diff --git a/robot-repo-automaton/README.adoc b/robot-repo-automaton/README.adoc index 878cb95f..c55d6442 100644 --- a/robot-repo-automaton/README.adoc +++ b/robot-repo-automaton/README.adoc @@ -316,6 +316,10 @@ The error catalog uses S-expression format (Guile Scheme compatible): | Apply a line-level transformation. Requires a `modification` field with spec such as `replace-line:N:content`, `insert-before:N:content`, `replace-pattern:regex:replacement`, `prepend:content`, or `append:content`. + For `replace-pattern`, the first unescaped colon separates the regex and + replacement. Write a colon within either field as `\:` (for example, + `replace-pattern:https?\://old:https\://new`). Regex replacement expansion is + preserved, so capture references such as `$1` and `$name` are supported. | `create` | Create the target file from a template or `fallback` content. Supports diff --git a/robot-repo-automaton/src/fixer.rs b/robot-repo-automaton/src/fixer.rs index 91a788ad..b329436c 100644 --- a/robot-repo-automaton/src/fixer.rs +++ b/robot-repo-automaton/src/fixer.rs @@ -3,6 +3,7 @@ use regex::Regex; use std::fs; +use std::io::ErrorKind; use std::path::{Component, Path, PathBuf}; use crate::catalog::{Fix, FixAction}; @@ -30,11 +31,20 @@ impl Fixer { Self { repo_path, dry_run } } - /// Resolve a fix target relative to the repository root, rejecting any - /// path that would escape the repository. The target need not exist - /// (e.g. for `Create`), so this is pure path arithmetic. + /// Resolve a fix target relative to the canonical repository root. + /// + /// The target need not exist (for example, for `Create`), so the nearest + /// existing ancestor is canonicalized and any missing suffix is appended. + /// This rejects lexical traversal, symlink escapes, and symlink targets + /// (including dangling symlinks) before a mutation can occur. fn resolve_target(&self, target: &str) -> Result { - let joined = self.repo_path.join(target); + let canonical_root = self.repo_path.canonicalize().map_err(|e| { + Error::Fix(format!( + "Failed to canonicalize repository '{}': {e}", + self.repo_path.display() + )) + })?; + let joined = canonical_root.join(target); let mut normalized = PathBuf::new(); for component in joined.components() { @@ -51,13 +61,73 @@ impl Fixer { } } - if !normalized.starts_with(&self.repo_path) { + if !normalized.starts_with(&canonical_root) { return Err(Error::Fix(format!( "Fix target '{target}' resolves outside the repository" ))); } - Ok(normalized) + match fs::symlink_metadata(&normalized) { + Ok(metadata) if metadata.file_type().is_symlink() => { + return Err(Error::Fix(format!( + "Fix target '{target}' is a symlink and cannot be mutated" + ))); + } + Ok(_) => {} + Err(e) if e.kind() == ErrorKind::NotFound => {} + Err(e) => { + return Err(Error::Fix(format!( + "Failed to inspect fix target '{target}': {e}" + ))); + } + } + + let mut ancestor = normalized.clone(); + let mut missing = Vec::new(); + let canonical_ancestor = loop { + match fs::symlink_metadata(&ancestor) { + Ok(_) => { + break ancestor.canonicalize().map_err(|e| { + Error::Fix(format!( + "Failed to canonicalize fix target ancestor '{}': {e}", + ancestor.display() + )) + })?; + } + Err(e) if e.kind() == ErrorKind::NotFound => { + let component = ancestor.file_name().ok_or_else(|| { + Error::Fix(format!( + "Fix target '{target}' resolves outside the repository" + )) + })?; + missing.push(component.to_os_string()); + if !ancestor.pop() { + return Err(Error::Fix(format!( + "Fix target '{target}' resolves outside the repository" + ))); + } + } + Err(e) => { + return Err(Error::Fix(format!( + "Failed to inspect fix target ancestor '{}': {e}", + ancestor.display() + ))); + } + } + }; + + if !canonical_ancestor.starts_with(&canonical_root) { + return Err(Error::Fix(format!( + "Fix target '{target}' resolves outside the repository" + ))); + } + + let mut resolved = canonical_ancestor; + for component in missing.iter().rev() { + resolved.push(component); + } + + Ok(resolved) } /// Apply a single fix, returning the outcome. A rejected or failed fix @@ -80,17 +150,34 @@ impl Fixer { FixAction::Delete => self.apply_delete(&target), FixAction::Modify => self.apply_modify(&target, fix), FixAction::Create => self.apply_create(&target, fix), - FixAction::Disable => FixResult { - success: true, - files_modified: Vec::new(), - action_taken: "Disable: no-op, manual review required".to_string(), - error: None, - }, + FixAction::Disable => { + let disabled = target.with_extension("yml.disabled"); + match self.resolve_target_path(&disabled) { + Ok(disabled) => self.apply_disable(&target, &disabled), + Err(e) => FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Disable: rejected".to_string(), + error: Some(e.to_string()), + }, + } + } }; Ok(result) } + fn resolve_target_path(&self, target: &Path) -> Result { + let canonical_root = self.repo_path.canonicalize()?; + let relative = target.strip_prefix(&canonical_root).map_err(|_| { + Error::Fix(format!( + "Fix target '{}' resolves outside the repository", + target.display() + )) + })?; + self.resolve_target(&relative.to_string_lossy()) + } + fn apply_delete(&self, target: &Path) -> FixResult { if !target.exists() { return FixResult { @@ -127,7 +214,7 @@ impl Fixer { } fn apply_create(&self, target: &Path, fix: &Fix) -> FixResult { - if target.exists() { + if fs::symlink_metadata(target).is_ok() { return FixResult { success: true, files_modified: Vec::new(), @@ -222,20 +309,20 @@ impl Fixer { } }; - if self.dry_run { + if new_text == original_text { return FixResult { success: true, files_modified: Vec::new(), - action_taken: format!("DRY RUN: would modify {}", target.display()), + action_taken: format!("Modify: {} already up to date", target.display()), error: None, }; } - if new_text == original_text { + if self.dry_run { return FixResult { success: true, files_modified: Vec::new(), - action_taken: format!("Modify: {} already up to date", target.display()), + action_taken: format!("DRY RUN: would modify {}", target.display()), error: None, }; } @@ -256,6 +343,70 @@ impl Fixer { } } + fn apply_disable(&self, target: &Path, disabled: &Path) -> FixResult { + if !target.exists() { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!("Disable: {} already absent", target.display()), + error: None, + }; + } + + if fs::symlink_metadata(disabled).is_ok() { + return FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Disable: failed".to_string(), + error: Some(format!( + "Refusing to overwrite existing disabled target {}", + disabled.display() + )), + }; + } + + if self.dry_run { + return FixResult { + success: true, + files_modified: Vec::new(), + action_taken: format!( + "DRY RUN: would rename {} to {}", + target.display(), + disabled.display() + ), + error: None, + }; + } + + // `hard_link` publishes the destination without overwriting a file + // that appears concurrently. Removing the source completes the rename. + match fs::hard_link(target, disabled) { + Ok(()) => match fs::remove_file(target) { + Ok(()) => FixResult { + success: true, + files_modified: vec![target.to_path_buf(), disabled.to_path_buf()], + action_taken: format!("Renamed {} to {}", target.display(), disabled.display()), + error: None, + }, + Err(e) => { + let _ = fs::remove_file(disabled); + FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Disable: failed".to_string(), + error: Some(e.to_string()), + } + } + }, + Err(e) => FixResult { + success: false, + files_modified: Vec::new(), + action_taken: "Disable: failed".to_string(), + error: Some(e.to_string()), + }, + } + } + /// Apply a `replace-line:`, `replace-pattern:`, `insert-before:` or /// `insert-after:` modification instruction to `content`. fn apply_modification( @@ -263,14 +414,26 @@ impl Fixer { modification: &str, ) -> std::result::Result { if let Some(rest) = modification.strip_prefix("replace-pattern:") { - let (pattern, replacement) = rest - .split_once(':') + let separator = rest + .char_indices() + .find_map(|(index, character)| { + (character == ':' && !Self::is_escaped(rest, index)).then_some(index) + }) .ok_or_else(|| "Invalid replace-pattern instruction".to_string())?; - let re = Regex::new(pattern).map_err(|e| format!("Invalid regex: {e}"))?; - return Ok(re.replace_all(content, replacement).into_owned()); + let pattern = Self::unescape_colons(&rest[..separator]); + let replacement = Self::unescape_colons(&rest[separator + 1..]); + if pattern.is_empty() { + return Err("Invalid replace-pattern instruction: empty regex".to_string()); + } + let re = Regex::new(&pattern).map_err(|e| format!("Invalid regex: {e}"))?; + return Ok(re.replace_all(content, replacement.as_str()).into_owned()); } - let mut lines: Vec = content.lines().map(str::to_string).collect(); + let line_ending = Self::dominant_line_ending(content); + let mut lines: Vec = content + .split_terminator('\n') + .map(|line| line.strip_suffix('\r').unwrap_or(line).to_string()) + .collect(); let trailing_newline = content.ends_with('\n'); if let Some(rest) = modification.strip_prefix("replace-line:") { @@ -319,19 +482,67 @@ impl Fixer { return Err(format!("Unknown modification instruction: {modification}")); } - let mut result = lines.join("\n"); + let mut result = lines.join(line_ending); if trailing_newline { - result.push('\n'); + result.push_str(line_ending); } Ok(result) } + fn is_escaped(value: &str, index: usize) -> bool { + value[..index] + .bytes() + .rev() + .take_while(|byte| *byte == b'\\') + .count() + % 2 + == 1 + } + + fn unescape_colons(value: &str) -> String { + let mut output = String::with_capacity(value.len()); + let mut characters = value.chars().peekable(); + while let Some(character) = characters.next() { + if character == '\\' && characters.peek() == Some(&':') { + characters.next(); + output.push(':'); + } else { + output.push(character); + } + } + output + } + + fn dominant_line_ending(content: &str) -> &'static str { + let bytes = content.as_bytes(); + let mut crlf = 0; + let mut lf = 0; + for (index, byte) in bytes.iter().enumerate() { + if *byte == b'\n' { + if index > 0 && bytes[index - 1] == b'\r' { + crlf += 1; + } else { + lf += 1; + } + } + } + if crlf > 0 && crlf >= lf { + "\r\n" + } else { + "\n" + } + } + /// Apply a batch of auto-approved fixes and commit the results locally. pub fn apply_and_commit( &self, _issues: &[DetectedIssue], auto_fixes: &[(DetectedIssue, Fix)], ) -> Result> { + if !self.dry_run && !auto_fixes.is_empty() { + self.ensure_clean_index()?; + } + let mut results = Vec::with_capacity(auto_fixes.len()); let mut modified: Vec = Vec::new(); let mut messages: Vec = Vec::new(); @@ -354,11 +565,15 @@ impl Fixer { /// Stage and commit the given files in the local repository. fn commit_changes(&self, files: &[PathBuf], messages: &[String]) -> Result<()> { + // Re-check immediately before touching the index in case another + // process staged work while fixes were being applied. + self.ensure_clean_index()?; let repo = git2::Repository::open(&self.repo_path)?; let mut index = repo.index()?; + let canonical_root = self.repo_path.canonicalize()?; for file in files { - let relative = file.strip_prefix(&self.repo_path).unwrap_or(file); + let relative = file.strip_prefix(&canonical_root).unwrap_or(file); if file.exists() { index.add_path(relative)?; } else { @@ -391,4 +606,29 @@ impl Fixer { Ok(()) } + + fn ensure_clean_index(&self) -> Result<()> { + let repo = git2::Repository::open(&self.repo_path)?; + let index = repo.index()?; + let head_tree = match repo.head() { + Ok(head) => Some(head.peel_to_tree()?), + Err(e) + if matches!( + e.code(), + git2::ErrorCode::UnbornBranch | git2::ErrorCode::NotFound + ) => + { + None + } + Err(e) => return Err(e.into()), + }; + let diff = repo.diff_tree_to_index(head_tree.as_ref(), Some(&index), None)?; + if diff.deltas().len() != 0 { + return Err(Error::Fix( + "Refusing to apply and commit fixes while the repository index contains staged changes" + .to_string(), + )); + } + Ok(()) + } } diff --git a/robot-repo-automaton/tests/fixer_tests.rs b/robot-repo-automaton/tests/fixer_tests.rs index 581801a7..f3663ed2 100644 --- a/robot-repo-automaton/tests/fixer_tests.rs +++ b/robot-repo-automaton/tests/fixer_tests.rs @@ -20,6 +20,16 @@ fn make_issue(id: &str) -> DetectedIssue { } } +fn make_fix(action: FixAction, target: &str) -> Fix { + Fix { + action, + target: target.to_string(), + reason: None, + modification: None, + fallback: None, + } +} + // ========================================================================= // DELETE FIX TESTS // ========================================================================= @@ -361,6 +371,134 @@ fn test_dry_run_does_not_delete() { assert!(file_path.exists()); // File still exists } +#[test] +fn test_dry_run_unchanged_modify_reports_no_op() { + let temp = TempDir::new().unwrap(); + let file_path = temp.path().join("config.txt"); + std::fs::write(&file_path, "already=current\n").unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), true); + let issue = make_issue("DRY-004"); + let mut fix = make_fix(FixAction::Modify, "config.txt"); + fix.modification = Some("replace-pattern:missing:replacement".to_string()); + + let result = fixer.apply(&issue, &fix).unwrap(); + assert!(result.success); + assert!(result.files_modified.is_empty()); + assert!(result.action_taken.contains("already up to date")); + assert!(!result.action_taken.contains("would modify")); +} + +// ========================================================================= +// DISABLE FIX TESTS +// ========================================================================= + +#[test] +fn test_disable_fix_renames_workflow() { + let temp = TempDir::new().unwrap(); + let source = temp.path().join("workflow.yml"); + let disabled = temp.path().join("workflow.yml.disabled"); + std::fs::write(&source, "name: active\n").unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let result = fixer + .apply( + &make_issue("DIS-001"), + &make_fix(FixAction::Disable, "workflow.yml"), + ) + .unwrap(); + + assert!(result.success); + assert!(!source.exists()); + assert_eq!(std::fs::read_to_string(&disabled).unwrap(), "name: active\n"); + assert_eq!(result.files_modified, vec![source, disabled]); +} + +#[test] +fn test_disable_fix_does_not_overwrite_existing_destination() { + let temp = TempDir::new().unwrap(); + let source = temp.path().join("workflow.yml"); + let disabled = temp.path().join("workflow.yml.disabled"); + std::fs::write(&source, "active\n").unwrap(); + std::fs::write(&disabled, "preserve me\n").unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let result = fixer + .apply( + &make_issue("DIS-002"), + &make_fix(FixAction::Disable, "workflow.yml"), + ) + .unwrap(); + + assert!(!result.success); + assert_eq!(std::fs::read_to_string(source).unwrap(), "active\n"); + assert_eq!(std::fs::read_to_string(disabled).unwrap(), "preserve me\n"); +} + +// ========================================================================= +// MODIFICATION FORMAT AND LINE ENDING TESTS +// ========================================================================= + +#[test] +fn test_replace_pattern_supports_colons_and_capture_expansion() { + let temp = TempDir::new().unwrap(); + let file_path = temp.path().join("urls.txt"); + std::fs::write(&file_path, "http://old:8080/path\n").unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(FixAction::Modify, "urls.txt"); + fix.modification = + Some(r"replace-pattern:(http\://old\:)(\d+):prefix-$1\:$2".to_string()); + let result = fixer.apply(&make_issue("MOD-006"), &fix).unwrap(); + + assert!(result.success); + assert_eq!( + std::fs::read_to_string(file_path).unwrap(), + "prefix-http://old::8080/path\n" + ); +} + +#[test] +fn test_replace_pattern_preserves_named_capture_expansion() { + let temp = TempDir::new().unwrap(); + let file_path = temp.path().join("value.txt"); + std::fs::write(&file_path, "item=42\n").unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(FixAction::Modify, "value.txt"); + fix.modification = + Some(r"replace-pattern:item=(?P\d+):value=$number".to_string()); + let result = fixer.apply(&make_issue("MOD-007"), &fix).unwrap(); + + assert!(result.success); + assert_eq!(std::fs::read_to_string(file_path).unwrap(), "value=42\n"); +} + +#[test] +fn test_line_modifications_preserve_crlf() { + let cases = [ + ("replace-line:1:ONE", "ONE\r\ntwo\r\n"), + ("insert-before:2:middle", "one\r\nmiddle\r\ntwo\r\n"), + ("insert-after:1:middle", "one\r\nmiddle\r\ntwo\r\n"), + ]; + + for (index, (modification, expected)) in cases.into_iter().enumerate() { + let temp = TempDir::new().unwrap(); + let file_path = temp.path().join("crlf.txt"); + std::fs::write(&file_path, b"one\r\ntwo\r\n").unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(FixAction::Modify, "crlf.txt"); + fix.modification = Some(modification.to_string()); + let result = fixer + .apply(&make_issue(&format!("CRLF-{index}")), &fix) + .unwrap(); + + assert!(result.success); + assert_eq!(std::fs::read(&file_path).unwrap(), expected.as_bytes()); + } +} + // ========================================================================= // IDEMPOTENCY TESTS // ========================================================================= @@ -577,3 +715,189 @@ fn test_path_within_repo_is_not_rejected() { assert!(result.success, "Legitimate in-repo path was incorrectly rejected"); assert!(!file_path.exists()); } + +#[cfg(unix)] +#[test] +fn test_symlink_targets_are_rejected_for_every_action() { + use std::os::unix::fs::symlink; + + for (index, action) in [ + FixAction::Delete, + FixAction::Modify, + FixAction::Create, + FixAction::Disable, + ] + .into_iter() + .enumerate() + { + let temp = TempDir::new().unwrap(); + let outer = TempDir::new().unwrap(); + let victim = outer.path().join("victim.txt"); + std::fs::write(&victim, "untouched\n").unwrap(); + symlink(&victim, temp.path().join("target.yml")).unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(action, "target.yml"); + fix.modification = Some("replace-line:1:changed".to_string()); + fix.fallback = Some("created".to_string()); + let result = fixer + .apply(&make_issue(&format!("SYM-{index}")), &fix) + .unwrap(); + + assert!(!result.success); + assert!(result.error.as_deref().unwrap().contains("symlink")); + assert_eq!(std::fs::read_to_string(victim).unwrap(), "untouched\n"); + } +} + +#[cfg(unix)] +#[test] +fn test_dangling_symlink_targets_are_rejected_for_every_action() { + use std::os::unix::fs::symlink; + + for (index, action) in [ + FixAction::Delete, + FixAction::Modify, + FixAction::Create, + FixAction::Disable, + ] + .into_iter() + .enumerate() + { + let temp = TempDir::new().unwrap(); + symlink("missing", temp.path().join("target.yml")).unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(action, "target.yml"); + fix.modification = Some("replace-line:1:changed".to_string()); + fix.fallback = Some("created".to_string()); + let result = fixer + .apply(&make_issue(&format!("DANGLING-{index}")), &fix) + .unwrap(); + + assert!(!result.success); + assert!(result.error.as_deref().unwrap().contains("symlink")); + assert!(std::fs::symlink_metadata(temp.path().join("target.yml")).is_ok()); + } +} + +#[cfg(unix)] +#[test] +fn test_symlink_parent_escape_is_rejected() { + use std::os::unix::fs::symlink; + + let temp = TempDir::new().unwrap(); + let outer = TempDir::new().unwrap(); + symlink(outer.path(), temp.path().join("outside-link")).unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(FixAction::Create, "outside-link/injected.txt"); + fix.fallback = Some("injected".to_string()); + let result = fixer.apply(&make_issue("SYM-PARENT"), &fix).unwrap(); + + assert!(!result.success); + assert!( + result + .error + .as_deref() + .unwrap() + .contains("outside the repository") + ); + assert!(!outer.path().join("injected.txt").exists()); +} + +#[test] +fn test_relative_repository_path_accepts_in_repo_target() { + let current = std::env::current_dir().unwrap(); + let temp = tempfile::Builder::new() + .prefix("fixer-relative-") + .tempdir_in(¤t) + .unwrap(); + let relative_repo = temp.path().strip_prefix(¤t).unwrap().to_path_buf(); + let file_path = temp.path().join("safe.txt"); + std::fs::write(&file_path, "before\n").unwrap(); + + let fixer = Fixer::new(relative_repo, false); + let mut fix = make_fix(FixAction::Modify, "safe.txt"); + fix.modification = Some("replace-line:1:after".to_string()); + let result = fixer.apply(&make_issue("RELATIVE"), &fix).unwrap(); + + assert!(result.success); + assert_eq!(std::fs::read_to_string(file_path).unwrap(), "after\n"); +} + +#[test] +fn test_apply_and_commit_rejects_staged_changes_before_fixing() { + let temp = TempDir::new().unwrap(); + let repo = git2::Repository::init(temp.path()).unwrap(); + let staged_path = temp.path().join("staged.txt"); + std::fs::write(&staged_path, "base\n").unwrap(); + + { + let mut index = repo.index().unwrap(); + index.add_path(std::path::Path::new("staged.txt")).unwrap(); + index.write().unwrap(); + let tree_id = index.write_tree().unwrap(); + let tree = repo.find_tree(tree_id).unwrap(); + let signature = git2::Signature::now("test", "test@example.com").unwrap(); + repo.commit( + Some("HEAD"), + &signature, + &signature, + "initial", + &tree, + &[], + ) + .unwrap(); + } + + std::fs::write(&staged_path, "staged change\n").unwrap(); + let mut index = repo.index().unwrap(); + index.add_path(std::path::Path::new("staged.txt")).unwrap(); + index.write().unwrap(); + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(FixAction::Create, "new.txt"); + fix.fallback = Some("must not be created".to_string()); + let fixes = vec![(make_issue("INDEX-001"), fix)]; + let error = fixer.apply_and_commit(&[], &fixes).unwrap_err(); + + assert!(error.to_string().contains("staged changes")); + assert!(!temp.path().join("new.txt").exists()); + assert_eq!(std::fs::read_to_string(staged_path).unwrap(), "staged change\n"); +} + +#[test] +fn test_apply_and_commit_commits_when_index_is_clean() { + let temp = TempDir::new().unwrap(); + let repo = git2::Repository::init(temp.path()).unwrap(); + std::fs::write(temp.path().join("tracked.txt"), "base\n").unwrap(); + + { + let mut index = repo.index().unwrap(); + index.add_path(std::path::Path::new("tracked.txt")).unwrap(); + index.write().unwrap(); + let tree_id = index.write_tree().unwrap(); + let tree = repo.find_tree(tree_id).unwrap(); + let signature = git2::Signature::now("test", "test@example.com").unwrap(); + repo.commit( + Some("HEAD"), + &signature, + &signature, + "initial", + &tree, + &[], + ) + .unwrap(); + } + + let fixer = Fixer::new(temp.path().to_path_buf(), false); + let mut fix = make_fix(FixAction::Create, "new.txt"); + fix.fallback = Some("created\n".to_string()); + let fixes = vec![(make_issue("INDEX-002"), fix)]; + let results = fixer.apply_and_commit(&[], &fixes).unwrap(); + + assert!(results[0].success); + assert_eq!(std::fs::read_to_string(temp.path().join("new.txt")).unwrap(), "created\n"); + assert_eq!(repo.head().unwrap().peel_to_commit().unwrap().parent_count(), 1); +}