business 2.3.0 → 3.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b251f5b883fe268c312d1d85b129f20244ca8729a427784f8e5c0b87681ff646
-  data.tar.gz: '05779798d8c21739f31a604b6e46c063f62189b0a7e0a1064e674c1c5fbe9278'
+  metadata.gz: c7aab6453e38130641098c102e0b05f1d5c40cd957710c80f3b53f4670175ce6
+  data.tar.gz: 2ae585a9a460e340db0821c755a787795e7504914af8febb247c451beb8f37f2
 SHA512:
-  metadata.gz: 7d117a929340ee63c4978d6a0869e3e99fb585c002ac609a9d12d047aee7a96f75fc04f7a03bda894591348d23a3d3f43a32c1e33366d2bdb77d2ce9481c7e21
-  data.tar.gz: b2b9acd515306f0460e3e48aa89a0c0296b8bd9eebf9a4b51a4a3731fd94b7096ca521fd50db9ace4ba97bbcb7bb24e17cc6d38c488e6855bc8b34c1d0cd982f
+  metadata.gz: ffe309242e862845535efb526d3f4ec95852bd685f026c97fdac4bcd4eec88051e47481f5d1354b98a9f34af47dd4858b417fe173b6f9498b52c226a6c491bac
+  data.tar.gz: 322e9a49e3fcec9078b6c5e1d78eb6ea0d4abc0bc47f95550cbb6069d72715c00d8c5868279bfdfc5e69776e7e85cea03fc3994441522ff7a84abb82411e867f

data/.github/workflows/tests.yml

@@ -0,0 +1,36 @@
+name: tests
+
+on:
+  push:
+    branches:
+      - "master"
+  pull_request:
+
+jobs:
+  rubocop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          # Maintain consistency with the TargetRubyVersion in .rubocop.yml
+          ruby-version: "3.3"
+      - name: Run rubocop
+        run: bundle exec rubocop --parallel --extra-details --display-style-guide
+
+  tests:
+    strategy:
+      matrix:
+        ruby-version: ["3.3", "3.4", "4.0"]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          bundler-cache: true
+          ruby-version: "${{ matrix.ruby-version }}"
+      - name: Run tests
+        run: bundle exec rspec

data/.rubocop.yml

@@ -1,6 +1,10 @@
 inherit_gem:
   gc_ruboconfig: rubocop.yml
 
+AllCops:
+  TargetRubyVersion: 3.3
+  NewCops: enable
+
 RSpec/NestedGroups:
   Exclude:
     - spec/business/calendar_spec.rb
@@ -12,5 +16,5 @@ Naming/AccessorMethodName:
 Gemspec/RequiredRubyVersion:
   Enabled: false
 
-Style/HashSyntax:
+RSpec/IndexedLet:
   Enabled: false

data/.ruby-version

@@ -1 +1 @@
-3.1.0
+4.0.6

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## Upcoming
 
+# 3.0.0 - Sept 29, 2026
+
+- Removed support for Ruby 3.2 and earlier
+- Prevent path traversal when loading calendar files #331
+
 ## 2.3.0 - Jan 31, 2022
 
 - Added permitted classes to YAML's `safe_load` #112 - thanks @attack

data/COMPATIBILITY.md

@@ -0,0 +1,21 @@
+# Compatibility
+
+## v2.0.0 breaking changes
+
+We have removed the bundled calendars as of version 2.0.0, if you need the calendars that were included:
+
+- Download the calendars you wish to use from [v1.18.0](https://github.com/gocardless/business/tree/b12c186ca6fd4ffdac85175742ff7e4d0a705ef4/lib/business/data)
+- Place them in a suitable directory in your project, typically `lib/calendars`
+-  Add this directory path to your instance of `Business::Calendar` using the `load_paths` method.dd the directory to where you placed the yml files before you load the calendar
+
+```ruby
+Business::Calendar.load_paths = ["lib/calendars"] # your_project/lib/calendars/ contains bacs.yml
+Business::Calendar.load("bacs")
+```
+
+If you wish to stay on the last version that contained bundled calendars, pin `business` to `v1.18.0`
+
+```ruby
+# Gemfile
+gem "business", "v1.18.0"
+```

data/Gemfile

@@ -3,3 +3,9 @@
 source 'https://rubygems.org'
 
 gemspec
+
+group :test, :development do
+  gem "gc_ruboconfig", "~> 6"
+  gem "rspec", "~> 3.4"
+  gem "rubocop", "~> 1.91"
+end

data/README.md

@@ -1,39 +1,18 @@
 # Business
 
 [![Gem version](https://badge.fury.io/rb/business.svg)](http://badge.fury.io/rb/business)
-[![CircleCI](https://circleci.com/gh/gocardless/business.svg?style=svg)](https://circleci.com/gh/gocardless/business)
 
 Date calculations based on business calendars.
 
-- [v2.0.0 breaking changes](#v200-breaking-changes)
 - [Getting Started](#getting-started)
   - [Creating a calendar](#creating-a-calendar)
   - [Using a calendar file](#use-a-calendar-file)
 - [Checking for business days](#checking-for-business-days)
 - [Business day arithmetic](#business-day-arithmetic)
 - [But other libraries already do this](#but-other-libraries-already-do-this)
+- [Compatibility](#compatibility)
 - [License & Contributing](#license--contributing)
 
-## v2.0.0 breaking changes
-
-We have removed the bundled calendars as of version 2.0.0, if you need the calendars that were included:
-
-- Download the calendars you wish to use from [v1.18.0](https://github.com/gocardless/business/tree/b12c186ca6fd4ffdac85175742ff7e4d0a705ef4/lib/business/data)
-- Place them in a suitable directory in your project, typically `lib/calendars`
--  Add this directory path to your instance of `Business::Calendar` using the `load_paths` method.dd the directory to where you placed the yml files before you load the calendar
-
-```ruby
-Business::Calendar.load_paths = ["lib/calendars"] # your_project/lib/calendars/ contains bacs.yml
-Business::Calendar.load("bacs")
-```
-
-If you wish to stay on the last version that contained bundled calendars, pin `business` to `v1.18.0`
-
-```ruby
-# Gemfile
-gem "business", "v1.18.0"
-```
-
 ## Getting started
 
 To install business, simply:
@@ -45,7 +24,7 @@ gem install business
 If you are using a Gemfile:
 
 ```ruby
-gem "business", "~> 2.0"
+gem "business", "~> 3.0"
 ```
 
 ### Creating a calendar
@@ -189,6 +168,12 @@ Secondly, business_time supports calculations on times as well as dates. For our
 
 <p align="center"><img src="http://3.bp.blogspot.com/-aq4iOz2OZzs/Ty8xaQwMhtI/AAAAAAAABrM/-vn4tcRA9-4/s1600/daily-morning-awesomeness-243.jpeg" alt="I'm late for business" width="250"/></p>
 
+# Compatibility
+
+## v2.0.0 Breaking Changes
+
+- See [COMPATIBILITY.md](COMPATIBILITY.md#v200-breaking-changes)
+
 ## License & Contributing
 - business is available as open source under the terms of the [MIT License](LICENSE).
 - Bug reports and pull requests are welcome on GitHub at https://github.com/gocardless/business.

data/business.gemspec

@@ -8,7 +8,7 @@ require "business/version"
 Gem::Specification.new do |spec|
   spec.name          = "business"
   spec.version       = Business::VERSION
-  spec.authors       = ["Harry Marr"]
+  spec.authors       = ["GoCcardless"]
   spec.email         = ["developers@gocardless.com"]
   spec.summary       = "Date calculations based on business calendars"
   spec.description   = "Date calculations based on business calendars"
@@ -16,12 +16,7 @@ Gem::Specification.new do |spec|
   spec.licenses      = ["MIT"]
 
   spec.files         = `git ls-files`.split($INPUT_RECORD_SEPARATOR)
-  spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
-  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.add_development_dependency "gc_ruboconfig", "~> 2.31.0"
-  spec.add_development_dependency "rspec", "~> 3.1"
-  spec.add_development_dependency "rspec_junit_formatter", "~> 0.5.1"
-  spec.add_development_dependency "rubocop", "~> 1.25.0"
+  spec.metadata["rubygems_mfa_required"] = "true"
 end

data/lib/business/calendar.rb

@@ -8,6 +8,11 @@ module Business
   class Calendar
     VALID_KEYS = %w[holidays working_days extra_working_dates].freeze
 
+    # Calendar names are interpolated into a filesystem path, so restrict them to
+    # plain identifiers: anything containing path separators, "..", or an absolute
+    # path would otherwise load a file from outside the configured load_paths.
+    CALENDAR_NAME_FORMAT = /\A[a-zA-Z0-9_-]+\z/
+
     class << self
       attr_accessor :load_paths
     end
@@ -38,7 +43,7 @@ module Business
         if path.is_a?(Hash)
           break path[calendar_name] if path[calendar_name]
         else
-          calendar_path = Pathname.new(path).join("#{calendar_name}.yml")
+          calendar_path = calendar_path_for(path, calendar_name)
           next unless calendar_path.exist?
 
           break YAML.safe_load(calendar_path.read, permitted_classes: [Date])
@@ -46,6 +51,17 @@ module Business
       end
     end
 
+    # Only applied to directory load_paths; hash load_paths are a plain key
+    # lookup and cannot escape anywhere, so their keys stay unrestricted.
+    def self.calendar_path_for(directory, calendar_name)
+      unless calendar_name.to_s.match?(CALENDAR_NAME_FORMAT)
+        raise ArgumentError, "invalid calendar name: #{calendar_name.inspect}"
+      end
+
+      Pathname.new(directory).join("#{calendar_name}.yml")
+    end
+    private_class_method :calendar_path_for
+
     @lock = Mutex.new
     def self.load_cached(calendar)
       @lock.synchronize do
@@ -65,7 +81,7 @@ module Business
       set_working_days(working_days)
       set_holidays(holidays)
 
-      unless (@holidays & @extra_working_dates).none?
+      if @holidays.intersect?(@extra_working_dates)
         raise ArgumentError, "Holidays cannot be extra working dates"
       end
     end
@@ -129,10 +145,7 @@ module Business
     def add_business_days(date, delta)
       date = roll_forward(date)
       delta.times do
-        loop do
-          date += day_interval_for(date)
-          break date if business_day?(date)
-        end
+        date = next_business_day(date)
       end
       date
     end
@@ -145,10 +158,7 @@ module Business
     def subtract_business_days(date, delta)
       date = roll_backward(date)
       delta.times do
-        loop do
-          date -= day_interval_for(date)
-          break date if business_day?(date)
-        end
+        date = previous_business_day(date)
       end
       date
     end
@@ -184,7 +194,7 @@ module Business
         in_range && on_biz_day
       end
 
-      remaining_range = (date2 - remaining_days...date2)
+      remaining_range = ((date2 - remaining_days)...date2)
       # Loop through each day in remaining_range and count if a business day
       num_biz_days + remaining_range.count { |a| business_day?(a) }
     end
@@ -203,7 +213,7 @@ module Business
       extra_working_dates_names = @extra_working_dates.map do |d|
         d.strftime("%a").downcase
       end
-      return if (extra_working_dates_names & @working_days).none?
+      return if !extra_working_dates_names.intersect?(@working_days)
 
       raise ArgumentError, "Extra working dates cannot be on working days"
     end

data/lib/business/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Business
-  VERSION = "2.3.0"
+  VERSION = "3.0.0"
 end

data/spec/business/calendar_spec.rb

@@ -2,6 +2,7 @@
 
 require "business/calendar"
 require "time"
+require "fileutils"
 
 RSpec.configure do |config|
   config.mock_with(:rspec) { |mocks| mocks.verify_partial_doubles = true }
@@ -57,6 +58,71 @@ RSpec.describe Business::Calendar do
       specify { expect { load_calendar }.to raise_error(/No such calendar/) }
     end
 
+    context "when given a calendar name that escapes the load path" do
+      before do
+        outside = File.join(File.dirname(__FILE__), "../fixtures")
+        FileUtils.mkdir_p(File.join(outside, "outside"))
+        File.write(
+          File.join(outside, "outside", "escaped.yml"),
+          { "working_days" => ["monday"] }.to_yaml,
+        )
+      end
+
+      after do
+        FileUtils.rm_rf(File.join(File.dirname(__FILE__), "../fixtures", "outside"))
+      end
+
+      context "with a relative traversal" do
+        let(:calendar) { "../outside/escaped" }
+
+        specify do
+          expect { load_calendar }.
+            to raise_error(ArgumentError, /invalid calendar name/)
+        end
+      end
+
+      context "with an absolute path" do
+        let(:calendar) do
+          File.join(File.dirname(__FILE__), "../fixtures", "outside", "escaped")
+        end
+
+        specify do
+          expect { load_calendar }.
+            to raise_error(ArgumentError, /invalid calendar name/)
+        end
+      end
+
+      context "with a bare path separator" do
+        let(:calendar) { "outside/escaped" }
+
+        specify do
+          expect { load_calendar }.
+            to raise_error(ArgumentError, /invalid calendar name/)
+        end
+      end
+
+      context "with a name that is only dots" do
+        let(:calendar) { ".." }
+
+        specify do
+          expect { load_calendar }.
+            to raise_error(ArgumentError, /invalid calendar name/)
+        end
+      end
+
+      context "when the escaping name is a key in a hash load path" do
+        before do
+          described_class.load_paths = [{ "../outside/escaped" => dummy_calendar }]
+        end
+
+        let(:calendar) { "../outside/escaped" }
+
+        it "still resolves, since hash lookups touch no filesystem" do
+          expect(load_calendar).to be_a described_class
+        end
+      end
+    end
+
     context "when given a calendar that has invalid keys" do
       let(:calendar) { "invalid-keys" }
 
@@ -340,7 +406,7 @@ RSpec.describe Business::Calendar do
         context "followed by another non-business day" do
           let(:date) { date_class.parse("Saturday 5th Jan, 2013") }
 
-          it { is_expected.to eq(date + 2 * day_interval) }
+          it { is_expected.to eq(date + (2 * day_interval)) }
         end
       end
     end
@@ -368,7 +434,7 @@ RSpec.describe Business::Calendar do
         context "preceeded by another non-business day" do
           let(:date) { date_class.parse("Sunday 6th Jan, 2013") }
 
-          it { is_expected.to eq(date - 2 * day_interval) }
+          it { is_expected.to eq(date - (2 * day_interval)) }
         end
       end
     end
@@ -396,7 +462,7 @@ RSpec.describe Business::Calendar do
         context "followed by another non-business day" do
           let(:date) { date_class.parse("Saturday 5th Jan, 2013") }
 
-          it { is_expected.to eq(date + 2 * day_interval) }
+          it { is_expected.to eq(date + (2 * day_interval)) }
         end
       end
     end
@@ -424,7 +490,7 @@ RSpec.describe Business::Calendar do
         context "preceeded by another non-business day" do
           let(:date) { date_class.parse("Sunday 6th Jan, 2013") }
 
-          it { is_expected.to eq(date - 2 * day_interval) }
+          it { is_expected.to eq(date - (2 * day_interval)) }
         end
       end
     end
@@ -444,33 +510,33 @@ RSpec.describe Business::Calendar do
         context "and a period that includes only business days" do
           let(:date) { date_class.parse("Wednesday 2nd Jan, 2013") }
 
-          it { is_expected.to eq(date + delta * day_interval) }
+          it { is_expected.to eq(date + (delta * day_interval)) }
         end
 
         context "and a period that includes a weekend" do
           let(:date) { date_class.parse("Friday 4th Jan, 2013") }
 
-          it { is_expected.to eq(date + (delta + 2) * day_interval) }
+          it { is_expected.to eq(date + ((delta + 2) * day_interval)) }
         end
 
         context "and a period that includes a working date weekend" do
           let(:extra_working_dates) { ["Sunday 6th Jan, 2013"] }
           let(:date) { date_class.parse("Friday 4th Jan, 2013") }
 
-          it { is_expected.to eq(date + (delta + 1) * day_interval) }
+          it { is_expected.to eq(date + ((delta + 1) * day_interval)) }
         end
 
         context "and a period that includes a holiday day" do
           let(:date) { date_class.parse("Monday 31st Dec, 2012") }
 
-          it { is_expected.to eq(date + (delta + 1) * day_interval) }
+          it { is_expected.to eq(date + ((delta + 1) * day_interval)) }
         end
       end
 
       context "given a non-business day" do
         let(:date) { date_class.parse("Tuesday 1st Jan, 2013") }
 
-        it { is_expected.to eq(date + (delta + 1) * day_interval) }
+        it { is_expected.to eq(date + ((delta + 1) * day_interval)) }
       end
     end
 
@@ -489,33 +555,33 @@ RSpec.describe Business::Calendar do
         context "and a period that includes only business days" do
           let(:date) { date_class.parse("Wednesday 2nd Jan, 2013") }
 
-          it { is_expected.to eq(date - delta * day_interval) }
+          it { is_expected.to eq(date - (delta * day_interval)) }
         end
 
         context "and a period that includes a weekend" do
           let(:date) { date_class.parse("Monday 31st Dec, 2012") }
 
-          it { is_expected.to eq(date - (delta + 2) * day_interval) }
+          it { is_expected.to eq(date - ((delta + 2) * day_interval)) }
         end
 
         context "and a period that includes a working date weekend" do
           let(:extra_working_dates) { ["Saturday 29th Dec, 2012"] }
           let(:date) { date_class.parse("Monday 31st Dec, 2012") }
 
-          it { is_expected.to eq(date - (delta + 1) * day_interval) }
+          it { is_expected.to eq(date - ((delta + 1) * day_interval)) }
         end
 
         context "and a period that includes a holiday day" do
           let(:date) { date_class.parse("Friday 4th Jan, 2013") }
 
-          it { is_expected.to eq(date - (delta + 1) * day_interval) }
+          it { is_expected.to eq(date - ((delta + 1) * day_interval)) }
         end
       end
 
       context "given a non-business day" do
         let(:date) { date_class.parse("Thursday 3rd Jan, 2013") }
 
-        it { is_expected.to eq(date - (delta + 1) * day_interval) }
+        it { is_expected.to eq(date - ((delta + 1) * day_interval)) }
       end
     end
 

metadata

@@ -1,71 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: business
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 3.0.0
 platform: ruby
 authors:
-- Harry Marr
-autorequire:
+- GoCcardless
 bindir: bin
 cert_chain: []
-date: 2022-01-31 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: gc_ruboconfig
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.31.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.31.0
-- !ruby/object:Gem::Dependency
-  name: rspec
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.1'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.1'
-- !ruby/object:Gem::Dependency
-  name: rspec_junit_formatter
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.5.1
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.5.1
-- !ruby/object:Gem::Dependency
-  name: rubocop
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.25.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.25.0
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies: []
 description: Date calculations based on business calendars
 email:
 - developers@gocardless.com
@@ -73,12 +16,13 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".circleci/config.yml"
 - ".github/dependabot.yml"
+- ".github/workflows/tests.yml"
 - ".gitignore"
 - ".rubocop.yml"
 - ".ruby-version"
 - CHANGELOG.md
+- COMPATIBILITY.md
 - Gemfile
 - LICENSE
 - README.md
@@ -93,8 +37,8 @@ files:
 homepage: https://github.com/gocardless/business
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths:
 - lib
@@ -109,12 +53,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.3
-signing_key:
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Date calculations based on business calendars
-test_files:
-- spec/business/calendar_spec.rb
-- spec/fixtures/calendars/bacs.yml
-- spec/fixtures/calendars/ecb.yml
-- spec/fixtures/calendars/invalid-keys.yml
+test_files: []

data/.circleci/config.yml

@@ -1,37 +0,0 @@
-version: 2.1
-
-jobs:
-  test:
-    docker:
-      - image: cimg/ruby:<< parameters.ruby-version >>
-    parameters:
-      ruby-version:
-        type: string
-    steps:
-      - checkout
-      - restore_cache:
-          keys:
-            - bundle-v1-<< parameters.ruby-version >>-{{ checksum "business.gemspec" }}
-            - bundle-v1-<< parameters.ruby-version >>-
-      - run:
-          name: Install dependencies
-          command: bundle install --clean --no-cache --path vendor/bundle --jobs=4 --retry=3
-      - save_cache:
-          key: bundle-v1-<< parameters.ruby-version >>-{{ checksum "business.gemspec" }}
-          paths:
-            - vendor/bundle
-      - run:
-          name: Run tests
-          command: bundle exec rspec
-      - run:
-          name: Run rubocop
-          command: bundle exec rubocop --parallel --extra-details --display-style-guide
-
-workflows:
-  default:
-    jobs:
-      - test:
-          name: Ruby << matrix.ruby-version >>
-          matrix:
-            parameters:
-              ruby-version: ["2.6.7", "2.7.3", "3.0.1", "3.1.0"]