Class: Homebrew::DevCmd::AdvisoryMatch::DirEmitter Private

Inherits:
Emitter show all
Defined in:
dev-cmd/advisory-match.rb

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Instance Method Summary collapse

Constructor Details

#initialize(dir, verbose:, close_open_ranges:) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • dir (String)
  • verbose (Boolean)
  • close_open_ranges (Boolean) 


262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
 
# File 'dev-cmd/advisory-match.rb', line 262

def initialize(dir, verbose:, close_open_ranges:)
  super()
  FileUtils.mkdir_p(dir)
  @dir = dir
  @verbose = verbose
  @close_open_ranges = close_open_ranges
  @written = T.let(0, Integer)
  @unchanged = T.let(0, Integer)
  @skipped_generated = T.let(0, Integer)
  @history_walks = T.let(0, Integer)
  @history_unavailable_by_formula = T.let({}, T::Hash[String, Integer])
  @alias_targets = T.let({}, T::Hash[String, T::Array[String]])
  @protected_aliases = T.let({}, T::Hash[String, T::Boolean])
  @alias_records = T.let({}, T::Hash[String, T.untyped])
  @identity_paths = T.let({}, T::Hash[String, T::Array[String]])
  @path_identities = T.let({}, T::Hash[String, T::Array[String]])
  @alias_index_loaded = T.let(false, T::Boolean)
end

Instance Method Details

#<<(record) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Parameters:



369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
 
# File 'dev-cmd/advisory-match.rb', line 369

def <<(record)
  updates = alias_target_paths(record.fetch(:id)).map do |path|
    candidate = record.deep_dup
    existing = alias_record(path) if File.file?(path)
    if existing.is_a?(Hash)
      candidate[:id] = existing.fetch("id")
      candidate[:upstream] = (Array(existing["upstream"]) + Array(candidate[:upstream])).uniq
    elsif File.file?(path)
      candidate[:id] = File.basename(path, ".json")
    end
    merged = Homebrew::Vulns::OsvExport.merge_existing(
      path, candidate, close_open_ranges: @close_open_ranges
    )
    [path, merged]
  end

  updates.each do |path, merged|
    if merged.nil?
      @unchanged += 1
      next
    end
    File.write(path, "#{JSON.pretty_generate(merged)}\n")
    puts "  wrote #{path}" if @verbose
    @written += 1
  end
end

#affected_formula_names(record) ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



500
501
502
503
504
505
506
507
508
509
510
 
# File 'dev-cmd/advisory-match.rb', line 500

def affected_formula_names(record)
  Array(record["affected"]).filter_map do |entry|
    next unless entry.is_a?(Hash)

    package = entry["package"]
    next unless package.is_a?(Hash)
    next if package["ecosystem"] != Homebrew::Vulns::OsvExport::ECOSYSTEM

    package["name"]
  end.uniq
end

#alias_protected?(record_id) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


364
365
366
 
# File 'dev-cmd/advisory-match.rb', line 364

def alias_protected?(record_id)
  @protected_aliases.fetch(record_id, false)
end

#alias_record(path) ⇒ T.untyped

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (T.untyped) 


491
492
493
494
495
496
497
 
# File 'dev-cmd/advisory-match.rb', line 491

def alias_record(path)
  return @alias_records[path] if @alias_records.key?(path)

  @alias_records[path] = JSON.parse(File.read(path))
rescue JSON::ParserError
  @alias_records[path] = :malformed
end

#alias_target_paths(record_id) ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



486
487
488
 
# File 'dev-cmd/advisory-match.rb', line 486

def alias_target_paths(record_id)
  @alias_targets.fetch(record_id) { [record_path(record_id)] }
end

#ensure_alias_index ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.



513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
 
# File 'dev-cmd/advisory-match.rb', line 513

def ensure_alias_index
  return if @alias_index_loaded

  Dir.glob(File.join(@dir, "BREW-*.json")).each do |path|
    existing = alias_record(path)
    next unless existing.is_a?(Hash)

    formula_names = affected_formula_names(existing)
    next unless formula_names.one?

    identities = Array(existing["upstream"]).grep(String).map do |id|
      "BREW-#{formula_names.fetch(0)}-#{id}"
    end.uniq
    @path_identities[path] = identities
    identities.each { |identity| (@identity_paths[identity] ||= []) << path }
  end
  @alias_index_loaded = true
end

#finish ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.



587
588
589
590
591
592
593
594
595
596
 
# File 'dev-cmd/advisory-match.rb', line 587

def finish
  history_unavailable = @history_unavailable_by_formula.values.sum
  Utils::Output.ohai "#{@written} records written to #{@dir} " \
                     "(#{@unchanged} unchanged, #{@skipped_generated} generated left as-is, " \
                     "#{@history_walks} history walks, #{history_unavailable} history-unavailable skips)"
  return if @history_unavailable_by_formula.empty?

  puts "  Unavailable history by formula:"
  @history_unavailable_by_formula.sort.each { |formula, count| puts "    #{formula}: #{count}" }
end

#fixed_boundary_valid?(record_id, boundary) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
 
# File 'dev-cmd/advisory-match.rb', line 416

def fixed_boundary_valid?(record_id, boundary)
  alias_target_paths(record_id).all? do |path|
    next true unless File.file?(path)

    existing = alias_record(path)
    next false unless existing.is_a?(Hash)

    affected = existing["affected"]
    next false unless affected.is_a?(Array)

    affected.all? do |entry|
      entry.is_a?(Hash) &&
        Homebrew::Vulns::OsvExport.fixed_follows?(homebrew_ranges(entry["ranges"]), boundary)
    end
  end
end

#history_required?(record_id) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
 
# File 'dev-cmd/advisory-match.rb', line 397

def history_required?(record_id)
  alias_target_paths(record_id).any? do |path|
    next true unless File.file?(path)

    existing = alias_record(path)
    next true unless existing.is_a?(Hash)

    affected = existing["affected"]
    next true unless affected.is_a?(Array)
    next true if affected.empty?

    affected.any? do |entry|
      !entry.is_a?(Hash) ||
        !Homebrew::Vulns::OsvExport.ranges_terminal?(homebrew_ranges(entry["ranges"]))
    end
  end
end

#homebrew_ranges(ranges) ⇒ Array<T.untyped>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • ranges (T.untyped)

Returns:



580
581
582
583
584
 
# File 'dev-cmd/advisory-match.rb', line 580

def homebrew_ranges(ranges)
  Array(ranges).select do |range|
    range.is_a?(Hash) && range["type"] == "ECOSYSTEM"
  end
end

#matching_alias_paths(record_ids) ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
 
# File 'dev-cmd/advisory-match.rb', line 533

def matching_alias_paths(record_ids)
  pending = record_ids.dup
  identities = T.let({}, T::Hash[String, T::Boolean])
  paths = T.let({}, T::Hash[String, T::Boolean])
  until pending.empty?
    identity = pending.shift
    next if identity.nil? || identities[identity]

    identities[identity] = true
    direct = record_path(identity)
    linked = [direct, *@identity_paths.fetch(identity, [])]
    linked.each do |path|
      next unless File.file?(path)
      next if paths[path]

      paths[path] = true
      pending.concat(@path_identities.fetch(path, []))
    end
  end
  paths.keys.sort
end

#prepare_aliases(formula_name, groups) ⇒ Array<String>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
 
# File 'dev-cmd/advisory-match.rb', line 285

def prepare_aliases(formula_name, groups)
  ensure_alias_index
  errors = T.let([], T::Array[String])
  targets = T.let({}, T::Hash[String, T::Array[String]])
  protected = T.let({}, T::Hash[String, T::Boolean])
  owners = T.let({}, T::Hash[String, String])
  identity_owners = T.let({}, T::Hash[String, String])
  generated_paths = T.let([], T::Array[String])

  groups.each do |canonical_id, record_ids|
    record_ids.each do |record_id|
      if (owner = identity_owners[record_id]) && owner != canonical_id
        errors << "#{canonical_id}: identity also belongs to #{owner}; leaving both unchanged"
      else
        identity_owners[record_id] = canonical_id
      end
    end
    paths = matching_alias_paths(record_ids)
    paths.each do |path|
      if (owner = owners[path]) && owner != canonical_id
        errors << "#{canonical_id}: alias family also belongs to #{owner}; leaving both unchanged"
      else
        owners[path] = canonical_id
      end
    end

    writable = T.let([], T::Array[String])
    paths.each do |path|
      existing = alias_record(path)
      if existing == :malformed
        errors << "#{canonical_id}: malformed alias #{path}; leaving family unchanged"
        next
      end
      unless existing.is_a?(Hash)
        errors << "#{canonical_id}: invalid alias #{path}; leaving family unchanged"
        next
      end
      if existing["id"] != File.basename(path, ".json")
        errors << "#{canonical_id}: #{path} has a mismatched id; leaving family unchanged"
        next
      end

      database_specific = existing["database_specific"]
      source = database_specific["source"] if database_specific.is_a?(Hash)
      if source == "generated"
        generated_paths << path
        next
      end
      if source != "matched"
        errors << "#{canonical_id}: #{path} has unsupported source " \
                  "#{source.inspect}; leaving family unchanged"
        next
      end

      affected = existing["affected"]
      names = affected_formula_names(existing)
      if !affected.is_a?(Array) || !affected.one? || names != [formula_name]
        errors << "#{canonical_id}: #{path} has unsupported affected entries for " \
                  "#{formula_name}; leaving family unchanged"
        next
      end
      writable << path
    end

    canonical_path = record_path(canonical_id)
    writable << canonical_path unless File.file?(canonical_path)
    writable.uniq!
    targets[canonical_id] = writable
    protected[canonical_id] = writable.empty?
  end
  return errors.uniq if errors.any?

  @alias_targets.merge!(targets)
  @protected_aliases.merge!(protected)
  @skipped_generated += generated_paths.uniq.length
  []
end

#record_history_unavailable(formula_name) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Parameters:



475
476
477
478
 
# File 'dev-cmd/advisory-match.rb', line 475

def record_history_unavailable(formula_name)
  count = @history_unavailable_by_formula.fetch(formula_name, 0)
  @history_unavailable_by_formula[formula_name] = count + 1
end

#record_history_walk ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.



469
470
471
472
 
# File 'dev-cmd/advisory-match.rb', line 469

def record_history_walk
  @history_walks += 1
  puts "  #{@history_walks} history walks" if @verbose && (@history_walks % 100).zero?
end

#record_path(record_id) ⇒ String

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



481
482
483
 
# File 'dev-cmd/advisory-match.rb', line 481

def record_path(record_id)
  File.join(@dir, "#{record_id}.json")
end

#reintroduction_boundary_valid?(record_id, boundary) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
 
# File 'dev-cmd/advisory-match.rb', line 449

def reintroduction_boundary_valid?(record_id, boundary)
  alias_target_paths(record_id).all? do |path|
    next true unless File.file?(path)

    existing = alias_record(path)
    next false unless existing.is_a?(Hash)

    affected = existing["affected"]
    next false unless affected.is_a?(Array)

    affected.all? do |entry|
      next false unless entry.is_a?(Hash)

      ranges = homebrew_ranges(entry["ranges"])
      Homebrew::Vulns::OsvExport.reintroduction_follows?(ranges, boundary)
    end
  end
end

#reviewed_range_state(record_id) ⇒ Symbol?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



434
435
436
437
438
439
440
441
442
443
444
445
446
 
# File 'dev-cmd/advisory-match.rb', line 434

def reviewed_range_state(record_id)
  paths = alias_target_paths(record_id).select { |path| File.file?(path) }
  states_by_path = paths.map { |path| reviewed_states(path) }
  return if states_by_path.any?(&:nil?)

  states = states_by_path.flatten
  return if states.empty?

  unique = states.uniq
  return :mixed if unique.include?(:open) && unique.include?(:terminal)

  unique.fetch(0)
end

#reviewed_states(path) ⇒ Array<Symbol>?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
 
# File 'dev-cmd/advisory-match.rb', line 556

def reviewed_states(path)
  existing = alias_record(path)
  return unless existing.is_a?(Hash)

  affected = existing["affected"]
  return unless affected.is_a?(Array)
  return if affected.empty?

  states = affected.filter_map do |entry|
    next unless entry.is_a?(Hash)

    ranges = homebrew_ranges(entry["ranges"])
    if Homebrew::Vulns::OsvExport.ranges_terminal?(ranges)
      :terminal
    elsif Homebrew::Vulns::OsvExport.ranges_open?(ranges)
      :open
    end
  end
  return if states.length != affected.length

  states
end