Class: Dependabot::Nuget::NupkgFetcher

Inherits:
Object
  • Object
show all
Extended by:
T::Sig
Defined in:
lib/dependabot/nuget/update_checker/nupkg_fetcher.rb

Class Method Summary collapse

Class Method Details

.fetch_nupkg_buffer(dependency_urls, package_id, package_version) ⇒ Object 



26
27
28
29
30
31
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 26

def self.fetch_nupkg_buffer(dependency_urls, package_id, package_version)
  # check all repositories for the first one that has the nupkg
  dependency_urls.reduce(T.let(nil, T.nilable(String))) do |nupkg_buffer, repository_details|
    nupkg_buffer || fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
  end
end

.fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version) ⇒ Object 



66
67
68
69
70
71
72
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 66

def self.fetch_nupkg_buffer_from_repository(repository_details, package_id, package_version)
  package_url = fetch_nupkg_url_from_repository(repository_details, package_id, package_version)
  return unless package_url

  auth_header = repository_details[:auth_header]
  fetch_stream(package_url, auth_header)
end

.fetch_nupkg_url_from_repository(repository_details, package_id, package_version) ⇒ Object 



41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 41

def self.fetch_nupkg_url_from_repository(repository_details, package_id, package_version)
  return unless package_id && package_version && !package_version.empty?

  feed_url = repository_details[:repository_url]
  repository_type = repository_details[:repository_type]

  package_url = if repository_type == "v2"
                  get_nuget_v2_package_url(repository_details, package_id, package_version)
                elsif repository_type == "v3"
                  get_nuget_v3_package_url(repository_details, package_id, package_version)
                else
                  raise Dependabot::DependencyFileNotResolvable, "Unexpected NuGet feed format: #{feed_url}"
                end

  package_url
end

.fetch_stream(stream_url, auth_header, max_redirects = 5) ⇒ Object 



169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 169

def self.fetch_stream(stream_url, auth_header, max_redirects = 5)
  current_url = stream_url
  current_redirects = 0

  loop do
    # Directly download the stream without any additional settings _except_ for `omit_default_port: true` which
    # is necessary to not break the URL signing that some NuGet feeds use.
    response = Excon.get(
      current_url,
      headers: auth_header,
      omit_default_port: true
    )

    # redirect the HTTP response as appropriate based on documentation here:
    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections
    case response.status
    when 200
      return response.body
    when 301, 302, 303, 307, 308
      current_redirects += 1
      return nil if current_redirects > max_redirects

      current_url = T.must(response.headers["Location"])
    else
      return nil
    end
  end
end

.fetch_url(url, repository_details) ⇒ Object 



205
206
207
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 205

def self.fetch_url(url, repository_details)
  fetch_url_with_auth(url, repository_details.fetch(:auth_header))
end

.fetch_url_with_auth(url, auth_header) ⇒ Object 



210
211
212
213
214
215
216
217
218
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 210

def self.fetch_url_with_auth(url, auth_header)
  cache = CacheManager.cache("nupkg_fetcher_cache")
  cache[url] ||= Dependabot::RegistryClient.get(
    url: url,
    headers: auth_header
  )

  cache[url]
end

.get_nuget_v2_package_url(repository_details, package_id, package_version) ⇒ Object 



145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 145

def self.get_nuget_v2_package_url(repository_details, package_id, package_version)
  # get package XML
  base_url = repository_details[:base_url].delete_suffix("/")
  package_url = "#{base_url}/Packages(Id='#{package_id}',Version='#{package_version}')"
  response = fetch_url(package_url, repository_details)
  return nil unless response&.status == 200

  # find relevant element
  doc = Nokogiri::XML(T.must(response).body)
  doc.remove_namespaces!

  content_element = doc.xpath("/entry/content")
  nupkg_url = content_element&.attribute("src")&.value
  nupkg_url
end

.get_nuget_v3_package_url(repository_details, package_id, package_version) ⇒ Object 



82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 82

def self.get_nuget_v3_package_url(repository_details, package_id, package_version)
  base_url = repository_details[:base_url]
  unless base_url
    return get_nuget_v3_package_url_from_search(repository_details, package_id,
                                                package_version)
  end

  base_url = base_url.delete_suffix("/")
  package_id_downcased = package_id.downcase
  "#{base_url}/#{package_id_downcased}/#{package_version}/#{package_id_downcased}.#{package_version}.nupkg"
end

.get_nuget_v3_package_url_from_search(repository_details, package_id, package_version) ⇒ Object 



104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
 
# File 'lib/dependabot/nuget/update_checker/nupkg_fetcher.rb', line 104

def self.get_nuget_v3_package_url_from_search(repository_details, package_id, package_version)
  search_url = repository_details[:search_url]
  return nil unless search_url

  # get search result
  search_result_response = fetch_url(search_url, repository_details)
  return nil unless search_result_response&.status == 200

  search_response_body = HttpResponseHelpers.remove_wrapping_zero_width_chars(T.must(search_result_response).body)
  search_results = JSON.parse(search_response_body)

  # find matching package and version
  package_search_result = search_results&.[]("data")&.find { |d| package_id.casecmp?(d&.[]("id")) }
  version_search_result = package_search_result&.[]("versions")&.find do |v|
    package_version.casecmp?(v&.[]("version"))
  end
  registration_leaf_url = version_search_result&.[]("@id")
  return nil unless registration_leaf_url

  registration_leaf_response = fetch_url(registration_leaf_url, repository_details)
  return nil unless registration_leaf_response
  return nil unless registration_leaf_response.status == 200

  registration_leaf_response_body =
    HttpResponseHelpers.remove_wrapping_zero_width_chars(registration_leaf_response.body)
  registration_leaf = JSON.parse(registration_leaf_response_body)

  # finally, get the .nupkg url
  registration_leaf&.[]("packageContent")
end