feat(internal): template fields enforcement (#5880)

lib/config/__snapshots__/index.spec.ts.snap

@@ -281,7 +281,7 @@ Object {
     "Change",
   ],
   "prBodyDefinitions": Object {
-    "Change": "[{{#if displayFrom}}\`{{{displayFrom}}}\` -> {{else}}{{#if currentValue}}\`{{{currentValue}}}\` -> {{/if}}{{/if}}{{#if displayTo}}\`{{{displayTo}}}\`{{else}}\`{{{newValue}}}\`{{/if}}](https://renovatebot.com/diffs/npm/{{{depNameEscaped}}}/{{{fromVersion}}}/{{{toVersion}}})",
+    "Change": "[{{#if displayFrom}}\`{{{displayFrom}}}\` -> {{else}}{{#if currentValue}}\`{{{currentValue}}}\` -> {{/if}}{{/if}}{{#if displayTo}}\`{{{displayTo}}}\`{{else}}\`{{{newValue}}}\`{{/if}}](https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{fromVersion}}}/{{{toVersion}}})",
     "Current value": "{{{currentValue}}}",
     "New value": "{{{newValue}}}",
     "Package": "{{{depNameLinked}}}",

lib/manager/npm/index.ts

@@ -14,6 +14,6 @@ export const defaultConfig = {
   versioning: npmVersioning.id,
   prBodyDefinitions: {
     Change:
-      '[{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}](https://renovatebot.com/diffs/npm/{{{depNameEscaped}}}/{{{fromVersion}}}/{{{toVersion}}})',
+      "[{{#if displayFrom}}`{{{displayFrom}}}` -> {{else}}{{#if currentValue}}`{{{currentValue}}}` -> {{/if}}{{/if}}{{#if displayTo}}`{{{displayTo}}}`{{else}}`{{{newValue}}}`{{/if}}](https://renovatebot.com/diffs/npm/{{replace '/' '%2f' depName}}/{{{fromVersion}}}/{{{toVersion}}})",
   },
 };

lib/util/clone.ts

@@ -1,3 +1,5 @@
+import safeStringify from 'fast-safe-stringify';
+
 export function clone<T>(input: T): T {
-  return JSON.parse(JSON.stringify(input));
+  return JSON.parse(safeStringify(input));
 }

lib/util/template/index.spec.ts

@@ -0,0 +1,12 @@
+import * as template from '.';
+import { getOptions } from '../../config/definitions';
+
+describe('util/template', () => {
+  it('has valid exposed config options', () => {
+    const allOptions = getOptions().map(option => option.name);
+    const missingOptions = template.exposedConfigOptions.filter(
+      option => !allOptions.includes(option)
+    );
+    expect(missingOptions).toEqual([]);
+  });
+});

lib/util/template/index.ts

@@ -1,7 +1,108 @@
+import is from '@sindresorhus/is';
 import * as handlebars from 'handlebars';
+import { logger } from '../../logger';
+import { clone } from '../clone';
 
 handlebars.registerHelper('encodeURIComponent', encodeURIComponent);
 
-export function compile(template: string, input: any): string {
+// istanbul ignore next
+handlebars.registerHelper('replace', (find, replace, context) => {
+  return context.replace(new RegExp(find, 'g'), replace);
+});
+
+export const exposedConfigOptions = [
+  'branchName',
+  'branchPrefix',
+  'branchTopic',
+  'commitMessage',
+  'commitMessageAction',
+  'commitMessageExtra',
+  'commitMessagePrefix',
+  'commitMessageSuffix',
+  'commitMessageTopic',
+  'group',
+  'groupSlug',
+  'groupName',
+  'managerBranchPrefix',
+  'prBodyColumns',
+  'prBodyDefinitions',
+  'prBodyNotes',
+  'prTitle',
+];
+
+export const allowedFields = {
+  baseDir: 'The full directory with path that the dependency has been found in',
+  currentValue: 'The extracted current value of the dependency being updated',
+  currentVersion: 'The current version that is being updated',
+  datasource: 'The datasource used to look up the upgrade',
+  depName: 'The name of the dependency being updated',
+  depNameEscaped: 'The dependency name with forward slashes replace with %2f',
+  depNameLinked:
+    'The dependency name already linked to its home page using markdown',
+  depNameSanitized:
+    'The depName field sanitized for use in branches after removing spaces and special characters',
+  depNameShort: 'Shortened depName',
+  depType: 'The dependency type (if extracted - manager-dependent)',
+  displayFrom: 'The current value, formatted for display',
+  displayTo: 'The to value, formatted for display',
+  fromVersion:
+    'The version that would be currently installed. For example, if currentValue is ^3.0.0 then currentVersion might be 3.1.0.',
+  isLockfileUpdate: 'true if the branch is a lock file update',
+  isMajor: 'true if the upgrade is major',
+  isPatch: 'true if the upgrade is a patch upgrade',
+  isRange: 'true if the new value is a range',
+  isSingleVersion:
+    'true if the upgrade is to a single version rather than a range',
+  lookupName: 'The full name that was used to look up the dependency.',
+  newDigest: 'The new digest value',
+  newDigestShort:
+    'A shorted version of newDigest, for use when the full digest is too long to be conveniently displayed',
+  newMajor:
+    'The major version of the new version. e.g. "3" if the new version if "3.1.0"',
+  newMinor:
+    'The minor version of the new version. e.g. "1" if the new version if "3.1.0"',
+  newValue:
+    'The new value in the upgrade. Can be a range or version e.g. "^3.0.0" or "3.1.0"',
+  newVersion: 'The new version in the upgrade.',
+  packageFile: 'The filename that the dependency was found in',
+  parentDir:
+    'The name of the directory that the dependency was found in, without full path',
+  platform: 'VCS platform in use, e.g. "github", "gitlab", etc.',
+  recreateClosed: 'If true, this PR will be recreated if closed',
+  references: 'A list of references for the upgrade',
+  releases: 'An array of releases for an upgrade',
+  repository: 'The current repository',
+  toVersion: 'The new version in the upgrade, e.g. "3.1.0"',
+  updateType: 'One of digest, pin, rollback, patch, minor, major',
+  upgrades: 'An array of upgrade objects in the branch',
+};
+
+function getFilteredObject(input: any): any {
+  const obj = clone(input);
+  const res = {};
+  const allAllowed = [
+    ...Object.keys(allowedFields),
+    ...exposedConfigOptions,
+  ].sort();
+  for (const field of allAllowed) {
+    const value = obj[field];
+    if (is.array(value)) {
+      res[field] = value.map(element => getFilteredObject(element));
+    } else if (is.object(value)) {
+      res[field] = getFilteredObject(value);
+    } else if (!is.undefined(value)) {
+      res[field] = value;
+    }
+  }
+  return res;
+}
+
+export function compile(
+  template: string,
+  input: any,
+  filterFields = true
+): string {
+  const filteredInput = filterFields ? getFilteredObject(input) : input;
+  logger.trace({ template, filteredInput }, 'Compiling template');
   return handlebars.compile(template)(input);
 }

lib/workers/pr/body/changelogs.ts

@@ -9,7 +9,7 @@ export function getChangelogs(config: BranchConfig): string {
     return releaseNotes;
   }
   releaseNotes +=
-    '\n\n---\n\n' + template.compile(releaseNotesHbs, config) + '\n\n';
+    '\n\n---\n\n' + template.compile(releaseNotesHbs, config, false) + '\n\n';
   releaseNotes = releaseNotes.replace(/### \[`vv/g, '### [`v');
   // Generic replacements/link-breakers
 

lib/workers/pr/body/index.ts

@@ -78,7 +78,7 @@ export async function getPrBody(config: BranchConfig): Promise<string> {
   const defaultPrBodyTemplate =
     '{{{banner}}}{{{table}}}{{{notes}}}{{{changelogs}}}{{{configDescription}}}{{{controls}}}{{{footer}}}';
   const prBodyTemplate = config.prBodyTemplate || defaultPrBodyTemplate;
-  let prBody = template.compile(prBodyTemplate, content);
+  let prBody = template.compile(prBodyTemplate, content, false);
   prBody = prBody.trim();
   prBody = prBody.replace(/\n\n\n+/g, '\n\n');
   prBody = platform.getPrBody(prBody);

lib/workers/pr/index.ts

@@ -192,7 +192,6 @@ export async function ensurePr(
       continue; // eslint-disable-line no-continue
     }
     processedUpgrades.push(upgradeKey);
-    upgrade.hasUrls = !!(upgrade.sourceUrl || upgrade.homepage);
 
     const logJSON = await getChangeLogJSON(upgrade);
 

package.json

@@ -128,6 +128,7 @@
     "delay": "4.3.0",
     "detect-indent": "6.0.0",
     "email-addresses": "3.1.0",
+    "fast-safe-stringify": "2.0.7",
     "fs-extra": "8.1.0",
     "get-installed-path": "4.0.8",
     "github-url-from-git": "1.5.0",

yarn.lock

@@ -3914,6 +3914,11 @@ fast-levenshtein@~2.0.6:
   resolved "https://registry.yarnpkg.com/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz#3d8a5c66883a16a30ca8643e851f19baa7797917"
   integrity sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=
 
+fast-safe-stringify@2.0.7:
+  version "2.0.7"
+  resolved "https://registry.yarnpkg.com/fast-safe-stringify/-/fast-safe-stringify-2.0.7.tgz#124aa885899261f68aedb42a7c080de9da608743"
+  integrity sha512-Utm6CdzT+6xsDk2m8S6uL8VHxNwI6Jub+e9NYTcAms28T84pTa25GJQV9j0CY0N1rM8hK4x6grpF2BQf+2qwVA==
+
 fastq@^1.6.0:
   version "1.6.0"
   resolved "https://registry.yarnpkg.com/fastq/-/fastq-1.6.0.tgz#4ec8a38f4ac25f21492673adb7eae9cfef47d1c2"