mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-27 07:50:47 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
85 lines
3.1 KiB
TypeScript
85 lines
3.1 KiB
TypeScript
import type { RootContent } from 'mdast';
|
|
import { remark } from 'remark';
|
|
import type { Plugin, Transformer } from 'unified';
|
|
import { logger } from '../../../logger/index.ts';
|
|
import { coerceNumber } from '../../../util/number.ts';
|
|
import { regEx } from '../../../util/regex.ts';
|
|
|
|
interface UrlMatch {
|
|
start: number;
|
|
end: number;
|
|
replaceTo: string;
|
|
}
|
|
|
|
//according to https://github.com/dead-claudia/github-limits
|
|
// An optional `api.` prefix is captured (instead of a negative lookbehind,
|
|
// which RE2 does not support) so that api.github.com matches can be skipped.
|
|
const urlRegexSource =
|
|
'(?:https?:)?(?:\\/\\/)?(?:www\\.)?(?<apiPrefix>api\\.)?(?:to)?github\\.com\\/[-a-z0-9]+\\/[-_a-z0-9.]+\\/(?:discussions|issues|pull)\\/[0-9]+(?:#[-_a-z0-9]+)?';
|
|
const urlRegex = regEx(urlRegexSource, 'i');
|
|
|
|
function massageLink(input: string): string {
|
|
return input.replace(
|
|
regEx(/(?:to|redirect\.|www\.)?github\.com/i),
|
|
'redirect.github.com',
|
|
);
|
|
}
|
|
|
|
function collectLinkPosition(input: string, matches: UrlMatch[]): Plugin {
|
|
function transformer(tree: RootContent): void {
|
|
const startOffset = coerceNumber(tree.position?.start.offset);
|
|
const endOffset = coerceNumber(tree.position?.end.offset);
|
|
|
|
// v8 ignore else -- TODO: add test #40625
|
|
if (tree.type === 'link') {
|
|
const substr = input.slice(startOffset, endOffset);
|
|
const url: string = tree.url;
|
|
const offset: number = startOffset + substr.lastIndexOf(url);
|
|
const urlMatch = urlRegex.exec(url);
|
|
if (urlMatch && !urlMatch.groups?.apiPrefix) {
|
|
matches.push({
|
|
start: offset,
|
|
end: offset + url.length,
|
|
replaceTo: massageLink(url),
|
|
});
|
|
}
|
|
} else if (tree.type === 'text') {
|
|
const globalUrlReg = regEx(urlRegexSource, 'gi');
|
|
const urlMatches = [...tree.value.matchAll(globalUrlReg)];
|
|
for (const match of urlMatches) {
|
|
if (match.groups?.apiPrefix) {
|
|
continue;
|
|
}
|
|
const [url] = match;
|
|
const start = startOffset + coerceNumber(match.index);
|
|
const end = start + url.length;
|
|
const newUrl = massageLink(url);
|
|
matches.push({ start, end, replaceTo: `[${url}](${newUrl})` });
|
|
}
|
|
} else if ('children' in tree) {
|
|
tree.children.forEach((child: RootContent) => {
|
|
transformer(child);
|
|
});
|
|
}
|
|
}
|
|
|
|
return () => transformer as Transformer;
|
|
}
|
|
|
|
export function massageMarkdownLinks(content: string): string {
|
|
try {
|
|
const rightSpaces = content.replace(content.trimEnd(), '');
|
|
const matches: UrlMatch[] = [];
|
|
remark().use(collectLinkPosition(content, matches)).processSync(content);
|
|
const result = matches.reduceRight((acc, { start, end, replaceTo }) => {
|
|
const leftPart = acc.slice(0, start);
|
|
const rightPart = acc.slice(end);
|
|
return leftPart + replaceTo + rightPart;
|
|
}, content);
|
|
return result.trimEnd() + rightSpaces;
|
|
} catch (err) /* v8 ignore next -- defensive: remark parsing does not throw on any string input, failure not simulable */ {
|
|
logger.warn({ err }, `Unable to massage markdown text`);
|
|
return content;
|
|
}
|
|
}
|