activitypub 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d306bc2763af88f633f0645a032d1e0ed47e5a790b140ad566e6a53fdf9aeea
-  data.tar.gz: 2f12fc9aa91aa64fedd909b68b6182ae2ed352e2bb06e80e60a65ee0f6ad4e6e
+  metadata.gz: 259eb9ee62ae1fdd8155792569764c2ed1725755463cdf97ad3ec1807bdcf88a
+  data.tar.gz: b8758711d3bdd3eafe0747c7f16f279634f87ee67ad4c6ce3e18fada660a2648
 SHA512:
-  metadata.gz: b154f2bcf3cb03386947ea1f137f55b53461c0dcaa0a6fde15c5098b276c809620fe3f94f90d110b416dd29b31a9ff75a5f5376d1cdaefaa98e5e9f713fd4c4c
-  data.tar.gz: 44ca4b68aa880bed6a62a92e757c4e48ead8afb5f4b71fb300c8156729062d79f9ac15333ba38e2e776c52c89dc03701070ef84040e8b5033ead9d7cac03eb25
+  metadata.gz: d38fe32f27c42f7ff652cbafdb7a97506d963bed70c94d49782da0a44396232b2236e0965bb08547928f73c7fcb9b232461cef384f051d51dd4000f1f22f6fd1
+  data.tar.gz: 0a3c78633eae0eaf5a7f74c5cb424de24e4f0148c10209de6da8e2f956c3ed1e563cedda71c79c7a14bb19284b6081526d6a1d244f42a37069b435439b6fa586

data/lib/activitypub/resolvers.rb

@@ -31,11 +31,12 @@ module ActivityPub
   #
   class UnsafeResolver
     def initialize(base)
-      @base = base
+      @base = File.expand_path(base)
     end
     
     def call(path)
-      path = File.expand_path(File.join(@base, path))
+      path = File.expand_path(path,@base)
+      raise "Illegal path" if path[0...@base.length] != @base
       if File.exist?(path)
         data = File.read(path)
         return ActivityPub.from_json(data)

data/lib/activitypub/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActivityPub
-  VERSION = "0.5.0"
+  VERSION = "0.5.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activitypub
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.5.1
 platform: ruby
 authors:
 - Vidar Hokstad
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2024-07-19 00:00:00.000000000 Z
+date: 2024-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: webfinger