diff --git a/maven/lib/dependabot/maven/file_fetcher.rb b/maven/lib/dependabot/maven/file_fetcher.rb index cbd949a3b7..5bc4a2d2e8 100644 --- a/maven/lib/dependabot/maven/file_fetcher.rb +++ b/maven/lib/dependabot/maven/file_fetcher.rb @@ -32,6 +32,7 @@ def fetch_files fetched_files << pom fetched_files += child_poms fetched_files += relative_path_parents(fetched_files) + fetched_files += targetfiles fetched_files << extensions if extensions fetched_files.uniq end @@ -47,6 +48,14 @@ def pom def extensions @extensions ||= T.let(fetch_file_if_present(".mvn/extensions.xml"), T.nilable(Dependabot::DependencyFile)) end + + sig { returns(T::Array[DependencyFile]) } + def targetfiles + @targetfiles ||= + repo_contents(raise_errors: false). + select { |f| f.type == "file" && f.name.end_with?(".target") }. + map { |f| fetch_file_from_host(f.name) } + end sig { returns(T::Array[DependencyFile]) } def child_poms diff --git a/maven/lib/dependabot/maven/file_parser.rb b/maven/lib/dependabot/maven/file_parser.rb index 6dfee68bab..4089497c2f 100644 --- a/maven/lib/dependabot/maven/file_parser.rb +++ b/maven/lib/dependabot/maven/file_parser.rb @@ -26,12 +26,14 @@ class FileParser < Dependabot::FileParsers::Base # - Any dependencies (incl. those in dependencyManagement or plugins) # - Any plugins (incl. those in pluginManagement) # - Any extensions + # - Any eclipse-target with a location of type Maven DEPENDENCY_SELECTOR = "project > parent, " \ "dependencies > dependency, " \ "extensions > extension, " \ "annotationProcessorPaths > path" PLUGIN_SELECTOR = "plugins > plugin" EXTENSION_SELECTOR = "extensions > extension" + TARGET_SELECTOR = "target > locations > location[type='Maven'] > dependencies > dependency" PLUGIN_ARTIFACT_ITEMS_SELECTOR = "plugins > plugin > executions > execution > " \ "configuration > artifactItems > artifactItem" @@ -43,6 +45,7 @@ def parse dependency_set = DependencySet.new pomfiles.each { |pom| dependency_set += pomfile_dependencies(pom) } extensionfiles.each { |extension| dependency_set += extensionfile_dependencies(extension) } + targetfiles.each { |target| dependency_set += targetfile_dependencies(target) } dependency_set.dependencies end diff --git a/maven/spec/dependabot/maven/file_fetcher_spec.rb b/maven/spec/dependabot/maven/file_fetcher_spec.rb index bf14800f84..72fcd8c19e 100644 --- a/maven/spec/dependabot/maven/file_fetcher_spec.rb +++ b/maven/spec/dependabot/maven/file_fetcher_spec.rb @@ -27,6 +27,9 @@ directory: directory ) end + + let(:file_fetcher_instance) do + described_class.new(source: source, credentials: credentials, repo_contents_path: nil) before do allow(file_fetcher_instance).to receive(:commit).and_return("sha") @@ -79,6 +82,21 @@ it { is_expected.to be(false) } end end + + before do + allow(file_fetcher_instance).to receive(:commit).and_return("sha") + + stub_request(:get, File.join(url, ".mvn?ref=sha")). + with(headers: { "Authorization" => "token token" }). + to_return( + status: 404 + ) + stub_request(:get, /.*\?ref=sha/). + with(headers: { "Authorization" => "token token" }). + to_return( + status: 404 + ) + end context "with a basic pom" do before do diff --git a/maven/spec/dependabot/maven/file_parser_spec.rb b/maven/spec/dependabot/maven/file_parser_spec.rb index 07d8534ecb..666bf664a2 100644 --- a/maven/spec/dependabot/maven/file_parser_spec.rb +++ b/maven/spec/dependabot/maven/file_parser_spec.rb @@ -118,6 +118,33 @@ end end + context "with target-file" do + let(:files) { [targetfile, pom] } + let(:targetfile) do + Dependabot::DependencyFile.new(name: "releng/myproject.target", content: targetfile_body) + end + let(:targetfile_body) { fixture("target-files", "example.target") } + + describe "the sole dependency" do + subject(:dependency) { dependencies[3] } + + it "has the right details" do + expect(dependency).to be_a(Dependabot::Dependency) + expect(dependency.name).to eq("commons-io:commons-io") + expect(dependency.version).to eq("2.11.0") + expect(dependency.requirements).to eq( + [{ + requirement: "2.11.0", + file: "releng/myproject.target", + groups: [], + source: nil, + metadata: { packaging_type: "jar" } + }] + ) + end + end + end + context "with rogue whitespace" do let(:pom_body) { fixture("poms", "whitespace.xml") } diff --git a/maven/spec/fixtures/target-files/example.target b/maven/spec/fixtures/target-files/example.target new file mode 100644 index 0000000000..86ef8ab39d --- /dev/null +++ b/maven/spec/fixtures/target-files/example.target @@ -0,0 +1,18 @@ + + + + + + + + + commons-io + commons-io + 2.11.0 + jar + + + + + + \ No newline at end of file