From 54af47e286d0fb601e2e60aeb19002f6b7937574 Mon Sep 17 00:00:00 2001 From: nsfisis Date: Sun, 7 Jun 2026 11:20:23 +0900 Subject: feat(shirabe): resolve advisory instanceof TODOs via AnySecurityAdvisory Add an Ignored variant to the advisory enum (renamed to AnySecurityAdvisory) so the PHP three-class hierarchy PartialSecurityAdvisory -> SecurityAdvisory -> IgnoredSecurityAdvisory maps one-to-one onto enum variants. Replace the hard-coded auditor downcasts with as_security_advisory() (PHP `instanceof SecurityAdvisory`, true for both full and ignored) and as_ignored(), implementing severity/cve/source ignore filtering, the toIgnoredAdvisory conversion, and the table/plain row output faithfully. Co-Authored-By: Claude Opus 4.8 (1M context) --- .../src/repository/advisory_provider_interface.rs | 4 ++-- crates/shirabe/src/repository/composer_repository.rs | 19 ++++++++----------- crates/shirabe/src/repository/package_repository.rs | 11 +++++------ crates/shirabe/src/repository/repository_set.rs | 8 ++++---- 4 files changed, 19 insertions(+), 23 deletions(-) (limited to 'crates/shirabe/src/repository') diff --git a/crates/shirabe/src/repository/advisory_provider_interface.rs b/crates/shirabe/src/repository/advisory_provider_interface.rs index 6b94ca9..9d0c5ac 100644 --- a/crates/shirabe/src/repository/advisory_provider_interface.rs +++ b/crates/shirabe/src/repository/advisory_provider_interface.rs @@ -1,13 +1,13 @@ //! ref: composer/src/Composer/Repository/AdvisoryProviderInterface.php -use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory}; +use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory}; use indexmap::IndexMap; use shirabe_semver::constraint::AnyConstraint; #[derive(Debug)] pub struct SecurityAdvisoryResult { pub names_found: Vec, - pub advisories: IndexMap>, + pub advisories: IndexMap>, } pub trait AdvisoryProviderInterface { diff --git a/crates/shirabe/src/repository/composer_repository.rs b/crates/shirabe/src/repository/composer_repository.rs index 0d2fa2f..f9fa551 100644 --- a/crates/shirabe/src/repository/composer_repository.rs +++ b/crates/shirabe/src/repository/composer_repository.rs @@ -14,7 +14,7 @@ use shirabe_semver::constraint::AnyConstraint; use shirabe_semver::constraint::MatchAllConstraint; use shirabe_semver::constraint::SimpleConstraint; -use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory}; +use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory}; use crate::cache::Cache; use crate::config::Config; use crate::downloader::TransportException; @@ -896,7 +896,7 @@ impl ComposerRepository { }); } - let mut advisories: IndexMap> = IndexMap::new(); + let mut advisories: IndexMap> = IndexMap::new(); let mut names_found: IndexMap = IndexMap::new(); let api_url = self @@ -919,9 +919,9 @@ impl ComposerRepository { let create = |data: &IndexMap, name: &str, package_constraint_map: &IndexMap| - -> anyhow::Result> { + -> anyhow::Result> { let advisory = PartialSecurityAdvisory::create(name, data, &parser)?; - let is_full = matches!(advisory, PartialOrFullSecurityAdvisory::Full(_)); + let is_full = matches!(advisory, AnySecurityAdvisory::Full(_)); if !allow_partial_advisories && !is_full { let data_mixed = PhpMixed::Array( data.iter() @@ -940,10 +940,7 @@ impl ComposerRepository { } .into()); } - let affected_versions: &AnyConstraint = match &advisory { - PartialOrFullSecurityAdvisory::Partial(p) => &p.affected_versions, - PartialOrFullSecurityAdvisory::Full(p) => p.affected_versions(), - }; + let affected_versions: &AnyConstraint = advisory.affected_versions(); let constraint = package_constraint_map.get(name); if let Some(c) = constraint { if !affected_versions.matches(c) { @@ -995,7 +992,7 @@ impl ComposerRepository { names_found.insert(name.clone(), true); if !sec_advs_arr.is_empty() { - let mut entries: Vec = Vec::new(); + let mut entries: Vec = Vec::new(); for (_k, data_mixed) in sec_advs_arr.iter() { if let Some(data) = data_mixed.as_array() { let data_map: IndexMap = data @@ -1086,7 +1083,7 @@ impl ComposerRepository { None => continue, }; if !list.is_empty() { - let mut entries: Vec = Vec::new(); + let mut entries: Vec = Vec::new(); for data_mixed in list.iter() { if let Some(data) = data_mixed.as_array() { let data_map: IndexMap = data @@ -1106,7 +1103,7 @@ impl ComposerRepository { } } - let advisories_filtered: IndexMap> = advisories + let advisories_filtered: IndexMap> = advisories .into_iter() .filter(|(_, adv)| !adv.is_empty()) .collect(); diff --git a/crates/shirabe/src/repository/package_repository.rs b/crates/shirabe/src/repository/package_repository.rs index c264eaf..273cde0 100644 --- a/crates/shirabe/src/repository/package_repository.rs +++ b/crates/shirabe/src/repository/package_repository.rs @@ -1,7 +1,7 @@ //! ref: composer/src/Composer/Repository/PackageRepository.php use crate::advisory::SecurityAdvisory; -use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory}; +use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory}; use crate::package::loader::ArrayLoader; use crate::package::loader::ValidatingArrayLoader; use crate::package::version::VersionParser; @@ -93,7 +93,7 @@ impl AdvisoryProviderInterface for PackageRepository { ) -> anyhow::Result { let parser = VersionParser::new(); - let mut advisories: IndexMap> = IndexMap::new(); + let mut advisories: IndexMap> = IndexMap::new(); for (package_name, package_advisories) in &self.security_advisories { let Some(package_constraint) = package_constraint_map.get(package_name) else { continue; @@ -103,7 +103,7 @@ impl AdvisoryProviderInterface for PackageRepository { PhpMixed::List(list) => list, _ => continue, }; - let mut items: Vec = Vec::new(); + let mut items: Vec = Vec::new(); for data in list { let data_map: IndexMap = match data.as_ref() { PhpMixed::Array(m) => m.iter().map(|(k, v)| (k.clone(), *v.clone())).collect(), @@ -114,8 +114,7 @@ impl AdvisoryProviderInterface for PackageRepository { Ok(a) => a, Err(_) => continue, }; - if !allow_partial_advisories - && matches!(advisory, PartialOrFullSecurityAdvisory::Partial(_)) + if !allow_partial_advisories && matches!(advisory, AnySecurityAdvisory::Partial(_)) { return Err(anyhow::anyhow!(RuntimeException { message: format!( @@ -138,7 +137,7 @@ impl AdvisoryProviderInterface for PackageRepository { } let names_found: Vec = advisories.keys().cloned().collect(); - let advisories: IndexMap> = advisories + let advisories: IndexMap> = advisories .into_iter() .filter(|(_, adv)| !adv.is_empty()) .collect(); diff --git a/crates/shirabe/src/repository/repository_set.rs b/crates/shirabe/src/repository/repository_set.rs index 367a46a..62b25cb 100644 --- a/crates/shirabe/src/repository/repository_set.rs +++ b/crates/shirabe/src/repository/repository_set.rs @@ -13,7 +13,7 @@ use shirabe_semver::constraint::MatchAllConstraint; use shirabe_semver::constraint::MultiConstraint; use shirabe_semver::constraint::SimpleConstraint; -use crate::advisory::{PartialOrFullSecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory}; +use crate::advisory::{AnySecurityAdvisory, PartialSecurityAdvisory, SecurityAdvisory}; use crate::dependency_resolver::Pool; use crate::dependency_resolver::PoolBuilder; use crate::dependency_resolver::PoolOptimizer; @@ -371,8 +371,8 @@ impl RepositorySet { allow_partial_advisories: bool, ignore_unreachable: bool, unreachable_repos: &mut Vec, - ) -> Result>> { - let mut repo_advisories: Vec>> = vec![]; + ) -> Result>> { + let mut repo_advisories: Vec>> = vec![]; for repository in &self.repositories { let attempt: Result<()> = (|| -> Result<()> { let mut repo_ref = repository.borrow_mut(); @@ -664,6 +664,6 @@ impl RepositorySet { #[derive(Debug)] pub struct SecurityAdvisoriesResult { - pub advisories: IndexMap>, + pub advisories: IndexMap>, pub unreachable_repos: Vec, } -- cgit v1.3.1