Fixup for security warnings

Signed-off-by: Dominik Gedon <dominik.gedon@suse.com>

Author: nodeg

lib/tetra/packages/package.rb

@@ -58,11 +58,14 @@ def cleanup_description(raw, max_length)
       clean = clean[0, max_length]
 
       # Remove the last word if it looks cut off (ends in letters, not punctuation)
-      #    Note: This assumes descriptions usually end with punctuation.
+      # Note: This assumes descriptions usually end with punctuation.
       clean = clean.sub(/\s\w+\z/, "")
 
-      # Remove ALL trailing dots efficiently (replaces O(N) loop)
-      clean.sub(/\.+\z/, "")
+      # Remove ALL trailing dots efficiently (Security Fix for ReDoS)
+      # Replaces clean.sub(/\.+\z/, "")
+      clean = clean.chomp(".") while clean.end_with?(".")
+
+      clean
     end
 
     def to_spec

lib/tetra/version_matcher.rb

@@ -10,11 +10,14 @@ class VersionMatcher
     # by a ., -, _, ~ or space
     # returns a [name, version] pair
     def split_version(full_name)
-      # Use non-capturing group (?:...) for the separator part
-      matches = full_name.match(/\A(.*?)(?:[.\-_ ~,]?([0-9].*))\z/)
-
-      if matches && matches.length > 1
-        [matches[1], matches[2]]
+      # 1. Match from the start (\A)
+      # 2. Capture everything that is NOT a digit (ZERO or more times) -> *?
+      # 3. Handle the optional separator
+      # 4. Capture the version (MUST start with a digit)
+      matches = full_name.match(/\A(?<name>[^0-9]*?)(?:[.\-_ ~,]?(?<version>[0-9].*))\z/)
+
+      if matches
+        [matches[:name], matches[:version]]
       else
         [full_name, nil]
       end
@@ -96,7 +99,11 @@ def chunk_distance(my_chunk, their_chunk)
 
     # true for integer strings
     def integer?(string)
-      string.match?(/^[0-9]+$/)
+      # Faster than regex for simple digit checks
+      Integer(string, 10)
+      true
+    rescue ArgumentError, TypeError
+      false
     end
   end
 end

spec/lib/fine/package_spec.rb

@@ -68,4 +68,32 @@
       end
     end
   end
+
+  describe "cleanup_description" do
+    it "cleans up a simple description" do
+      expect(@package.cleanup_description("Simple description.", 50)).to eq("Simple description")
+    end
+
+    it "removes newlines and extra spaces" do
+      desc = "Line one.\n\nLine two  with   spaces."
+      expect(@package.cleanup_description(desc, 100)).to eq("Line one. Line two with spaces")
+    end
+
+    it "truncates long descriptions" do
+      desc = "This is a very long description that should be truncated here."
+      # Truncate at 46 chars: "This is a very long description that should be"
+      # The logic removes " be" because it ends in letters (assumed cut-off)
+      expect(@package.cleanup_description(desc, 46)).to eq("This is a very long description that should")
+    end
+
+    it "removes trailing dots (ReDoS fix check)" do
+      expect(@package.cleanup_description("Description...", 50)).to eq("Description")
+      expect(@package.cleanup_description("Description..........", 50)).to eq("Description")
+    end
+
+    it "handles cut-off words" do
+      # "This is a descrip" -> "This is a"
+      expect(@package.cleanup_description("This is a description", 17)).to eq("This is a")
+    end
+  end
 end

spec/lib/fine/speccable_spec.rb

@@ -7,12 +7,20 @@
 
   # mock class to test the module
   class SpeccableTestClass
-    attr_accessor :world_property
+    attr_accessor :world_property, :src_archive, :name, :version, :patches,
+                  :artifact_ids, :runtime_dependency_ids, :outputs
 
     include Tetra::Speccable
 
     def initialize
       @world_property = "World!"
+      @name = "test-package"
+      @version = "1.0"
+      @src_archive = nil
+      @patches = []
+      @artifact_ids = []
+      @runtime_dependency_ids = []
+      @outputs = []
     end
   end
 
@@ -90,4 +98,56 @@ def initialize
       end
     end
   end
+
+  describe "#to_spec unzip requirement" do
+    before(:each) do
+      template_content = <<~ERB
+        Name: <%= name %>
+        <% if src_archive&.downcase&.end_with?(".zip") %>
+        BuildRequires: unzip
+        <% end %>
+      ERB
+      File.write(@template_path, template_content)
+    end
+
+    it "adds BuildRequires: unzip if the source is a .zip file" do
+      instance.src_archive = "sources.zip"
+      expect(instance._to_spec(@project, "test-package", "test.spec", "output")).to be_truthy
+
+      @project.from_directory do
+        spec_lines = File.readlines(@destination_path)
+        expect(spec_lines).to include("BuildRequires: unzip\n")
+      end
+    end
+
+    it "adds BuildRequires: unzip if the source is a .ZIP file (case insensitivity)" do
+      instance.src_archive = "SOURCES.ZIP"
+      expect(instance._to_spec(@project, "test-package", "test.spec", "output")).to be_truthy
+
+      @project.from_directory do
+        spec_lines = File.readlines(@destination_path)
+        expect(spec_lines).to include("BuildRequires: unzip\n")
+      end
+    end
+
+    it "does not add BuildRequires: unzip if the source is a tarball" do
+      instance.src_archive = "sources.tar.gz"
+      expect(instance._to_spec(@project, "test-package", "test.spec", "output")).to be_truthy
+
+      @project.from_directory do
+        spec_lines = File.readlines(@destination_path)
+        expect(spec_lines).not_to include("BuildRequires: unzip\n")
+      end
+    end
+
+    it "does not add BuildRequires: unzip if there is no source archive" do
+      instance.src_archive = nil
+      expect(instance._to_spec(@project, "test-package", "test.spec", "output")).to be_truthy
+
+      @project.from_directory do
+        spec_lines = File.readlines(@destination_path)
+        expect(spec_lines).not_to include("BuildRequires: unzip\n")
+      end
+    end
+  end
 end