208
209
210
211
212
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 203

def extract_release_date_from_link(link)
  raw_date_text = link.next&.text.to_s
  date_match = raw_date_text.match(/\b(?:\d{4}-\d{2}-\d{2}|\d{2}-[A-Za-z]{3}-\d{4}) \d{2}:\d{2}\b/)

  return Time.parse(date_match[0]) if date_match

  Time.parse(raw_date_text.strip)
rescue StandardError
  nil
end

#extract_version_details_from_html(html_doc) ⇒ Object 



173
174
175
176
177
178
179
180
181
182
183
184
185
186
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 173

def extract_version_details_from_html(html_doc)
  versions_detail_hash = T.let({}, T::Hash[String, HtmlVersionDetails])

  html_doc.css("a[href]").each do |link|
    version = extract_version_from_link(link)
    next unless version && version_class.correct?(version)

    release_date = extract_release_date_from_link(link)

    versions_detail_hash[version] = { release_date: release_date }
  end

  versions_detail_hash
end

#extract_version_from_link(link) ⇒ Object 



189
190
191
192
193
194
195
196
197
198
199
200
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 189

def extract_version_from_link(link)
  href = link["href"]&.strip
  return unless href&.end_with?("/")

  identifier = [link["title"], link.text, href].find { |value| value && !value.strip.empty? }
  return unless identifier

  version = identifier.strip.gsub(%r{/$}, "")
  return if ["..", "."].include?(version)

  version
end

#fetch_dependency_metadata(repository_details) ⇒ Object 



107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 107

def fetch_dependency_metadata(repository_details)
  url = repository_url(repository_details)
  headers = repository_auth_headers(repository_details)
  response = Dependabot::RegistryClient.get(
    url: dependency_metadata_url(url),
    headers: headers
  )
  check_response(response, url)
  return unless response.status < 400

  Nokogiri::XML(response.body)
rescue URI::InvalidURIError
  nil
rescue Excon::Error::Socket, Excon::Error::Timeout,
       Excon::Error::TooManyRedirects => e
  handle_registry_error(T.must(url), e, response)
  nil
end

#fetch_dependency_metadata_from_html(repository_details) ⇒ Object 



146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 146

def fetch_dependency_metadata_from_html(repository_details)
  url = repository_url(repository_details)
  headers = repository_auth_headers(repository_details)
  # Add trailing slash for directory listing
  base_directory_url = dependency_base_url(url)
  base_directory_url += "/" unless base_directory_url.end_with?("/")
  response = Dependabot::RegistryClient.get(
    url: base_directory_url,
    headers: headers
  )
  check_response(response, url)
  return unless response.status < 400

  Nokogiri::HTML(response.body)
rescue URI::InvalidURIError
  nil
rescue Excon::Error::Socket, Excon::Error::Timeout,
       Excon::Error::TooManyRedirects => e
  handle_registry_error(T.must(url), e, response)
  nil
end

#forbidden_urls ⇒ Object 



400
401
402
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 400

def forbidden_urls
  @forbidden_urls ||= T.let([], T.nilable(T::Array[String]))
end

#handle_registry_error(url, error, response) ⇒ Object

Raises:

  • (RegistryError) 


234
235
236
237
238
239
240
241
242
243
244
245
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 234

def handle_registry_error(url, error, response)
  return unless central_repo_urls.include?(url)

  response_status = response&.status || 0
  response_body = if response
                    "RegistryError: #{response.status} response status with body #{response.body}"
                  else
                    "RegistryError: #{error.message}"
                  end

  raise RegistryError.new(response_status, response_body)
end

#released?(version) ⇒ Boolean

Returns:

  • (Boolean) 


334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 334

def released?(version)
  @released_check = T.let(@released_check, T.nilable(T::Hash[Dependabot::Version, T::Boolean]))
  @released_check ||= {}
  return T.must(@released_check[version]) if @released_check.key?(version)

  @released_check[version] =
    repositories.any? do |repository_details|
      url = repository_url(repository_details)
      headers = repository_auth_headers(repository_details)
      response = Dependabot::RegistryClient.head(
        url: dependency_files_url(url, version),
        headers: headers
      )
      next true if response.status < 400

      # When the artifact file returns 404, fall back to checking the .pom file.
      # This handles artifacts with non-jar packaging (e.g., aar, bundle) where
      # the consumer POM omits <type>, causing the parser to default to "jar".
      # Only fall back when there's no classifier (classifier artifacts are specific).
      next false unless response.status == 404
      next false if dependency.requirements.first&.metadata_string("classifier")

      pom_response = Dependabot::RegistryClient.head(
        url: dependency_pom_url(url, version),
        headers: headers
      )
      pom_response.status < 400
    rescue Excon::Error::Socket, Excon::Error::Timeout,
           Excon::Error::TooManyRedirects
      false
    rescue URI::InvalidURIError => e
      raise DependencyFileNotResolvable, e.message
    end
end

#repositories ⇒ Object 



44
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 44

def repositories; end

#repository_auth_headers(repository_details) ⇒ Object 



420
421
422
423
424
425
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 420

def repository_auth_headers(repository_details)
  headers = repository_details.fetch(AUTH_HEADERS_KEY)
  return headers if headers.is_a?(Hash)

  raise "Repository auth headers must be a hash"
end

#repository_url(repository_details) ⇒ Object 



412
413
414
415
416
417
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 412

def repository_url(repository_details)
  url = repository_details.fetch(URL_KEY)
  return url if url.is_a?(String)

  raise "Repository URL must be a string"
end

#version_class ⇒ Object 



467
468
469
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 467

def version_class
  dependency.version_class
end

#versions ⇒ Object 



253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 253

def versions
  @version_details = T.let(@version_details, T.nilable(T::Array[VersionDetails]))
  return @version_details if @version_details

  @version_details = versions_details_from_xml

  begin
    versions_details_hash = versions_details_hash_from_html if @version_details.any?

    if versions_details_hash
      @version_details = @version_details.map do |vd|
        html_details = versions_details_hash[vd[:version].to_s]

        next vd unless html_details

        release_date = html_details[:release_date]

        next vd unless release_date

        vd.merge(
          release_date: html_details[:release_date],
          source_url: vd[:source_url]
        )
      end
    end
  rescue StandardError => e
    Dependabot.logger.error(
      "Error fetching version details from HTML: #{e.message}"
    )
  end

  @version_details = @version_details.sort_by { |d| d.fetch(:version) }
  @version_details
end

#versions_details_from_xml ⇒ Object

Raises:

  • (PrivateSourceAuthenticationFailure) 


290
291
292
293
294
295
296
297
298
299
300
301
302
303
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 290

def versions_details_from_xml
  forbidden_urls.clear
  version_details = repositories.flat_map do |repository_details|
    url = repository_url(repository_details)
    xml = dependency_metadata(repository_details)
    next [] if xml.nil?

    extract_metadata_from_xml(xml, url)
  end

  raise PrivateSourceAuthenticationFailure, forbidden_urls.first if version_details.none? && forbidden_urls.any?

  version_details
end

#versions_details_hash_from_html ⇒ Object 



307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
 
# File 'lib/dependabot/maven/shared/shared_package_details_fetcher.rb', line 307

def versions_details_hash_from_html
  forbidden_urls.clear

  versions_detail_hash = T.let(
    {}, T::Hash[String, HtmlVersionDetails]
  )
  repositories.each do |repository_details|
    html = dependency_metadata_from_html(repository_details)
    next if html.nil?

    versions_detail_hash = extract_version_details_from_html(html)
    break if versions_detail_hash.any?
  end

  if versions_detail_hash.any? && forbidden_urls.any?
    raise PrivateSourceAuthenticationFailure,
          forbidden_urls.first
  end

  versions_detail_hash
end