api2convert 10.3.0 → 10.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ab0c201184fae5e154e8eb8dda08b1dd523f6721b8c0ea63882f36b0d08d69a8
-  data.tar.gz: 51d41801caf9b731b48b2f988b2f76605638b455b90a337c4ce6ce2acbfda4d6
+  metadata.gz: 7b3813dd8314612f6d7b87b5eeb108be94bed5978da2107651414fec83bc1450
+  data.tar.gz: e5b33c01144af84acd534eae3fcc5ab12d51ab36f861aaacfa0a437b3d40f107
 SHA512:
-  metadata.gz: e1a07542793b7fe4f016907ba28b6e25bc6d887bf0549714b3233350994f561534604a79f1488df8c69efc7cd40f76340a73486938fa5c82fb9424a8f63417d6
-  data.tar.gz: bd3a8cdc13f9d5092a54f91d7e6ef3caa5e7627b2bee607e8203afda5a7991d5356749ce35da48afcd0ae8420e3e43cf6b52f359b37bdfc6feba030111fefb24
+  metadata.gz: 6b8fa42db82e724bfd66f835c01349e70eb6c2265b0a5b493d15a54d86530d6cbd0d364a2bd49fe3cbda7d2f82dd99cb25350684fbb120c23d1daf57539b468b
+  data.tar.gz: 77772316f9261aeb355a2043dbd440369e2bd3e85b421526bb155836e308efbdb2ac052c434bccf6d90ce45220bc103c137a2a3ac59ee877bb86b1b2ba6372d3

data/README.md

@@ -87,6 +87,35 @@ rescue Api2Convert::SignatureVerificationError
 end
 ```
 
+## Cloud storage
+
+Read an input straight from your own cloud storage, and/or deliver the output
+into a bucket — no local upload or download in between (shipped in 10.3.0).
+
+```ruby
+# Input from S3: import the source and save the converted result locally
+input = Api2Convert::Model::CloudInput.amazon_s3(
+  bucket:          "my-bucket",
+  file:            "invoices/report.docx",
+  accesskeyid:     "AKIA…",
+  secretaccesskey: "…"
+)
+client.convert(input, "pdf").save("report.pdf")
+
+# Output to S3: deliver the result into a bucket (generic OutputTarget)
+target = Api2Convert::Model::OutputTarget.of(
+  Api2Convert::CloudProvider::AMAZON_S3,
+  parameters:  { "bucket" => "my-bucket", "file" => "out/report.pdf" },
+  credentials: { "accesskeyid" => "AKIA…", "secretaccesskey" => "…" }
+)
+client.convert("report.docx", "pdf", output_targets: [target])
+# Delivered to the bucket — the job completes with no local output to save.
+```
+
+`azure`, `ftp` and `google_cloud` have matching input factories; output uses the
+generic `OutputTarget` for every provider. Credentials are redacted in
+`inspect`/errors and never printed.
+
 ## Error handling
 
 ```ruby

data/docs/CHANGELOG.md

@@ -4,6 +4,34 @@ All notable changes to the API2Convert Ruby SDK are documented here. The five
 official SDKs (PHP, Python, Java, Node.js, Ruby) version together against the
 shared [`SDK_CONTRACT.md`](SDK_CONTRACT.md).
 
+## [10.3.2] - 2026-08-12
+
+### Fixed
+
+- Replaced the trailing-separator regex trims (`%r{/+\z}`) in `config.rb`, `result.rb` and
+  `file_uploader.rb` with a linear reverse scan (`Support::Strings.trim_trailing`). CodeQL
+  flagged the patterns as polynomial ReDoS: a string ending in a long run of separators cost
+  O(n²), and `job.server` comes from the API while `base_url` comes from caller config.
+  Identical semantics, linear time.
+
+## [10.3.1] - 2026-07-12
+
+- Ships the cloud-storage examples added to the README (READMEs are included in the published
+  gem). No functional or API change from 10.3.0.
+
+## [10.3.0] - 2026-07-12
+
+### Added
+
+- Cloud-storage connectors: typed `CloudInput` + `OutputTarget` (SDK contract D-5).
+- On-brand `x-api2convert-*` request headers.
+
+### Fixed
+
+- Bounded the control-plane response-body read; atomic save, download error typing and numeric
+  overflow safety (Track B robustness); a 3xx on the authenticated JSON path now raises a typed
+  error instead of returning an empty model.
+
 ## [10.2.1] - 2026-07-08
 
 - Lock-step version bump to keep all API2Convert SDKs on 10.2.1. No library changes since 10.2.0

data/lib/api2convert/config.rb

@@ -41,7 +41,7 @@ module Api2Convert
 
       new(
         api_key: api_key,
-        base_url: (base_url.nil? ? DEFAULT_BASE_URL : base_url).sub(%r{/+\z}, ""),
+        base_url: Support::Strings.trim_trailing(base_url.nil? ? DEFAULT_BASE_URL : base_url, "/"),
         timeout: [1, (timeout.nil? ? 30 : timeout).to_i].max,
         max_retries: [0, (max_retries.nil? ? 2 : max_retries).to_i].max,
         poll_interval: interval,

data/lib/api2convert/result.rb

@@ -128,7 +128,7 @@ module Api2Convert
                          path_or_dir.end_with?(File::SEPARATOR)
         if looks_like_dir
           name = safe_name(@output.filename) || safe_name(@output.id) || "output"
-          return File.join(path_or_dir.sub(%r{[/\\]+\z}, ""), name)
+          return File.join(Support::Strings.trim_trailing(path_or_dir, "/\\"), name)
         end
         path_or_dir
       end

data/lib/api2convert/support/strings.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Api2Convert
+  module Support
+    # Small string helpers shared across the SDK. Internal, not part of the public API.
+    module Strings
+      module_function
+
+      # Strip every trailing character contained in +chars+ from +value+.
+      #
+      # Deliberately a scan rather than a regex: %r{/+\z} and friends backtrack, so a
+      # string ending in a long run of separators costs O(n^2) to match (CodeQL's
+      # +rb/polynomial-redos+). +job.server+ arrives from the API and +base_url+ from
+      # caller config, so neither is worth a quadratic path. This is a single reverse
+      # scan — O(n), no backtracking, identical result.
+      def trim_trailing(value, chars)
+        last = value.length
+        last -= 1 while last.positive? && chars.include?(value[last - 1])
+        last == value.length ? value : value[0, last]
+      end
+    end
+  end
+end

data/lib/api2convert/upload/file_uploader.rb

@@ -29,7 +29,7 @@ module Api2Convert
 
         io, resolved_name, opened = resolve(file, filename)
         seekable = io.respond_to?(:rewind)
-        url = "#{job.server.sub(%r{/+\z}, "")}/upload-file/#{job.id}"
+        url = "#{Support::Strings.trim_trailing(job.server, "/")}/upload-file/#{job.id}"
         token = job.token
         boundary = "----Api2Convert#{SecureRandom.hex(16)}"
 

data/lib/api2convert/version.rb

@@ -4,5 +4,5 @@ module Api2Convert
   # The SDK version. Kept in lock-step with the sibling SDKs (PHP, Python, Java,
   # Node.js): all official ports implement the same `docs/SDK_CONTRACT.md` and
   # version together.
-  VERSION = "10.3.0"
+  VERSION = "10.3.2"
 end

data/lib/api2convert.rb

@@ -20,6 +20,7 @@ require_relative "api2convert/version"
 require_relative "api2convert/errors"
 require_relative "api2convert/config"
 require_relative "api2convert/support/data"
+require_relative "api2convert/support/strings"
 require_relative "api2convert/support/secret"
 require_relative "api2convert/support/redactor"
 require_relative "api2convert/job_status"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: api2convert
 version: !ruby/object:Gem::Version
-  version: 10.3.0
+  version: 10.3.2
 platform: ruby
 authors:
 - Qaamgo Media GmbH
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-12 00:00:00.000000000 Z
+date: 2026-08-12 00:00:00.000000000 Z
 dependencies: []
 description: Convert, compress and transform images, documents, audio, video, ebooks,
   archives and CAD — and run operations like OCR, merge, thumbnail and website capture
@@ -73,6 +73,7 @@ files:
 - lib/api2convert/support/data.rb
 - lib/api2convert/support/redactor.rb
 - lib/api2convert/support/secret.rb
+- lib/api2convert/support/strings.rb
 - lib/api2convert/upload/file_uploader.rb
 - lib/api2convert/upload/multipart_stream.rb
 - lib/api2convert/version.rb