feat: anchor regex and escape meta characters

Author: notrepo05

internal/commands/update_stemcell.go

@@ -90,13 +90,12 @@ func (update UpdateStemcell) Execute(args []string) error {
 		}
 
 		if err != nil {
+			if component.IsErrNotFound(err) {
+				return fmt.Errorf("couldn't find release %q", rel.Name)
+			}
 			return fmt.Errorf("while finding release %q, encountered error: %w", rel.Name, err)
 		}
 
-		if component.IsErrNotFound(err) {
-			return fmt.Errorf("couldn't find release %q", rel.Name)
-		}
-
 		if remote.RemotePath == rel.RemotePath && remote.RemoteSource == rel.RemoteSource {
 			update.Logger.Printf("No change for release %q\n", rel.Name)
 

internal/commands/update_stemcell_test.go

@@ -615,13 +615,13 @@ var _ = Describe("UpdateStemcell", func() {
 				releaseSource.GetMatchedReleaseReturns(cargo.BOSHReleaseTarballLock{}, component.ErrNotFound)
 			})
 
-			It("errors", func() {
+			It("returns a user-friendly not-found message", func() {
 				err := update.Execute([]string{"--kilnfile", kilnfilePath, "--version", newStemcellVersion})
 
-				Expect(err).To(MatchError(And(
-					ContainSubstring(component.ErrNotFound.Error()),
-					ContainSubstring(release1Name),
-				)))
+				Expect(err).To(HaveOccurred())
+				Expect(err.Error()).To(ContainSubstring("couldn't find release"))
+				Expect(err.Error()).To(ContainSubstring(release1Name))
+				Expect(err.Error()).NotTo(ContainSubstring("while finding release"))
 			})
 		})
 

internal/component/artifactory_release_source.go

@@ -102,6 +102,7 @@ func (ars *ArtifactoryReleaseSource) DownloadRelease(releaseDir string, remoteRe
 	if err != nil {
 		return Local{}, err
 	}
+	defer resp.Body.Close()
 
 	if resp.StatusCode != http.StatusOK {
 		return Local{}, fmt.Errorf("failed to download %s release from artifactory with error code %d", remoteRelease.Name, resp.StatusCode)
@@ -119,7 +120,6 @@ func (ars *ArtifactoryReleaseSource) DownloadRelease(releaseDir string, remoteRe
 
 	mw := io.MultiWriter(out, hash)
 	_, err = io.Copy(mw, resp.Body)
-	_ = resp.Body.Close()
 	if err != nil {
 		return Local{}, err
 	}
@@ -242,17 +242,29 @@ func (ars *ArtifactoryReleaseSource) findReleaseVersion(spec, searchSpec cargo.B
 	return foundRelease, nil
 }
 
+const (
+	versionPlaceholder         = "\x00VERSION_CAPTURE_GROUP\x00"
+	stemcellVersionPlaceholder = "\x00STEMCELL_VERSION_CAPTURE_GROUP\x00"
+)
+
 func (ars *ArtifactoryReleaseSource) regexPatternFromSpec(spec cargo.BOSHReleaseTarballSpecification) (*regexp.Regexp, error) {
+	versionGroup := fmt.Sprintf(`(?P<%s>(%s))`, reReleaseVersionGroup, semverRegex)
+	stemcellVersionGroup := fmt.Sprintf(`(?P<%s>(%s))`, reStemcellVersionGroup, semverRegex)
+
 	regexSpec := spec
-	regexSpec.Version = fmt.Sprintf(`(?P<%s>(%s))`, reReleaseVersionGroup, semverRegex)
-	regexSpec.StemcellVersion = fmt.Sprintf(`(?P<%s>(%s))`, reStemcellVersionGroup, semverRegex)
+	regexSpec.Version = versionPlaceholder
+	regexSpec.StemcellVersion = stemcellVersionPlaceholder
 
-	semverFilepathRegex, err := ars.RemotePath(regexSpec)
+	rawPath, err := ars.RemotePath(regexSpec)
 	if err != nil {
 		return nil, err
 	}
 
-	re, err := regexp.Compile(semverFilepathRegex)
+	escaped := regexp.QuoteMeta(rawPath)
+	escaped = strings.ReplaceAll(escaped, regexp.QuoteMeta(versionPlaceholder), versionGroup)
+	escaped = strings.ReplaceAll(escaped, regexp.QuoteMeta(stemcellVersionPlaceholder), stemcellVersionGroup)
+
+	re, err := regexp.Compile("^" + escaped + "$")
 	return re, err
 }
 

internal/component/artifactory_release_source_test.go

@@ -765,6 +765,72 @@ var _ = Describe("interacting with BOSH releases on Artifactory", func() {
 		})
 	})
 
+	Describe("regex pattern matching", func() {
+		When("a release name contains a dot and only a non-matching file is returned", func() {
+			BeforeEach(func() {
+				config.PathTemplate = "bosh-releases/{{.Name}}-{{.Version}}.tgz"
+				requireAuth := requireBasicAuthMiddleware(correctUsername, correctPassword)
+
+				apiStorageListing := ApiStorageListing{}
+				apiStorageListing.Children = append(apiStorageListing.Children, ApiStorageChildren{
+					Path:       "bosh-releases",
+					Name:       "myXrelease-2.3.4.tgz",
+					ActualSha1: "some-sha",
+				})
+
+				apiStorageListingBytes, err := json.Marshal(apiStorageListing)
+				Expect(err).NotTo(HaveOccurred())
+
+				artifactoryRouter.Handler(http.MethodPost, "/api/search/aql", applyMiddleware(http.HandlerFunc(func(res http.ResponseWriter, _ *http.Request) {
+					res.WriteHeader(http.StatusOK)
+					_, _ = io.Writer.Write(res, apiStorageListingBytes)
+				}), requireAuth))
+			})
+
+			It("does not match a file where the dot is replaced by another character", func() {
+				_, resultErr := source.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
+					Name:    "my.release",
+					Version: "2.3.4",
+				})
+
+				Expect(resultErr).To(HaveOccurred())
+				Expect(component.IsErrNotFound(resultErr)).To(BeTrue())
+			})
+		})
+
+		When("a file extension dot is replaced by another character", func() {
+			BeforeEach(func() {
+				config.PathTemplate = "bosh-releases/{{.Name}}-{{.Version}}.tgz"
+				requireAuth := requireBasicAuthMiddleware(correctUsername, correctPassword)
+
+				apiStorageListing := ApiStorageListing{}
+				apiStorageListing.Children = append(apiStorageListing.Children, ApiStorageChildren{
+					Path:       "bosh-releases",
+					Name:       "mango-2.3.4Xtgz",
+					ActualSha1: "some-sha",
+				})
+
+				apiStorageListingBytes, err := json.Marshal(apiStorageListing)
+				Expect(err).NotTo(HaveOccurred())
+
+				artifactoryRouter.Handler(http.MethodPost, "/api/search/aql", applyMiddleware(http.HandlerFunc(func(res http.ResponseWriter, _ *http.Request) {
+					res.WriteHeader(http.StatusOK)
+					_, _ = io.Writer.Write(res, apiStorageListingBytes)
+				}), requireAuth))
+			})
+
+			It("does not match the file", func() {
+				_, resultErr := source.GetMatchedRelease(cargo.BOSHReleaseTarballSpecification{
+					Name:    "mango",
+					Version: "2.3.4",
+				})
+
+				Expect(resultErr).To(HaveOccurred())
+				Expect(component.IsErrNotFound(resultErr)).To(BeTrue())
+			})
+		})
+	})
+
 	When("a bosh release is not found", func() {
 		When("there are no files", func() {
 			BeforeEach(func() {