mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-25 23:11:31 +00:00
a1971afa78
* ci(linter): add renovate/require-regex-util rule Adds a custom oxlint rule that flags raw RegExp usage in lib/ production code: any `new RegExp(...)` call and any regex literal that is not the direct first argument of `regEx(...)`. The regEx() helper from lib/util/regex.ts uses the RE2 engine for ReDoS-safe matching and caches compiled patterns. lib/util/regex.ts itself is exempt. The rule is disabled for **/*.spec.ts, test/**, and tools/** via config overrides, because vitest APIs such as expect.stringMatching need bare RegExp instances (a past commit reverted regEx() there). Severity is set to "warn" instead of "error": the repo currently has 197 pre-existing violations (above the agreed mechanical-fix threshold of 80), and a number of them are deliberately RE2-incompatible patterns (lookahead/lookbehind/named backreferences, see TODO #12872/#12875 markers in e.g. lib/modules/versioning/rez/ pattern.ts and lib/modules/manager/dockerfile/extract.ts) that need per-site judgment before they can be wrapped in regEx() or suppressed with a justified disable comment. No violation fixes are included in this commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(linter): enforce renovate/require-regex-util at error Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: use regEx() for regex literals and RegExp construction in lib Burn down all renovate/require-regex-util violations (197): - wrap RE2-compatible regex literals and RegExp constructions in regEx() - rewrite lookaround patterns where behavior is provably preserved: goproxy separator split, sbt-package link extraction, leiningen comment stripping and keyword search, npm GitHub owner validation (unit-count bound replaced by an explicit length check) - keep native RegExp with disable comments where RE2 cannot be used: moo / good-enough-parser lexer patterns (moo rejects RE2 instances), MigrationsService propertyName (matched via isRegExp, which RE2 instances fail), rez named backreferences and lookaheads, GitHub markdown link negative lookbehind, emoji astral-plane matching - drop stale TODO #12875 comments for patterns current re2 handles Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: reduce require-regex-util disable comments Rewrite the github massage-markdown-links URL regex to capture an optional `api.` prefix in a named group (skipped in code) instead of relying on a negative lookbehind, so both the base and global variants can use regEx()/RE2 and their two disable comments are removed. Add spec cases for api-prefixed URLs that match the URL shape. Consolidate the four related line disables in rez/pattern.ts (bound and range patterns emulating Python conditional patterns via named backreferences and lookaheads, which RE2 cannot express) into a single block disable/enable pair, matching the treatment of the lexer files. Disable comment count drops from 13 to 8. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(datasource/sbt-package): use named capture group in link regex Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(manager/cake): restore original multiLineComment regex spelling The [^] -> [\\s\\S] rewrite was only needed for an RE2 wrap that was later reverted; keep the diff minimal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(datasource/go): skip empty GOPROXY segments The switch from a lookahead split to a capture-group split (needed because RE2 has no lookahead support) changed how empty GOPROXY segments parse: `a|,b` yielded `{ url: ',', fallback: '|' }` before and `{ url: '', fallback: ',' }` after. The comma fallback only continues on 404/410, so a failing proxy ahead of an empty segment silently stopped the lookup instead of falling through to the remaining proxies. Empty segments carry no url to query, so drop them. * refactor(datasource/go): use isTruthy for empty segment filter * fix(datasource/go): filter empty segments before mapping Filtering after the map broke the contextual typing from the GoproxyItem[] annotation, widening fallback to string. * refactor(platform/github): use regEx() for merge queue query stripping --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
125 lines
3.2 KiB
TypeScript
125 lines
3.2 KiB
TypeScript
import { isString, isTruthy } from '@sindresorhus/is';
|
|
import moo from 'moo';
|
|
import * as memCache from '../../../util/cache/memory/index.ts';
|
|
import { getEnv } from '../../../util/env.ts';
|
|
import { regEx } from '../../../util/regex.ts';
|
|
import type { GoproxyItem } from './types.ts';
|
|
|
|
/**
|
|
* Parse `GOPROXY` to the sequence of url + fallback strategy tags.
|
|
*
|
|
* @example
|
|
* parseGoproxy('foo.example.com|bar.example.com,baz.example.com')
|
|
* // [
|
|
* // { url: 'foo.example.com', fallback: '|' },
|
|
* // { url: 'bar.example.com', fallback: ',' },
|
|
* // { url: 'baz.example.com', fallback: '|' },
|
|
* // ]
|
|
*
|
|
* @see https://golang.org/ref/mod#goproxy-protocol
|
|
*/
|
|
export function parseGoproxy(
|
|
input: string | undefined = getEnv().GOPROXY,
|
|
): GoproxyItem[] {
|
|
if (!isString(input)) {
|
|
return [];
|
|
}
|
|
|
|
const cacheKey = `goproxy::${input}`;
|
|
const cachedResult = memCache.get<GoproxyItem[]>(cacheKey);
|
|
if (cachedResult) {
|
|
return cachedResult;
|
|
}
|
|
|
|
const result: GoproxyItem[] = input
|
|
.split(regEx(/([^,|]*(?:,|\|))/))
|
|
.filter(isTruthy)
|
|
.map((s) => s.split(regEx(/(,|\|)/)))
|
|
// Empty segments (`a||b`, `,a`) carry no url to query, and keeping them
|
|
// would apply their separator as the fallback strategy for a bogus request
|
|
.filter(([url]) => isTruthy(url))
|
|
.map(([url, separator]) => ({
|
|
url,
|
|
fallback: separator === ',' ? ',' : '|',
|
|
}));
|
|
|
|
memCache.set(cacheKey, result);
|
|
return result;
|
|
}
|
|
|
|
// https://golang.org/pkg/path/#Match
|
|
/* oxlint-disable renovate/require-regex-util -- moo lexer patterns must be native RegExp: moo recompiles their source with the native engine and rejects RE2 instances (TODO #12870) */
|
|
const noproxyLexer = moo.states({
|
|
main: {
|
|
separator: {
|
|
match: /\s*?,\s*?/, // TODO #12870
|
|
value: (_: string) => '|',
|
|
},
|
|
asterisk: {
|
|
match: '*',
|
|
value: (_: string) => '[^/]*',
|
|
},
|
|
qmark: {
|
|
match: '?',
|
|
value: (_: string) => '[^/]',
|
|
},
|
|
characterRangeOpen: {
|
|
match: '[',
|
|
push: 'characterRange',
|
|
value: (_: string) => '[',
|
|
},
|
|
trailingSlash: {
|
|
match: /\/$/,
|
|
value: (_: string) => '',
|
|
},
|
|
char: {
|
|
match: /[^*?\\[\n]/,
|
|
value: (s: string) => s.replace(regEx('\\.', 'g'), '\\.'),
|
|
},
|
|
escapedChar: {
|
|
match: /\\./, // TODO #12870
|
|
value: (s: string) => s.slice(1),
|
|
},
|
|
},
|
|
characterRange: {
|
|
char: /[^\\\]\n]/, // TODO #12870
|
|
escapedChar: {
|
|
match: /\\./, // TODO #12870
|
|
value: (s: string) => s.slice(1),
|
|
},
|
|
characterRangeEnd: {
|
|
match: ']',
|
|
pop: 1,
|
|
},
|
|
},
|
|
});
|
|
/* oxlint-enable renovate/require-regex-util */
|
|
|
|
export function parseNoproxy(
|
|
input: unknown = (() => {
|
|
const env = getEnv();
|
|
return env.GONOPROXY ?? env.GOPRIVATE;
|
|
})(),
|
|
): RegExp | null {
|
|
if (!isString(input)) {
|
|
return null;
|
|
}
|
|
|
|
const cacheKey = `noproxy::${input}`;
|
|
const cachedResult = memCache.get<RegExp | null>(cacheKey);
|
|
if (cachedResult !== undefined) {
|
|
return cachedResult;
|
|
}
|
|
|
|
const noproxyPattern = [...noproxyLexer.reset(input)]
|
|
.map(({ value }) => value)
|
|
.join('');
|
|
|
|
const result = noproxyPattern
|
|
? regEx(`^(?:${noproxyPattern})(?:/.*)?$`)
|
|
: null;
|
|
|
|
memCache.set(cacheKey, result);
|
|
return result;
|
|
}
|