Merge branch 'debian_regexp' into 'master'

Add Debian regexps

See merge request gitlab-org/gitlab!43259

changelogs/unreleased/debian_regexp.yml

+---
+title: Add Debian regexps
+merge_request: 43259
+author: Mathieu Parent
+type: added

lib/api/debian_package_endpoints.rb

@@ -44,7 +44,7 @@ module API
       end
 
       params do
-        requires :distribution, type: String, desc: 'The Debian Codename', file_path: true
+        requires :distribution, type: String, desc: 'The Debian Codename', regexp: Gitlab::Regex.debian_distribution_regex
       end
 
       namespace 'dists/*distribution', requirements: DISTRIBUTION_REQUIREMENTS do
@@ -80,8 +80,8 @@ module API
         end
 
         params do
-          requires :component, type: String, desc: 'The Debian Component'
-          requires :architecture, type: String, desc: 'The Debian Architecture'
+          requires :component, type: String, desc: 'The Debian Component', regexp: Gitlab::Regex.debian_component_regex
+          requires :architecture, type: String, desc: 'The Debian Architecture', regexp: Gitlab::Regex.debian_architecture_regex
         end
 
         namespace ':component/binary-:architecture', requirements: COMPONENT_ARCHITECTURE_REQUIREMENTS do
@@ -99,9 +99,9 @@ module API
       end
 
       params do
-        requires :component, type: String, desc: 'The Debian Component'
+        requires :component, type: String, desc: 'The Debian Component', regexp: Gitlab::Regex.debian_component_regex
         requires :letter, type: String, desc: 'The Debian Classification (first-letter or lib-first-letter)'
-        requires :source_package, type: String, desc: 'The Debian Source Package Name'
+        requires :source_package, type: String, desc: 'The Debian Source Package Name', regexp: Gitlab::Regex.debian_package_name_regex
       end
 
       namespace 'pool/:component/:letter/:source_package', requirements: COMPONENT_LETTER_SOURCE_PACKAGE_REQUIREMENTS do

lib/gitlab/regex.rb

@@ -61,6 +61,39 @@ module Gitlab
             )\z}xi.freeze
       end
 
+      def debian_package_name_regex
+        # See official parser
+        # https://git.dpkg.org/cgit/dpkg/dpkg.git/tree/lib/dpkg/parsehelp.c?id=9e0c88ec09475f4d1addde9cdba1ad7849720356#n122
+        # @debian_package_name_regex ||= %r{\A[a-z0-9][-+\._a-z0-9]*\z}i.freeze
+        # But we prefer a more strict version from Lintian
+        # https://salsa.debian.org/lintian/lintian/-/blob/5080c0068ffc4a9ddee92022a91d0c2ff53e56d1/lib/Lintian/Util.pm#L116
+        @debian_package_name_regex ||= %r{\A[a-z0-9][-+\.a-z0-9]+\z}.freeze
+      end
+
+      def debian_version_regex
+        # See official parser: https://git.dpkg.org/cgit/dpkg/dpkg.git/tree/lib/dpkg/parsehelp.c?id=9e0c88ec09475f4d1addde9cdba1ad7849720356#n205
+        @debian_version_regex ||= %r{
+          \A(?:
+            (?:([0-9]{1,9}):)?    (?# epoch)
+            ([0-9][0-9a-z\.+~-]*)  (?# version)
+            (?:(-[0-0a-z\.+~]+))?  (?# revision)
+            )\z}xi.freeze
+      end
+
+      def debian_architecture_regex
+        # See official parser: https://git.dpkg.org/cgit/dpkg/dpkg.git/tree/lib/dpkg/arch.c?id=9e0c88ec09475f4d1addde9cdba1ad7849720356#n43
+        # But we limit to lower case
+        @debian_architecture_regex ||= %r{\A[a-z0-9][-a-z0-9]*\z}.freeze
+      end
+
+      def debian_distribution_regex
+        @debian_distribution_regex ||= %r{\A[a-z0-9][a-z0-9\.-]*\z}i.freeze
+      end
+
+      def debian_component_regex
+        @debian_component_regex ||= %r{#{debian_distribution_regex}}.freeze
+      end
+
       def unbounded_semver_regex
         # See the official regex: https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
 

spec/lib/gitlab/regex_spec.rb

@@ -414,6 +414,140 @@ RSpec.describe Gitlab::Regex do
     it { is_expected.not_to match('%2e%2e%2f1.2.3') }
   end
 
+  describe '.debian_package_name_regex' do
+    subject { described_class.debian_package_name_regex }
+
+    it { is_expected.to match('0ad') }
+    it { is_expected.to match('g++') }
+    it { is_expected.to match('lua5.1') }
+    it { is_expected.to match('samba') }
+
+    # may not be empty string
+    it { is_expected.not_to match('') }
+    # must start with an alphanumeric character
+    it { is_expected.not_to match('-a') }
+    it { is_expected.not_to match('+a') }
+    it { is_expected.not_to match('.a') }
+    it { is_expected.not_to match('_a') }
+    # only letters, digits and characters '-+._'
+    it { is_expected.not_to match('a~') }
+    it { is_expected.not_to match('aé') }
+
+    # More strict Lintian regex
+    # at least 2 chars
+    it { is_expected.not_to match('a') }
+    # lowercase only
+    it { is_expected.not_to match('Aa') }
+    it { is_expected.not_to match('aA') }
+    # No underscore
+    it { is_expected.not_to match('a_b') }
+  end
+
+  describe '.debian_version_regex' do
+    subject { described_class.debian_version_regex }
+
+    context 'valid versions' do
+      it { is_expected.to match('1.0') }
+      it { is_expected.to match('1.0~alpha1') }
+      it { is_expected.to match('2:4.9.5+dfsg-5+deb10u1') }
+    end
+
+    context 'dpkg errors' do
+      # version string is empty
+      it { is_expected.not_to match('') }
+      # version string has embedded spaces
+      it { is_expected.not_to match('1 0') }
+      # epoch in version is empty
+      it { is_expected.not_to match(':1.0') }
+      # epoch in version is not number
+      it { is_expected.not_to match('a:1.0') }
+      # epoch in version is negative
+      it { is_expected.not_to match('-1:1.0') }
+      # epoch in version is too big
+      it { is_expected.not_to match('9999999999:1.0') }
+      # nothing after colon in version number
+      it { is_expected.not_to match('2:') }
+      # revision number is empty
+      # Note: we are less strict here
+      # it { is_expected.not_to match('1.0-') }
+      # version number is empty
+      it { is_expected.not_to match('-1') }
+      it { is_expected.not_to match('2:-1') }
+    end
+
+    context 'dpkg warnings' do
+      # version number does not start with digit
+      it { is_expected.not_to match('a') }
+      it { is_expected.not_to match('a1.0') }
+      # invalid character in version number
+      it { is_expected.not_to match('1_0') }
+      # invalid character in revision number
+      it { is_expected.not_to match('1.0-1_0') }
+    end
+
+    context 'dpkg accepts' do
+      # dpkg accepts leading or trailing space
+      it { is_expected.not_to match(' 1.0') }
+      it { is_expected.not_to match('1.0 ') }
+      # dpkg accepts multiple colons
+      it { is_expected.not_to match('1:2:3') }
+    end
+  end
+
+  describe '.debian_architecture_regex' do
+    subject { described_class.debian_architecture_regex }
+
+    it { is_expected.to match('amd64') }
+    it { is_expected.to match('kfreebsd-i386') }
+
+    # may not be empty string
+    it { is_expected.not_to match('') }
+    # must start with an alphanumeric
+    it { is_expected.not_to match('-a') }
+    it { is_expected.not_to match('+a') }
+    it { is_expected.not_to match('.a') }
+    it { is_expected.not_to match('_a') }
+    # only letters, digits and characters '-'
+    it { is_expected.not_to match('a+b') }
+    it { is_expected.not_to match('a.b') }
+    it { is_expected.not_to match('a_b') }
+    it { is_expected.not_to match('a~') }
+    it { is_expected.not_to match('aé') }
+
+    # More strict
+    # Enforce lowercase
+    it { is_expected.not_to match('AMD64') }
+    it { is_expected.not_to match('Amd64') }
+    it { is_expected.not_to match('aMD64') }
+  end
+
+  describe '.debian_distribution_regex' do
+    subject { described_class.debian_distribution_regex }
+
+    it { is_expected.to match('buster') }
+    it { is_expected.to match('buster-updates') }
+    it { is_expected.to match('Debian10.5') }
+
+    # Do not allow slash, even if this exists in the wild
+    it { is_expected.not_to match('jessie/updates') }
+
+    # Do not allow Unicode
+    it { is_expected.not_to match('hé') }
+  end
+
+  describe '.debian_component_regex' do
+    subject { described_class.debian_component_regex }
+
+    it { is_expected.to match('main') }
+    it { is_expected.to match('non-free') }
+
+    # Do not allow slash
+    it { is_expected.not_to match('non/free') }
+
+    # Do not allow Unicode
+    it { is_expected.not_to match('hé') }
+  end
+
   describe '.semver_regex' do
     subject { described_class.semver_regex }