Class: Homebrew::Vulns::AdvisoryOverrides Private

Inherits:
Object
  • Object
show all
Defined in:
vulns/advisory_overrides.rb

Overview

This class is part of a private API. This class may only be used in the Homebrew/brew repository. Third parties should avoid using this class if possible, as it may be removed or changed without warning.

Reviewed, candidate-specific corrections for advisory matching. These are intentionally keyed by formula and upstream advisory identifier so a bad upstream range cannot silently change unrelated matches.

Defined Under Namespace

Classes: Entry, Error

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(data) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

  • data (T.untyped) 


31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
 
# File 'vulns/advisory_overrides.rb', line 31

def initialize(data)
  @skipped_formulae = T.let({}, T::Hash[String, T::Boolean])
  @advisories = T.let({}, T::Hash[String, T::Hash[String, Entry]])

  root = hash(data, "top level")
  root.each do |formula_name, raw_formula|
    raise Error, "Formula names must be strings" unless formula_name.is_a?(String)

    formula = hash(raw_formula, formula_name)
    reject_unknown_keys(formula, %w[skip advisories], formula_name)

    skip = formula.fetch("skip", false)
    raise Error, "#{formula_name}.skip must be true or false" unless [true, false].include?(skip)

    @skipped_formulae[formula_name] = true if skip
    next unless formula.key?("advisories")

    raw_advisories = hash(formula.fetch("advisories"), "#{formula_name}.advisories")
    parsed = T.let({}, T::Hash[String, Entry])
    raw_advisories.each do |identifier, raw_entry|
      raise Error, "#{formula_name} advisory identifiers must be strings" unless identifier.is_a?(String)

      entry = hash(raw_entry, "#{formula_name}.advisories.#{identifier}")
      reject_unknown_keys(entry, %w[range_state upstream_fixed_in],
                          "#{formula_name}.advisories.#{identifier}")

      state = T.let(nil, T.nilable(Symbol))
      if entry.key?("range_state")
        raw_state = entry.fetch("range_state")
        state = raw_state.to_sym if raw_state.is_a?(String)
        if state.nil? || VALID_STATES.exclude?(state)
          raise Error, "#{formula_name}.advisories.#{identifier}.range_state must be " \
                       "affected, fixed, or not_applicable"
        end
      end

      fixed_in_overridden = entry.key?("upstream_fixed_in")
      fixed_in = entry["upstream_fixed_in"]
      if !fixed_in.nil? && !fixed_in.is_a?(String)
        raise Error, "#{formula_name}.advisories.#{identifier}.upstream_fixed_in must be a string or null"
      end
      if state.nil? && !fixed_in_overridden
        raise Error, "#{formula_name}.advisories.#{identifier} must override at least one field"
      end

      parsed[identifier] = Entry.new(state:, fixed_in:, fixed_in_overridden:)
    end
    @advisories[formula_name] = parsed.freeze
  end
  @skipped_formulae.freeze
  @advisories.freeze
end

Class Method Details

.from_file(path) ⇒ AdvisoryOverrides

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



24
25
26
27
28
 
# File 'vulns/advisory_overrides.rb', line 24

def self.from_file(path)
  new(YAML.safe_load(path.read, permitted_classes: [], permitted_symbols: [], aliases: false))
rescue Psych::Exception => e
  raise Error, "Failed to parse advisory overrides at #{path}: #{e.message}"
end

Instance Method Details

#advisory_override(formula_name, identifiers) ⇒ Entry?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



90
91
92
93
94
95
96
97
98
99
 
# File 'vulns/advisory_overrides.rb', line 90

def advisory_override(formula_name, identifiers)
  formula = @advisories[formula_name]
  return unless formula

  identifiers.each do |identifier|
    override = formula[identifier]
    return override if override
  end
  nil
end

#skip_formula?(formula_name) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


85
86
87
 
# File 'vulns/advisory_overrides.rb', line 85

def skip_formula?(formula_name)
  @skipped_formulae.key?(formula_name)
end