asciidoctor-include-ext 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 426f9fc65b85c68d988632d3b123f9e21ed8f539bed5cb8dfb389b9bf9bcc066
-  data.tar.gz: bb40b284130e5c1bc0f6774471da10e0405b1240dbbec51ff05d9be568cd8c70
+  metadata.gz: e351222783e131005427ad519891508168603495508299c6d71c2fb55d71a19e
+  data.tar.gz: 209424da5377db4f71f273f32413f69d083faec1ee9da79cf127d7ed55a57c62
 SHA512:
-  metadata.gz: 5418ef883794df0cf2df411516592c58a058e5a7a8b13bf1d9130aba246a62630752748b1056413d82c48d2196454dbf25c75fabda3001132d02d99feb9ce5d6
-  data.tar.gz: 1aa743cb0820f82f3d670ae44649ce4e20f385a68a08110fb213ac63aa9b0cd21d1d8f4835c315be728463a85e2d2f9b969eaf17cef558969424b2b4f403107c
+  metadata.gz: b93df9f785ad62e1b36a8a68207f06f57578f6ee54af248596c17aa0be38c58e15175ca1cbc02bbe1a73338306959d9a99b06181948fb5743461510cfa02fb4f
+  data.tar.gz: 6ec6deec461722db7a314fb21726af6d08572690e1785865d83a0b3668df43781e9015b87966556b9b2982f434d7eda597eaedd7dcbe56af241e09e1017b8a4b

data/LICENSE

@@ -1,6 +1,6 @@
 The MIT License
 
-Copyright 2017 Jakub Jirutka <jakub@jirutka.cz>.
+Copyright 2017-present Jakub Jirutka <jakub@jirutka.cz>.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

data/README.adoc

@@ -7,7 +7,7 @@
 :codacy-id: 45320444129044688ef6553821b083f1
 
 ifdef::env-github[]
-image:https://travis-ci.org/{gh-name}.svg?branch={gh-branch}[Build Status, link="https://travis-ci.org/{gh-name}"]
+image:https://github.com/{gh-name}/workflows/CI/badge.svg[CI Status, link=https://github.com/{gh-name}/actions?query=workflow%3A%22CI%22]
 image:https://api.codacy.com/project/badge/Coverage/{codacy-id}["Test Coverage", link="https://www.codacy.com/app/{gh-name}"]
 image:https://api.codacy.com/project/badge/Grade/{codacy-id}["Codacy Code quality", link="https://www.codacy.com/app/{gh-name}"]
 image:https://img.shields.io/gem/v/{gem-name}.svg?style=flat[Gem Version, link="https://rubygems.org/gems/{gem-name}"]
@@ -49,6 +49,9 @@ or to install the latest development version:
 gem install {gem-name} --pre
 
 
+WARNING: Versions *prior 0.4.0* are vulnerable for Command Injection (see https://github.com/{gh-name}/commit/c7ea001a597c7033575342c51483dab7b87ae155[c7ea001] for more information). If you use an older version, update to 0.4.0 immediately!
+
+
 == Usage
 
 Just `require '{gem-name}'`.

data/asciidoctor-include-ext.gemspec

@@ -1,4 +1,4 @@
-require File.expand_path('../lib/asciidoctor/include_ext/version', __FILE__)
+require File.expand_path('lib/asciidoctor/include_ext/version', __dir__)
 
 Gem::Specification.new do |s|
   s.name        = 'asciidoctor-include-ext'
@@ -9,24 +9,22 @@ Gem::Specification.new do |s|
   s.license     = 'MIT'
 
   s.summary     = "Asciidoctor's standard include::[] processor reimplemented as an extension"
-  s.description = <<EOF
-This is a reimplementation of the Asciidoctor's built-in (pre)processor for the
-include::[] directive in extensible and more clean way. It provides the same
-features, but you can easily adjust it or extend for your needs. For example,
-you can change how it loads included files or add another ways how to select
-portions of the document to include.
-EOF
+  s.description = <<~EOF
+    This is a reimplementation of the Asciidoctor's built-in (pre)processor for the
+    include::[] directive in extensible and more clean way. It provides the same
+    features, but you can easily adjust it or extend for your needs. For example,
+    you can change how it loads included files or add another ways how to select
+    portions of the document to include.
+  EOF
 
   s.files       = Dir['lib/**/*', '*.gemspec', 'LICENSE*', 'README*']
-  s.has_rdoc    = 'yard'
 
-  s.required_ruby_version = '>= 2.1'
+  s.required_ruby_version = '>= 2.3'
 
-  s.add_runtime_dependency 'asciidoctor', '~> 1.5.6'
+  s.add_runtime_dependency 'asciidoctor', '>= 1.5.6', '< 3.0.0'
 
-  s.add_development_dependency 'corefines', '~> 1.11'
-  s.add_development_dependency 'kramdown', '~> 1.16'
-  s.add_development_dependency 'rake', '~> 12.0'
+  s.add_development_dependency 'kramdown', '~> 2.0'
+  s.add_development_dependency 'rake', '~> 13.0'
   s.add_development_dependency 'rspec', '~> 3.7'
   s.add_development_dependency 'rubocop', '~> 0.51.0'
   s.add_development_dependency 'simplecov', '~> 0.15'

data/lib/asciidoctor/include_ext/include_processor.rb

@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 require 'logger'
 require 'open-uri'
+require 'uri'
 
 require 'asciidoctor/include_ext/version'
 require 'asciidoctor/include_ext/reader_ext'
 require 'asciidoctor/include_ext/lineno_lines_selector'
+require 'asciidoctor/include_ext/logging'
 require 'asciidoctor/include_ext/tag_lines_selector'
 require 'asciidoctor'
 require 'asciidoctor/extensions'
@@ -22,7 +24,7 @@ module Asciidoctor::IncludeExt
     # @param logger [Logger] the logger to use for logging warning and errors
     #   from this object and selectors.
     def initialize(selectors: [LinenoLinesSelector, TagLinesSelector],
-                   logger: Logger.new(STDERR), **)
+                   logger: Logging.default_logger, **)
       super
       @selectors = selectors.dup.freeze
       @logger = logger
@@ -85,7 +87,7 @@ module Asciidoctor::IncludeExt
 
       return false if doc.safe >= ::Asciidoctor::SafeMode::SECURE
       return false if doc.attributes.fetch('max-include-depth', 64).to_i < 1
-      return false if target_uri?(target) && !doc.attributes.key?('allow-uri-read')
+      return false if target_http?(target) && !doc.attributes.key?('allow-uri-read')
       true
     end
 
@@ -93,7 +95,7 @@ module Asciidoctor::IncludeExt
     # @param reader (see #process)
     # @return [String, nil] file path or URI of the *target*, or `nil` if not found.
     def resolve_target_path(target, reader)
-      return target if target_uri? target
+      return target if target_http? target
 
       # Include file is resolved relative to dir of the current include,
       # or base_dir if within original docfile.
@@ -105,16 +107,22 @@ module Asciidoctor::IncludeExt
     # Reads the specified file as individual lines, filters them using the
     # *selector* (if provided) and returns those lines in an array.
     #
-    # @param filename [String] path of the file to be read.
+    # @param path [String] URL or path of the file to be read.
     # @param selector [#to_proc, nil] predicate to filter lines that should be
     #   included in the output. It must accept two arguments: line and
     #   the line number. If `nil` is given, all lines are passed.
     # @return [Array<String>] an array of read lines.
-    def read_lines(filename, selector)
-      if selector
-        IO.foreach(filename).select.with_index(1, &selector)
-      else
-        open(filename, &:read)
+    def read_lines(path, selector)
+      # IO.open is deliberately not used directly to avoid potential security risks.
+      # TODO: Get rid of 'open-uri' (URI.open).
+      io = target_http?(path) ? URI : File
+
+      io.open(path) do |f|
+        if selector
+          f.each.select.with_index(1, &selector)
+        else
+          f.read
+        end
       end
     end
 
@@ -141,9 +149,13 @@ module Asciidoctor::IncludeExt
     private
 
     # @param target (see #process)
-    # @return [Boolean] `true` if the *target* is an URI, `false` otherwise.
-    def target_uri?(target)
-      ::Asciidoctor::Helpers.uriish?(target)
+    # @return [Boolean] `true` if the *target* is a valid HTTP(S) URI, `false` otherwise.
+    def target_http?(target)
+      # First do a fast test, then try to parse it.
+      target.downcase.start_with?('http://', 'https://') \
+        && URI.parse(target).is_a?(URI::HTTP)
+    rescue URI::InvalidURIError
+      false
     end
   end
 end

data/lib/asciidoctor/include_ext/logging.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+require 'logger'
+require 'asciidoctor'
+require 'asciidoctor/include_ext/version'
+
+module Asciidoctor::IncludeExt
+  # Helper module for getting default Logger based on the Asciidoctor version.
+  module Logging
+    module_function
+
+    # @return [Logger] the default `Asciidoctor::Logger` if using Asciidoctor
+    #   1.5.7 or later, or Ruby's `Logger` that outputs to `STDERR`.
+    def default_logger
+      if defined? ::Asciidoctor::LoggerManager
+        ::Asciidoctor::LoggerManager.logger
+      else
+        ::Logger.new(STDERR)
+      end
+    end
+  end
+end

data/lib/asciidoctor/include_ext/tag_lines_selector.rb

@@ -4,6 +4,7 @@ require 'set'
 
 require 'asciidoctor'
 require 'asciidoctor/include_ext/version'
+require 'asciidoctor/include_ext/logging'
 
 module Asciidoctor::IncludeExt
   # Lines selector that selects lines of the content based on the specified tags.
@@ -39,7 +40,7 @@ module Asciidoctor::IncludeExt
     # @param attributes [Hash<String, String>] the attributes parsed from the
     #   `include::[]`s attributes slot. It must contain a key `"tag"` or `"tags"`.
     # @param logger [Logger]
-    def initialize(target, attributes, logger: Logger.new(STDERR), **)
+    def initialize(target, attributes, logger: Logging.default_logger, **)
       tag_flags =
         if attributes.key? 'tag'
           parse_attribute(attributes['tag'], true)

data/lib/asciidoctor/include_ext/version.rb

@@ -3,6 +3,6 @@
 module Asciidoctor
   module IncludeExt
     # Version of the asciidoctor-include-ext gem.
-    VERSION = '0.2.0'.freeze
+    VERSION = '0.4.0'.freeze
   end
 end

metadata

@@ -1,71 +1,63 @@
 --- !ruby/object:Gem::Specification
 name: asciidoctor-include-ext
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Jakub Jirutka
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-05-03 00:00:00.000000000 Z
+date: 2022-03-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: asciidoctor
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.5.6
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: 3.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.5.6
-- !ruby/object:Gem::Dependency
-  name: corefines
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.11'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: 3.0.0
 - !ruby/object:Gem::Dependency
   name: kramdown
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: '2.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.16'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.0'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.0'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -140,6 +132,7 @@ files:
 - lib/asciidoctor/include_ext.rb
 - lib/asciidoctor/include_ext/include_processor.rb
 - lib/asciidoctor/include_ext/lineno_lines_selector.rb
+- lib/asciidoctor/include_ext/logging.rb
 - lib/asciidoctor/include_ext/reader_ext.rb
 - lib/asciidoctor/include_ext/tag_lines_selector.rb
 - lib/asciidoctor/include_ext/version.rb
@@ -155,15 +148,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.1'
+      version: '2.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.3.7
 signing_key: 
 specification_version: 4
 summary: Asciidoctor's standard include::[] processor reimplemented as an extension