down 4.7.0 → 4.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a731d7a9096d275efb334bb06f6a7d2060f9711ac8973f4db286170a0f288e9
-  data.tar.gz: 89924b87d6fea6ba6fb3d5fc2ceed6d50a312758a1a9ec57baaeeaefd5283a8f
+  metadata.gz: 3d16d04f8312202b900d1384a3b859ffa9020eb1e4b00a83ad74f49d0211953d
+  data.tar.gz: 2b473d352ee773333efe32bbd11d38597c3bf3edc66d1808c9888de3d0cc09cf
 SHA512:
-  metadata.gz: f63e9bbf2f5e8f10105816ffc9369f5aff75e65667ffb85e0e0c71f96c0b1861c5e727d379c55fd5695855e409ca49c306ce70fa5927a7bbb826cfb780b2ac77
-  data.tar.gz: 49db0e8cee2494962384613c4cbb84b232e3e9a6872cc13a19e7a4b4f86b86e09e70a65620ab1c067a8557f0ae43de9d37f2fc0255d8fed42e46ed4705aa7911
+  metadata.gz: 93016da86cad0833589bb4a31068181675bb16a22d94de9332650782cea764b1ea815685202b8a8eea88dedff89b8f35cfd70f884104739437589adffab4b76b
+  data.tar.gz: 4fbc673a14247f63e0616e0b87d4f5b6ad038dc2eecb476725a2d0c74424101c22a28d16700418979418b0b9f4c1d378e2c00cb6f6c9b91f1412bcd5ee36c890

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 4.8.0 (2018-12-19)
+
+* Prefer UTF-8 filenames in `Content-Disposition` header for `Tempfile#original_filename` (@janko-m)
+
+* Make the internal Tempfile of `Down::ChunkedIO` inaccessible to outside programs (@janko-m)
+
 ## 4.7.0 (2018-11-18)
 
 * Allow request headers to be passed via `:headers` to `Down::NetHttp#download` and `#open` (@janko-m)

data/README.md

@@ -338,7 +338,7 @@ net_http.open("http://example.com/image.jpg")
 
 ```rb
 gem "down", "~> 4.4"
-gem "http", "~> 3.2"
+gem "http", "~> 4.0"
 ```
 ```rb
 require "down/http"

data/lib/down/chunked_io.rb

@@ -256,7 +256,14 @@ module Down
     # If Down::ChunkedIO is specified as rewindable, returns a new Tempfile for
     # writing read content to. This allows the Down::ChunkedIO to be rewinded.
     def cache
-      @cache ||= Tempfile.new("down-chunked_io", binmode: true) if @rewindable
+      return if !rewindable?
+
+      @cache ||= (
+        tempfile = Tempfile.new("down-chunked_io", binmode: true)
+        tempfile.chmod(0000)      # make sure nobody else can read or write to it
+        tempfile.unlink if posix? # remove entry from filesystem if it's POSIX
+        tempfile
+      )
     end
 
     # Returns current chunk and retrieves the next chunk. If next chunk is nil,
@@ -296,5 +303,10 @@ module Down
     rescue ArgumentError
       Encoding::BINARY
     end
+
+    # Returns whether the filesystem has POSIX semantics.
+    def posix?
+      RUBY_PLATFORM !~ /(mswin|mingw|cygwin|java)/
+    end
   end
 end

data/lib/down/utils.rb

@@ -8,8 +8,12 @@ module Down
     def filename_from_content_disposition(content_disposition)
       content_disposition = content_disposition.to_s
 
-      filename = content_disposition[/filename="([^"]*)"/, 1] || content_disposition[/filename=(.+)/, 1]
-      filename = CGI.unescape(filename.to_s.strip)
+      escaped_filename =
+        content_disposition[/filename\*=UTF-8''(\S+)/, 1] ||
+        content_disposition[/filename="([^"]*)"/, 1] ||
+        content_disposition[/filename=(\S+)/, 1]
+
+      filename = CGI.unescape(escaped_filename.to_s)
 
       filename unless filename.empty?
     end

data/lib/down/version.rb

@@ -1,5 +1,5 @@
 # frozen-string-literal: true
 
 module Down
-  VERSION = "4.7.0"
+  VERSION = "4.8.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: down
 version: !ruby/object:Gem::Version
-  version: 4.7.0
+  version: 4.8.0
 platform: ruby
 authors:
 - Janko Marohnić
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-11-18 00:00:00.000000000 Z
+date: 2018-12-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable