Sanitize file names in Dependabot::DependencyFile initializer

[mattt]

Most package ecosystems have code to write dependency files into a temporary directory. Here's a representative example from npm_and_yarn:

dependabot-core/npm_and_yarn/lib/dependabot/npm_and_yarn/update_checker/dependency_files_builder.rb

Lines 16 to 26 in 6a9c745

	def write_temporary_dependency_files
	write_lock_files
	File.write(".npmrc", npmrc_content)
	package_files.each do |file|
	path = file.name
	FileUtils.mkdir_p(Pathname.new(path).dirname)
	File.write(file.name, prepared_package_json_content(file))
	end
	end

You can find a few dozen instances of this pattern in our codebase.

When file.name has a leading /, those calls to FileUtils#mkdir_p and File.write write to the root directory. This causes an Errno::EACCES. For example, when Dependabot runs an update job for a JavaScript project with a local path dependency it produces the error "Permission denied @ rb_sysopen - /package.json".

This PR attempts to address this problem by sanitizing Dependabot::DependencyFile names in the initializer. With this change, any file names with an absolute path are translated into relative paths that will be written into temporary directories instead of attempting to be written to system root.

[jakecoffman]

This has been an issue with the file_fetchers (#5866, #5869), but it manifests in the update_checker when it tries to write the files out. I'm wondering if it's causing other subtle issues, and if we sanitize here we might see more issues elsewhere that will be harder to diagnose.

Also if users are checking in absolute paths we should just be rejecting the job since we can't see some of the dependencies involved, the update could be invalid.

So I think we need to dig down into each of these and see where we're going wrong in the file_fetcher rather than fix it up later.

[mattt]

@jakecoffman Yeah, looking at the test failures makes me think this isn't the right approach. I'll take another pass starting from the file fetcher to see if I can figure out a more targeted solution. Thanks for taking a look!

[jeffwidman]

Related:

• NPM: skip blank "file:" references in path dependencies #6229