canvas_link_migrator 1.0.18 → 1.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 949c23c7d951df591af05de644bc829ceada5889aed295bb8e8dee5b897054ee
-  data.tar.gz: 8418a95af9eca811bf3e3848987bbd83bef233ca7aadaf33455f277cecb759b0
+  metadata.gz: ca1247f98a0eee8de26f1fa32da2ec683f374ea995a695bb4af201d87644795a
+  data.tar.gz: 122790ae2f969eee61c75118096d2e9b736fc328e9a27846f8b5b2e82ec7830b
 SHA512:
-  metadata.gz: 0e886dbeaefd433185a7036739dba643c4c26add118b0dd737ee79db6e1dd7e384ba1a5389491023a857b72727055f494e2894746e5f55849ea13f11855c5b4b
-  data.tar.gz: 97f130e22876d639a79faf0b062442252df9392b8e2338a6bf6b46793a83d815b954b43e34f4e1ff1fce97f7e4856b4ca34e5085e1b212c58f653dc05ff89c9d
+  metadata.gz: 37e6e2273e60f1e4428793295e8610e21c138ae16527d54d3a8885c9b5ed88e3660e521e63386ea15f7b7fdab8201f29b0732360e26dce640020c40ec9e88985
+  data.tar.gz: 1d7e969234f632637138adcffa681a30a2a0d5fb3391ef080010c2252fbcd2520ed9e726ab4267793d8c1402baa45b5b910a16cce74e421be740899daccc4b7c

data/lib/canvas_link_migrator/imported_html_converter.rb

@@ -37,11 +37,14 @@ module CanvasLinkMigrator
       LinkParser::REFERENCE_KEYWORDS.each { |ref| url.gsub!("%24#{ref}%24", "$#{ref}$") }
       # create the link map for a single link (parse)
       link_parsing_result = link_parser.parse_single_url(url, link_type)
-      link_parser.handle_parsed_url(url, link_parsing_result, nil, nil, link_type, nil, nil)
-      # resolve_link! on the single element link map
-      link_resolver.resolve_link!(link_parsing_result, link_type)
-      # return the new value
-      link_parsing_result[:new_value]
+      if link_parsing_result[:resolved]
+        link_parser.perform_substitutions_and_make_relative_if_possible(url, link_parsing_result)
+      else
+        link_parser.handle_unresolved_link(url, link_parsing_result, nil, nil, link_type, nil, nil)
+        # resolve_link! on the single element link map
+        link_resolver.resolve_link!(link_parsing_result, link_type)
+        link_parsing_result[:new_value]
+      end
     end
 
     def convert_exported_html(input_html)

data/lib/canvas_link_migrator/link_parser.rb

@@ -180,7 +180,7 @@ module CanvasLinkMigrator
       add_unresolved_link(result, item_type, mig_id, field)
     end
 
-    def handle_resolved_link(url, result, node, attr)
+    def perform_substitutions_and_make_relative_if_possible(url, result)
       new_url = result[:new_url] || url
       unless CanvasLinkMigrator.relative_url?(new_url)
         # perform configured substitutions
@@ -200,7 +200,11 @@ module CanvasLinkMigrator
           nil
         end
       end
-      node[attr] = new_url
+      new_url
+    end
+
+    def handle_resolved_link(url, result, node, attr)
+      node[attr] = perform_substitutions_and_make_relative_if_possible(url, result)
     end
 
     def unresolved(type, data = {})

data/lib/canvas_link_migrator/link_replacer.rb

@@ -19,16 +19,38 @@
 
 module CanvasLinkMigrator
   class LinkReplacer
+    HTML_ESCAPES = { '"' => "&quot;", "<" => "&lt;", ">" => "&gt;" }.freeze
+    HTML_ESCAPE_RE = Regexp.union(HTML_ESCAPES.keys).freeze
+
+    def self.escape_url_for_html(value)
+      value.to_s.gsub(HTML_ESCAPE_RE, HTML_ESCAPES)
+    end
+
     # returns false if no substitutions were made
     def self.sub_placeholders!(html, links)
       subbed = false
-      links.each do |link|
+      media_links, other_links = links.partition { |l| l[:link_type] == :media_object }
+
+      if media_links.any?
+        by_placeholder = media_links.to_h { |l| [l[:placeholder], l] }
+        if html.gsub!(Regexp.union(by_placeholder.keys)) { |m|
+          link = by_placeholder[m]
+          link[:replaced] = true
+          link[:new_value] || link[:old_value]
+        }
+          subbed = true
+        end
+      end
+
+      other_links.each do |link|
         new_value = link[:new_value] || link[:old_value]
-        if html.gsub!(link[:placeholder], new_value)
+        new_value = escape_url_for_html(new_value)
+        if html.gsub!(link[:placeholder]) { new_value }
           link[:replaced] = true
           subbed = true
         end
       end
+
       subbed
     end
 

data/lib/canvas_link_migrator/link_resolver.rb

@@ -222,7 +222,7 @@ module CanvasLinkMigrator
             case k
             when /canvas_qs_(.*)/
               qs << "#{Rack::Utils.escape($1)}=#{Rack::Utils.escape(v)}"
-            when /canvas_(.*)/
+            when /\Acanvas_(\w*)\z/
               new_action += "/#{$1}"
             end
           end

data/lib/canvas_link_migrator/version.rb

@@ -1,3 +1,3 @@
 module CanvasLinkMigrator
-  VERSION = "1.0.18"
+  VERSION = "1.0.20"
 end

data/spec/canvas_link_migrator/imported_html_converter_spec.rb

@@ -140,6 +140,35 @@ describe CanvasLinkMigrator::ImportedHtmlConverter do
         test_string = %(<img src="%24IMS_CC_FILEBASE%24/test.png?notarelevantparam" alt="nope" />)
         expect(@converter.convert_exported_html(test_string)).to eq([%(<img src="#{@path}files/5/preview?verifier=u5" alt="nope">), nil])
       end
+
+      describe "path-segment injection via canvas_* parameter names" do
+        it "does not allow `..` path traversal via canvas_* keys" do
+          test_string = %(<img src="%24IMS_CC_FILEBASE%24/test.png?canvas_..%2F..%2Faccounts%2F1%2Fadmin=x" alt="nope" />)
+          html, _ = @converter.convert_exported_html(test_string)
+          src = Nokogiri::HTML5.fragment(html).at_css("img")["src"]
+          expect(src).not_to include(".."),
+            "path traversal: src contains `..` segments -- output was: #{src.inspect}"
+        end
+
+        it "does not allow a single `..` segment via canvas_* keys" do
+          test_string = %(<a href="%24IMS_CC_FILEBASE%24/test.png?canvas_..=x">x</a>)
+          html, _ = @converter.convert_exported_html(test_string)
+          href = Nokogiri::HTML5.fragment(html).at_css("a")["href"]
+          expect(href).not_to match(%r{/\.\.(?:/|\?|#|\z)}),
+            "path traversal: href ends in a `..` segment -- output was: #{href.inspect}"
+        end
+
+        it "does not allow `#` fragment injection that hides the verifier" do
+          test_string = %(<a href="%24IMS_CC_FILEBASE%24/test.png?canvas_a%23evil=x">x</a>)
+          html, _ = @converter.convert_exported_html(test_string)
+          href = Nokogiri::HTML5.fragment(html).at_css("a")["href"]
+          parsed = URI.parse(href)
+          expect(parsed.fragment).to be_nil,
+            "fragment injection: produced fragment #{parsed.fragment.inspect} -- output was: #{href.inspect}"
+          expect(parsed.query.to_s).to include("verifier="),
+            "verifier was pushed into the fragment by `#` injection -- output was: #{href.inspect}"
+        end
+      end
     end
 
     it "converts picture source srcsets" do
@@ -190,6 +219,113 @@ describe CanvasLinkMigrator::ImportedHtmlConverter do
       expect(@converter.convert_exported_html(test_string)).to eq([%(<a href="/courses/123">Mine</a><br><a href="/courses/456">Vain</a><br><a href="http://other-canvas.example.com/">Other Instance</a>), nil])
     end
 
+    describe "percent-encoded HTML in unresolved file references (CSAN-045)" do
+      it "does not allow attribute breakout via $IMS-CC-FILEBASE$ references" do
+        test_string = %(<img src="$IMS-CC-FILEBASE$/foo%22%09onerror=%22alert(1).jpg">)
+        html, _bad_links = @converter.convert_exported_html(test_string)
+
+        img = Nokogiri::HTML5.fragment(html).at_css("img")
+        expect(img).not_to be_nil
+        expect(img["onerror"]).to be_nil,
+          "attribute breakout: produced live onerror -- output was: #{html.inspect}"
+        expect(img.attributes.keys).to contain_exactly("src"),
+          "expected only `src`, got #{img.attributes.keys.inspect} -- output was: #{html.inspect}"
+      end
+
+      it "does not allow attribute breakout via plain relative URLs" do
+        test_string = %(<a href="relative/foo%22%09onmouseover=%22alert(1).html">x</a>)
+        html, _bad_links = @converter.convert_exported_html(test_string)
+
+        anchor = Nokogiri::HTML5.fragment(html).at_css("a")
+        expect(anchor).not_to be_nil
+        expect(anchor["onmouseover"]).to be_nil,
+          "attribute breakout: produced live onmouseover -- output was: #{html.inspect}"
+        expect(anchor.attributes.keys).to contain_exactly("href"),
+          "expected only `href`, got #{anchor.attributes.keys.inspect} -- output was: #{html.inspect}"
+      end
+
+      it "does not allow attribute breakout via $CANVAS_COURSE_REFERENCE$/file_ref/ rest" do
+        test_string = %(<a href="$CANVAS_COURSE_REFERENCE$/file_ref/E/preview&quot; onmouseover=&quot;alert(1)">x</a>)
+        html, _bad_links = @converter.convert_exported_html(test_string)
+
+        anchor = Nokogiri::HTML5.fragment(html).at_css("a")
+        expect(anchor).not_to be_nil
+        expect(anchor["onmouseover"]).to be_nil,
+          "attribute breakout via file_ref rest -- output was: #{html.inspect}"
+        expect(anchor.attributes.keys).to contain_exactly("href"),
+          "expected only `href`, got #{anchor.attributes.keys.inspect} -- output was: #{html.inspect}"
+      end
+
+      it "does not allow attribute breakout via $CANVAS_COURSE_REFERENCE$/modules/items/ query" do
+        test_string = %(<a href="$CANVAS_COURSE_REFERENCE$/modules/items/C?foo=bar&quot; onmouseover=&quot;alert(1)">x</a>)
+        html, _bad_links = @converter.convert_exported_html(test_string)
+
+        anchor = Nokogiri::HTML5.fragment(html).at_css("a")
+        expect(anchor).not_to be_nil
+        expect(anchor["onmouseover"]).to be_nil,
+          "attribute breakout via module_item query -- output was: #{html.inspect}"
+        expect(anchor.attributes.keys).to contain_exactly("href"),
+          "expected only `href`, got #{anchor.attributes.keys.inspect} -- output was: #{html.inspect}"
+      end
+
+      it "does not allow attribute breakout via wiki_page_migration_id fallback" do
+        test_string = %(<a href="wiki_page_migration_id=nope&quot; onmouseover=&quot;alert(1)">x</a>)
+        html, _bad_links = @converter.convert_exported_html(test_string)
+
+        anchor = Nokogiri::HTML5.fragment(html).at_css("a")
+        expect(anchor).not_to be_nil
+        expect(anchor["onmouseover"]).to be_nil,
+          "attribute breakout via wiki_page fallback -- output was: #{html.inspect}"
+        expect(anchor.attributes.keys).to contain_exactly("href"),
+          "expected only `href`, got #{anchor.attributes.keys.inspect} -- output was: #{html.inspect}"
+      end
+
+      it "does not allow text-node injection when placeholder lives in inner_html" do
+        payload = "relative/foo%3Cimg%09src=x%09onerror=alert(1)%3E.html"
+        test_string = %(<a href="#{payload}">#{payload}</a>)
+        html, _bad_links = @converter.convert_exported_html(test_string)
+
+        anchor = Nokogiri::HTML5.fragment(html).at_css("a")
+        expect(anchor).not_to be_nil
+        expect(anchor.css("img")).to be_empty,
+          "text-node injection: produced live <img> child -- output was: #{html.inspect}"
+      end
+
+      it "does not allow attribute injection via gsub! pre-match back-reference" do
+        test_string = %q(<img src="wiki_page_migration_id=NONEXIST\`onerror=alert(1) ">)
+        html, _bad_links = @converter.convert_exported_html(test_string)
+
+        img = Nokogiri::HTML5.fragment(html).at_css("img")
+        expect(img).not_to be_nil
+        expect(img["onerror"]).to be_nil,
+          "attribute injection via gsub backref: produced live onerror -- output was: #{html.inspect}"
+        expect(img.attributes.keys).to contain_exactly("src"),
+          "expected only `src`, got #{img.attributes.keys.inspect} -- output was: #{html.inspect}"
+      end
+
+      it "does not allow media_object cross-substitution into attribute context" do
+        attacker_video = %q(<video data-media-id="m-stuff" data-media-type="video"><source src="$IMS-CC-FILEBASE$/test.png" data-media-id="m-stuff" data-media-type="video"></video>)
+        preview = Nokogiri::HTML5.fragment(attacker_video, max_tree_depth: 10_000)
+        preview.search("source[data-media-type],source[data-media-id]").each do |source|
+          next unless %w[audio video].include?(source.parent.name)
+          media_node = source.parent
+          media_node.name = "iframe"
+          media_node["src"] = source["src"]
+          source.remove
+        end
+        predicted_placeholder = "LINK.PLACEHOLDER_#{Digest::MD5.hexdigest(preview.at_css("iframe").to_xml)}"
+
+        attack_html = %Q(<a href="evil/#{predicted_placeholder}">link</a>#{attacker_video})
+        html, _ = @converter.convert_exported_html(attack_html)
+
+        anchor = Nokogiri::HTML5.fragment(html).at_css("a")
+        expect(anchor).not_to be_nil
+        expect(anchor.attributes.keys).to contain_exactly("href"),
+          "media_object cross-substitution injected attributes onto anchor: " \
+          "#{anchor.attributes.keys.inspect} -- output was: #{html.inspect}"
+      end
+    end
+
     it "prepends course files for unrecognized relative urls" do
       test_string = %(<a href="/relative/path/to/file">Linkage</a>)
       html, bad_links = @converter.convert_exported_html(test_string)
@@ -438,5 +574,198 @@ describe CanvasLinkMigrator::ImportedHtmlConverter do
       link = @converter.convert_single_link(test_string)
       expect(link).to eq "/courses/2/files/9?verifier=u9&type=video&amp=&embedded=true"
     end
+
+    it "handles $CANVAS_COURSE_REFERENCE$/ without crashing" do
+      link = @converter.convert_single_link("$CANVAS_COURSE_REFERENCE$/")
+      expect(link).to eq "#{@path}"
+    end
+
+    it "handles $CANVAS_COURSE_REFERENCE$/ with link_type: :media_object without crashing" do
+      # Not sure this is a realistic case, but we should at least not crash on it
+      link = @converter.convert_single_link("$CANVAS_COURSE_REFERENCE$/", link_type: :media_object)
+      expect(link).to eq "#{@path}"
+    end
+
+    it "handles external URLs without crashing" do
+      link = @converter.convert_single_link("http://example.com/")
+      expect(link).to eq "http://example.com/"
+    end
+
+    it "returns nil for failed assignment substitution" do
+      link = @converter.convert_single_link("$CANVAS_OBJECT_REFERENCE$/assignments/noexist")
+      # passing thru might also be acceptable
+      expect(link).to be_nil
+    end
+
+    it "doesn't care about existence of wiki page slugs" do
+      link = @converter.convert_single_link("$WIKI_REFERENCE$/pages/slug-no-exist")
+      expect(link).to eq "/courses/2/pages/slug-no-exist"
+    end
+
+    it "doesn't care about existence of wiki page slugs (with fragment)" do
+      link = @converter.convert_single_link("$WIKI_REFERENCE$/pages/slug-no-exist#hello-world")
+      expect(link).to eq "/courses/2/pages/slug-no-exist#hello-world"
+    end
+
+    it "passes through incorrectly used $CANVAS_OBJECT_REFERENCE$" do
+      link = @converter.convert_single_link("http://example.com/courses/123/assignments/$CANVAS_OBJECT_REFERENCE$")
+      # returning nil might also be acceptable
+      expect(link).to eq "http://example.com/courses/123/assignments/$CANVAS_OBJECT_REFERENCE$"
+    end
+
+    it "returns nil for failed assignment substitution (on a different domain)" do
+      link = @converter.convert_single_link("http://pineapple.edu/$CANVAS_OBJECT_REFERENCE$/assignments/g2fac96de3e3dc1270155dddedb5bb1ce")
+      # passing through might also be acceptable
+      expect(link).to be_nil
+    end
+
+    it "returns nil for failed assignment substitution (used instead of host)" do
+      link = @converter.convert_single_link("http://$CANVAS_OBJECT_REFERENCE$/assignments/g2fac96de3e3dc1270155dddedb5bb1ce")
+      expect(link).to be_nil
+    end
+
+    it "passes through $CANVAS_COURSE_REFERENCE$ used weirdly" do
+      link = @converter.convert_single_link("$CANVAS_COURSE_REFERENCE$<b>/foo")
+      # nil would probably also be acceptable
+      expect(link).to eq "$CANVAS_COURSE_REFERENCE$<b>/foo"
+    end
+
+    it "passes through $INVALID_KEYWORD$" do
+      link = @converter.convert_single_link("http://example.com/$INVALID_KEYWORD$/path")
+      expect(link).to eq "http://example.com/$INVALID_KEYWORD$/path"
+    end
+
+    it "handles %24CANVAS_OBJECT_REFERENCE%24 like $CANVAS_OBJECT_REFERENCE$" do
+      link = @converter.convert_single_link("%24CANVAS_OBJECT_REFERENCE%24/assignments/I")
+      expect(link).to eq "/courses/2/assignments/12"
+    end
+
+    it "preserves absolute URLs with query params and fragments" do
+      link = @converter.convert_single_link("https://example.com/123?456#789")
+      expect(link).to eq "https://example.com/123?456#789"
+    end
+
+    it "preserves absolute URLs to other courses" do
+      link = @converter.convert_single_link("https://example.com/courses/123/assignments/123")
+      expect(link).to eq "https://example.com/courses/123/assignments/123"
+    end
+
+    it "converts assignment reference by migration id" do
+      link = @converter.convert_single_link("$CANVAS_OBJECT_REFERENCE$/assignments/I")
+      expect(link).to eq "/courses/2/assignments/12"
+    end
+
+    it "relative-izes absolute URLs in course domains with fragments" do
+      # I'm not 100% sure how important this case is, but this follows the
+      # behavior of translated HTML
+      link = @converter.convert_single_link("http://apple.edu/courses/18/settings#tab-navigation")
+      expect(link).to eq "/courses/18/settings#tab-navigation"
+    end
+
+    it "converts course reference with fragment" do
+      link = @converter.convert_single_link("$CANVAS_COURSE_REFERENCE$/settings#tab-navigation")
+      expect(link).to eq "/courses/2/settings#tab-navigation"
+    end
+
+    it "converts wiki reference by slug" do
+      link = @converter.convert_single_link("$WIKI_REFERENCE$/pages/slug-a")
+      expect(link).to eq "/courses/2/pages/slug-a"
+    end
+
+    it "converts wiki reference with fragment" do
+      link = @converter.convert_single_link("$WIKI_REFERENCE$/pages/slug-a#hello-world")
+      expect(link).to eq "/courses/2/pages/slug-a#hello-world"
+    end
+
+    it "preserves absolute URLs with invalid keywords" do
+      link = @converter.convert_single_link("http://example.com/$WHATEVER$/foo")
+      expect(link).to eq "http://example.com/$WHATEVER$/foo"
+    end
+
+    it "preserves absolute URLs with malformed $123$ syntax" do
+      link = @converter.convert_single_link("http://example.com/$123$/foo")
+      expect(link).to eq "http://example.com/$123$/foo"
+    end
+
+    it "preserves absolute URLs with errant $ characters" do
+      link = @converter.convert_single_link("http://example.com/$/foo")
+      expect(link).to eq "http://example.com/$/foo"
+    end
+
+    it "doesn't crash on http://example.com/$CANVAS_COURSE_REFERENCE$/foo" do
+      link = @converter.convert_single_link("http://example.com/$CANVAS_COURSE_REFERENCE$/foo")
+      # I don't know if we actually care what happens here, as long as it doesn't crash.
+      # this seems to follow existing behavior for HTML translation
+      expect(link).to eq "/courses/2/foo"
+    end
+
+    it "passes through malformed reference with spaces" do
+      link = @converter.convert_single_link("$  $/path")
+      expect(link).to eq "$  $/path"
+    end
+
+    it "handles $CANVAS_COURSE_REFERENCE$ with other stuff" do
+      link = @converter.convert_single_link("$CANVAS_COURSE_REFERENCE$/assignments/")
+      expect(link).to eq "/courses/2/assignments/"
+    end
+
+    describe 'invalid references returning file_contents' do
+      # These are invalid or malformed reference syntax that get treated as relative file paths.
+      # They get prepended with the course file_contents path, matching the existing behavior
+      # for HTML content. These cause 'broken link' pages to show up in the UI.
+      # That said, I'm not 100% sure we care that much about the actual values as they are
+      # invalid, so feel free to change the specs if we decide to handle these
+      # differently (e.g. return nil)
+
+      it "passes through $CANVAS_COURSE_REFERENCE" do
+        link = @converter.convert_single_link("$CANVAS_COURSE_REFERENCE")
+        expect(link).to eq("/courses/2/file_contents/course%20files/$CANVAS_COURSE_REFERENCE")
+      end
+
+      it "passes through lone $123" do
+        link = @converter.convert_single_link("/$123")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$123"
+      end
+
+      it "passes through errant $" do
+        link = @converter.convert_single_link("/$")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$"
+      end
+
+      it "passes through errant lone $123" do
+        link = @converter.convert_single_link("$123")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$123"
+      end
+
+      it "passes through errant lone $" do
+        link = @converter.convert_single_link("$")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$"
+      end
+
+      it "passes through starting $INVALID_KEYWORD$" do
+        link = @converter.convert_single_link("$INVALID_KEYWORD$/path")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$INVALID_KEYWORD$/path"
+      end
+
+      it "passes through errant $123$" do
+        link = @converter.convert_single_link("$123$/path")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$123$/path"
+      end
+
+      it "doesn't crash when given $CANVAS_COURSE_REFERENCE$" do
+        link = @converter.convert_single_link("$CANVAS_COURSE_REFERENCE$")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$CANVAS_COURSE_REFERENCE$"
+      end
+
+      it "doesn't crash on /courses/123/assignments/$CANVAS_OBJECT_REFERENCE$" do
+        link = @converter.convert_single_link("/courses/123/assignments/$CANVAS_OBJECT_REFERENCE$")
+        expect(link).to eq "/courses/2/file_contents/course%20files/courses/123/assignments/$CANVAS_OBJECT_REFERENCE$"
+      end
+
+      it "handles $$/path" do
+        link = @converter.convert_single_link("$$/path")
+        expect(link).to eq "/courses/2/file_contents/course%20files/$$/path"
+      end
+    end
   end
 end

data/spec/fixtures/canvas_resource_map.json

@@ -8,7 +8,6 @@
     "test.png": "E",
     "media_objects/0_bq09qam2": "F"
   },
-  "contains_migration_ids": true,
   "destination_course": "2",
   "destination_hosts": [
     "apple.edu",

data/spec/fixtures/canvas_resource_map_pages.json

@@ -7,7 +7,6 @@
       "lolcat.mp3": "H",
       "test.png": "E"
     },
-    "contains_migration_ids": true,
     "destination_course": "2",
     "destination_hosts": [
       "apple.edu",

metadata

@@ -1,17 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: canvas_link_migrator
 version: !ruby/object:Gem::Version
-  version: 1.0.18
+  version: 1.0.20
 platform: ruby
 authors:
 - Mysti Lilla
 - James Logan
 - Sarah Gerard
 - Math Costa
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-07-15 00:00:00.000000000 Z
+date: 2026-05-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -27,6 +27,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: bigdecimal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -125,7 +139,7 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description: 
+description:
 email:
 - mysti@instructure.com
 - james.logan@instructure.com
@@ -150,11 +164,11 @@ files:
 - spec/fixtures/canvas_resource_map_pages.json
 - spec/spec_helper.rb
 - test.sh
-homepage: 
+homepage:
 licenses: []
 metadata:
   source_code_uri: https://github.com/instructure/canvas_link_migrator
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -162,15 +176,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: '3.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key: 
+rubygems_version: 3.3.27
+signing_key:
 specification_version: 4
 summary: Instructure gem for migrating Canvas style rich content
 test_files: []