anystyle-parser 0.4.3 → 0.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8c7b1fcfe89790b7e0af8e285df94ccba0bb5760
-  data.tar.gz: d5ec56032e50d273fed64c97d1fce20e2ad8ca71
+  metadata.gz: 98fa1a2861bc3fd5953accb104cdf3bf3d3c7a8d
+  data.tar.gz: 691f25e7ade807451098edde34ae8628f299286d
 SHA512:
-  metadata.gz: 236b8315fbe8962bfe1dadf15836c91e77418f8566cb75b909954c7a814f215664fc4e4fda02ccaa48c0d9116bd89fce1f687d77efe0d6f663107b2efebace8c
-  data.tar.gz: c530d278eea102fe8282d16fd760c21f08ab27b08ca964bd81e884f7ca520cb442531a7e0b1eedf26d99995d5c30f6f18e76dcae6f0a30f90053f31e22f00383
+  metadata.gz: 95dc3700ea6a51ffac3059ab14c87098072342adbd108afd8aaa5bcf980fe627da7d279c801ce38f948b45db258a44e180c08021b671368f0270c39db148f31e
+  data.tar.gz: 81b0e2bce8ad581bddb9215882ff67d1d1cab38498d523411b64eed0115803b5fc465621849b128619d15315d1573b56245afaff19dc4c072a0bb8ca4595b012

data/HISTORY.md

@@ -1,3 +1,7 @@
+0.4.4 / 2014-03-10
+==================
+* Mitigate potential vulnerability: open files only if string not tainted
+
 0.4.3 / 2014-03-09
 ==================
 * Add model reload method

data/README.md

@@ -83,12 +83,14 @@ Anystyle-Parser are `#parse` and `#train` that both accept two arguments.
     Parser#train(input = options[:training_data], truncate = true)
 
 `#parse` parses the passed-in input (either a filename, your reference strings,
-or an array of your reference strings) and returns the parsed data in the
+or an array of your reference strings; files are only opened if the string is
+not tainted) and returns the parsed data in the
 format specified as the second argument (supported formats include: *:hash*,
 *:bibtex*, *:citeproc*, *:tags*, and *:raw*).
 
 `#train` allows you to easily train the Parser's CRF model. The first argument
-is either a filename or your data as a string; the format of training data
+is either a filename (if the string is not tainted) or your data as a string;
+the format of training data
 follows the XML-like syntax of the
 [CORA dataset](http://www.cs.umass.edu/~mccallum/data/cora-ie.tar.gz); the
 optional boolean argument lets you decide whether to train the existing

data/lib/anystyle/parser/parser.rb

@@ -215,7 +215,7 @@ module Anystyle
       def input_to_s(input)
         case input
         when String
-          if input.length < 128 && File.exists?(input)
+          if !input.tainted? && input.length < 128 && File.exists?(input)
             f = File.open(input, 'r:UTF-8')
             f.read
           else

data/lib/anystyle/parser/version.rb

@@ -1,5 +1,5 @@
 module Anystyle
   module Parser
-    VERSION = '0.4.3'.freeze
+    VERSION = '0.4.4'.freeze
   end
 end

metadata

@@ -1,55 +1,55 @@
 --- !ruby/object:Gem::Specification
 name: anystyle-parser
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.4.4
 platform: ruby
 authors:
 - Sylvester Keil
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-09 00:00:00.000000000 Z
+date: 2014-03-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bibtex-ruby
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '3.0'
 - !ruby/object:Gem::Dependency
   name: wapiti
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.1'
 - !ruby/object:Gem::Dependency
   name: namae
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: '0.8'
 description: A sophisticated parser for academic reference lists and bibliographies
@@ -96,27 +96,27 @@ licenses:
 metadata: {}
 post_install_message: 
 rdoc_options:
-- "--line-numbers"
-- "--inline-source"
-- "--title"
-- "\"Anystyle Parser\""
-- "--main"
+- --line-numbers
+- --inline-source
+- --title
+- '"Anystyle Parser"'
+- --main
 - README.md
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.0.14
 signing_key: 
 specification_version: 4
 summary: Smart and fast academic bibliography parser.