api2convert 10.3.1 → 10.3.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 050c52e2ed3addf46de0b0008d0a233c49001ff7b65e437a73288687b48b2142
-  data.tar.gz: 0dc7d74ea29cd2f98c618f31ef177766aaeeb3590ca2acc3df569201f1270602
+  metadata.gz: ada5e8eb2a1a367508025bfec543c9a730126291aa80ccff236f26a50947a2f5
+  data.tar.gz: b58f2ae36378bc937debe2f781576931a392ec18f47b80143fb1a07673075d0d
 SHA512:
-  metadata.gz: f6b0bcd3554022246ae7b99d8c52a65d6f8d122772ec397865592437470c35ff92663baebc8957c4227c4bee85ffdcae23829abc05822aa023dcf71abe81819b
-  data.tar.gz: c440475c94830650a2f9d81ef1a0573fafa05892cbea86c83812ade8528714ec812fb9441b8b7cb7f423a58b7e337b3e9b1639d365609d42cb7885d2e9ad4101
+  metadata.gz: efa67a69ac2e792e450a4f82dcccab941fd222dcb0c5014490b483fc7ec4bd845e1d3f4302f551f17bf67fbab2f4ef1cf79e30784df449bef93350657a3ddc39
+  data.tar.gz: 5d8a30b8597043b8b79489efa38866dbb3ce5d1da28659bb63a54b4136a40136f8bac7b3b8ded35f9c30f736ba463929bf1ff615b1f9cdaeb3388f329cc298d2

data/README.md

@@ -112,7 +112,7 @@ client.convert("report.docx", "pdf", output_targets: [target])
 # Delivered to the bucket — the job completes with no local output to save.
 ```
 
-`azure`, `ftp` and `google_cloud` have matching input factories; output uses the
+`azure` and `google_cloud` have matching input factories; output uses the
 generic `OutputTarget` for every provider. Credentials are redacted in
 `inspect`/errors and never printed.
 

data/docs/CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to the API2Convert Ruby SDK are documented here. The five
 official SDKs (PHP, Python, Java, Node.js, Ruby) version together against the
 shared [`SDK_CONTRACT.md`](SDK_CONTRACT.md).
 
+## [10.3.3] - 2026-11-06
+
+### Removed
+
+- The FTP cloud provider, because FTP is being retired from the API: `CloudInput.ftp` and
+  `CloudProvider::FTP`. Code that uses them raises `NoMethodError` or `NameError` and needs another
+  provider. Reading stays tolerant: jobs created with `ftp` earlier still load.
+
+## [10.3.2] - 2026-08-12
+
+### Fixed
+
+- Replaced the trailing-separator regex trims (`%r{/+\z}`) in `config.rb`, `result.rb` and
+  `file_uploader.rb` with a linear reverse scan (`Support::Strings.trim_trailing`). CodeQL
+  flagged the patterns as polynomial ReDoS: a string ending in a long run of separators cost
+  O(n²), and `job.server` comes from the API while `base_url` comes from caller config.
+  Identical semantics, linear time.
+
+## [10.3.1] - 2026-07-12
+
+- Ships the cloud-storage examples added to the README (READMEs are included in the published
+  gem). No functional or API change from 10.3.0.
+
+## [10.3.0] - 2026-07-12
+
+### Added
+
+- Cloud-storage connectors: typed `CloudInput` + `OutputTarget` (SDK contract D-5).
+- On-brand `x-api2convert-*` request headers.
+
+### Fixed
+
+- Bounded the control-plane response-body read; atomic save, download error typing and numeric
+  overflow safety (Track B robustness); a 3xx on the authenticated JSON path now raises a typed
+  error instead of returning an empty model.
+
 ## [10.2.1] - 2026-07-08
 
 - Lock-step version bump to keep all API2Convert SDKs on 10.2.1. No library changes since 10.2.0

data/docs/SDK_CONTRACT.md

@@ -29,13 +29,13 @@ Two layers make up an SDK:
 - **Add remote input**: `POST /jobs/{id}/input` `{ type:'remote', source:'https://…' }`.
 - **Cloud input** (import from customer storage): `POST /jobs/{id}/input` (or inline in `create`)
   `{ type:'cloud', source:<provider>, parameters:{…}, credentials:{…} }`, `<provider> ∈ {amazons3,
-  azure, ftp, googlecloud}`; plus `{ type:'gdrive_picker', source:<drive-file-id>,
+  azure, googlecloud}`; plus `{ type:'gdrive_picker', source:<drive-file-id>,
   credentials:{token}, content_type? }` for Google Drive. The API validates a cloud descriptor
   **asynchronously** — it accepts any descriptor on create (`201`) and later fails a bad one on the
   input (`status:failed`, generic `code 99`); it never echoes a credential value.
 - **Cloud output** (deliver to customer storage): a `conversion[]` may carry
   `output_target:[{ type:<provider>, parameters:{…}, credentials:{…} }]`, `<provider> ∈ {amazons3,
-  googlecloud, azure, ftp, youtube, gdrive}`. `status` (`waiting|uploading|completed|failed`) is
+  googlecloud, azure, youtube, gdrive}`. `status` (`waiting|uploading|completed|failed`) is
   server-set and read-only — never sent on create. The job reaches `completed` only after the upload
   succeeds (a failed upload → `failed`); an output-target conversion produces **no** local output.
 - **Start**: `PATCH /jobs/{id}` `{ process:true }`.
@@ -102,14 +102,14 @@ wire descriptors above; per-provider keys are **not** validated synchronously se
 typed surface is the client's only pre-flight structure.
 
 - **Provider vocabulary** — one shared `CloudProvider` concept (per-language spelling): `amazons3,
-  azure, ftp, gdrive, googlecloud, youtube`. It is **build-side vocabulary only** — read models keep
+  azure, gdrive, googlecloud, youtube`. It is **build-side vocabulary only** — read models keep
   `source`/`type`/`status` as raw strings, and an unknown provider from the server round-trips
   untyped (never throws).
 - **Cloud input** — a `CloudInput` builder emits `{ type:cloud, source, parameters, credentials }`
   and hands off to `addInput` / the create path. It ships per-provider named constructors whose
   signatures carry each provider's required keys **verbatim** (flat/lowercase, as the API expects):
   `amazonS3(bucket, file, accesskeyid, secretaccesskey)`,
-  `azure(container, file, accountname, accountkey)`, `ftp(host, file, username, password)`,
+  `azure(container, file, accountname, accountkey)`,
   `googleCloud(projectid, bucket, file, keyfile)`. The required keys are **constructor arguments**,
   not a runtime gate — the builder never rejects a descriptor the permissive server would accept, and
   a generic `parameters`/`credentials` map stays reachable for optional/forward-compat keys. Google

data/lib/api2convert/cloud_provider.rb

@@ -12,18 +12,17 @@ module Api2Convert
   # there is deliberately no strict parse.
   #
   # Import support (a {Model::CloudInput} factory) exists for {AMAZON_S3},
-  # {AZURE}, {FTP} and {GOOGLE_CLOUD}. {GDRIVE} and {YOUTUBE} are **output-only**
+  # {AZURE} and {GOOGLE_CLOUD}. {GDRIVE} and {YOUTUBE} are **output-only**
   # (they validate as an output `type` but have no downloader); Google Drive
   # *input* uses the separate `gdrive_picker` input type.
   module CloudProvider
     AMAZON_S3 = "amazons3"
     AZURE = "azure"
-    FTP = "ftp"
     GDRIVE = "gdrive"
     GOOGLE_CLOUD = "googlecloud"
     YOUTUBE = "youtube"
 
     # The full provider vocabulary, in canonical order.
-    ALL = [AMAZON_S3, AZURE, FTP, GDRIVE, GOOGLE_CLOUD, YOUTUBE].freeze
+    ALL = [AMAZON_S3, AZURE, GDRIVE, GOOGLE_CLOUD, YOUTUBE].freeze
   end
 end

data/lib/api2convert/config.rb

@@ -41,7 +41,7 @@ module Api2Convert
 
       new(
         api_key: api_key,
-        base_url: (base_url.nil? ? DEFAULT_BASE_URL : base_url).sub(%r{/+\z}, ""),
+        base_url: Support::Strings.trim_trailing(base_url.nil? ? DEFAULT_BASE_URL : base_url, "/"),
         timeout: [1, (timeout.nil? ? 30 : timeout).to_i].max,
         max_retries: [0, (max_retries.nil? ? 2 : max_retries).to_i].max,
         poll_interval: interval,

data/lib/api2convert/model/cloud_input.rb

@@ -63,15 +63,6 @@ module Api2Convert
         )
       end
 
-      # Import from an FTP server.
-      def self.ftp(host:, file:, username:, password:, parameters: {}, credentials: {})
-        new(
-          source: CloudProvider::FTP,
-          parameters: { "host" => host, "file" => file }.merge(parameters),
-          credentials: { "username" => username, "password" => password }.merge(credentials)
-        )
-      end
-
       # Import from Google Cloud Storage.
       def self.google_cloud(projectid:, bucket:, file:, keyfile:, parameters: {}, credentials: {})
         new(

data/lib/api2convert/result.rb

@@ -128,7 +128,7 @@ module Api2Convert
                          path_or_dir.end_with?(File::SEPARATOR)
         if looks_like_dir
           name = safe_name(@output.filename) || safe_name(@output.id) || "output"
-          return File.join(path_or_dir.sub(%r{[/\\]+\z}, ""), name)
+          return File.join(Support::Strings.trim_trailing(path_or_dir, "/\\"), name)
         end
         path_or_dir
       end

data/lib/api2convert/support/strings.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Api2Convert
+  module Support
+    # Small string helpers shared across the SDK. Internal, not part of the public API.
+    module Strings
+      module_function
+
+      # Strip every trailing character contained in +chars+ from +value+.
+      #
+      # Deliberately a scan rather than a regex: %r{/+\z} and friends backtrack, so a
+      # string ending in a long run of separators costs O(n^2) to match (CodeQL's
+      # +rb/polynomial-redos+). +job.server+ arrives from the API and +base_url+ from
+      # caller config, so neither is worth a quadratic path. This is a single reverse
+      # scan — O(n), no backtracking, identical result.
+      def trim_trailing(value, chars)
+        last = value.length
+        last -= 1 while last.positive? && chars.include?(value[last - 1])
+        last == value.length ? value : value[0, last]
+      end
+    end
+  end
+end

data/lib/api2convert/upload/file_uploader.rb

@@ -29,7 +29,7 @@ module Api2Convert
 
         io, resolved_name, opened = resolve(file, filename)
         seekable = io.respond_to?(:rewind)
-        url = "#{job.server.sub(%r{/+\z}, "")}/upload-file/#{job.id}"
+        url = "#{Support::Strings.trim_trailing(job.server, "/")}/upload-file/#{job.id}"
         token = job.token
         boundary = "----Api2Convert#{SecureRandom.hex(16)}"
 

data/lib/api2convert/version.rb

@@ -4,5 +4,5 @@ module Api2Convert
   # The SDK version. Kept in lock-step with the sibling SDKs (PHP, Python, Java,
   # Node.js): all official ports implement the same `docs/SDK_CONTRACT.md` and
   # version together.
-  VERSION = "10.3.1"
+  VERSION = "10.3.3"
 end

data/lib/api2convert.rb

@@ -20,6 +20,7 @@ require_relative "api2convert/version"
 require_relative "api2convert/errors"
 require_relative "api2convert/config"
 require_relative "api2convert/support/data"
+require_relative "api2convert/support/strings"
 require_relative "api2convert/support/secret"
 require_relative "api2convert/support/redactor"
 require_relative "api2convert/job_status"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: api2convert
 version: !ruby/object:Gem::Version
-  version: 10.3.1
+  version: 10.3.3
 platform: ruby
 authors:
 - Qaamgo Media GmbH
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-12 00:00:00.000000000 Z
+date: 2026-11-06 00:00:00.000000000 Z
 dependencies: []
 description: Convert, compress and transform images, documents, audio, video, ebooks,
   archives and CAD — and run operations like OCR, merge, thumbnail and website capture
@@ -73,6 +73,7 @@ files:
 - lib/api2convert/support/data.rb
 - lib/api2convert/support/redactor.rb
 - lib/api2convert/support/secret.rb
+- lib/api2convert/support/strings.rb
 - lib/api2convert/upload/file_uploader.rb
 - lib/api2convert/upload/multipart_stream.rb
 - lib/api2convert/version.rb