gradle: parse slashy strings in pluginManagement scanner

Author: thavaahariharangit

gradle/lib/dependabot/gradle/file_fetcher/settings_file_parser.rb

@@ -137,6 +137,8 @@ def skip_quoted_string(content:, index:)
         def string_literal_at(content:, index:)
           return "'''" if content[index, 3] == "'''"
           return '"""' if content[index, 3] == '"""'
+          return "$/" if content[index, 2] == "$/"
+          return "/" if content[index, 1] == "/" && slashy_string_start?(content: content, index: index)
           return "'" if content[index, 1] == "'"
           return '"' if content[index, 1] == '"'
 
@@ -145,6 +147,9 @@ def string_literal_at(content:, index:)
 
         sig { params(content: String, start_index: Integer, quote: String).returns(Integer) }
         def advance_after_string(content:, start_index:, quote:)
+          return advance_after_dollar_slashy_string(content: content, start_index: start_index) if quote == "$/"
+          return advance_after_slashy_string(content: content, start_index: start_index) if quote == "/"
+
           index = T.let(start_index, Integer)
 
           while index < content.length
@@ -168,6 +173,67 @@ def advance_after_string(content:, start_index:, quote:)
           content.length
         end
 
+        sig { params(content: String, start_index: Integer).returns(Integer) }
+        def advance_after_slashy_string(content:, start_index:)
+          index = T.let(start_index, Integer)
+
+          while index < content.length
+            if content[index, 1] == "\\"
+              index += 2
+              next
+            end
+
+            return index + 1 if content[index, 1] == "/"
+
+            index += 1
+          end
+
+          content.length
+        end
+
+        sig { params(content: String, start_index: Integer).returns(Integer) }
+        def advance_after_dollar_slashy_string(content:, start_index:)
+          index = T.let(start_index, Integer)
+
+          while index < content.length
+            return index + 2 if content[index, 2] == "/$"
+
+            if content[index, 1] == "$"
+              index += 2
+              next
+            end
+
+            index += 1
+          end
+
+          content.length
+        end
+
+        sig { params(content: String, index: Integer).returns(T::Boolean) }
+        def slashy_string_start?(content:, index:)
+          return false if content[index, 2] == "//"
+          return false if content[index, 2] == "/*"
+
+          previous = previous_non_whitespace_character(content: content, index: index)
+          return true unless previous
+
+          !!(previous =~ /[=(:,!?&|\[{;]/)
+        end
+
+        sig { params(content: String, index: Integer).returns(T.nilable(String)) }
+        def previous_non_whitespace_character(content:, index:)
+          cursor = T.let(index - 1, Integer)
+
+          while cursor >= 0
+            character = T.must(content[cursor])
+            return character unless character.match?(/\s/)
+
+            cursor -= 1
+          end
+
+          nil
+        end
+
         sig { params(quote: String).returns(T::Boolean) }
         def triple_quote?(quote)
           quote.length == 3

gradle/spec/dependabot/gradle/file_fetcher/settings_file_parser_spec.rb

@@ -223,5 +223,43 @@
         expect(plugin_management_included_build_paths).to match_array(%w(build-logic))
       end
     end
+
+    context "when pluginManagement contains braces in slashy strings" do
+      let(:settings_file_name) { "settings.gradle" }
+      let(:settings_file) do
+        Dependabot::DependencyFile.new(
+          name: settings_file_name,
+          content: <<~GROOVY
+            pluginManagement {
+              def marker = /}/
+              includeBuild("build-logic")
+            }
+          GROOVY
+        )
+      end
+
+      it "ignores braces inside slashy strings" do
+        expect(plugin_management_included_build_paths).to match_array(%w(build-logic))
+      end
+    end
+
+    context "when pluginManagement contains braces in dollar-slashy strings" do
+      let(:settings_file_name) { "settings.gradle" }
+      let(:settings_file) do
+        Dependabot::DependencyFile.new(
+          name: settings_file_name,
+          content: <<~GROOVY
+            pluginManagement {
+              def marker = $/}/$
+              includeBuild("build-logic")
+            }
+          GROOVY
+        )
+      end
+
+      it "ignores braces inside dollar-slashy strings" do
+        expect(plugin_management_included_build_paths).to match_array(%w(build-logic))
+      end
+    end
   end
 end