epzip 0.7.1 → 0.9.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 6532a1347f807c8b3ef8a83b43defb9793ae7648eb3c350533230191c93f13ea
+  data.tar.gz: 955f21763b1b83e0808508843d852bc222fd205ca81631fa38d545267f0153ac
+SHA512:
+  metadata.gz: 2e2a63c218531a117aac7c423f2e7aeb99fd76ba513cb86d8288986b77ea80016f8fd389b6cbcffb1dba544749a42f3154b36555c7806da4ff175986858bade8
+  data.tar.gz: 52861041f0025cb7f9f6d68cb6ddb34c81f93930287e6290b1517129f2eac3919c22833480adf6626b6401c4f8d5ead8e1da522a0edaf3e3b88a6aa219d586fa

data/.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+- package-ecosystem: bundler
+  directory: "/"
+  schedule:
+    interval: daily
+    time: "20:00"
+  open-pull-requests-limit: 10

data/.github/workflows/ruby.yml

@@ -0,0 +1,37 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+# This workflow will download a prebuilt Ruby version, install dependencies and run tests with Rake
+# For more information see: https://github.com/marketplace/actions/setup-ruby-jruby-and-truffleruby
+
+name: Ruby
+
+on:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby-version: ['3.0', '3.1', '3.2', '3.3', '3.4', '4.0']
+
+    steps:
+    - uses: actions/checkout@v7
+    - name: Set up Ruby
+    # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby,
+    # change this to (see https://github.com/ruby/setup-ruby#versioning):
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: ${{ matrix.ruby-version }}
+        bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+    - name: Run tests
+      run: bundle exec rake

data/.gitignore

@@ -17,5 +17,7 @@ tmtags
 coverage
 rdoc
 pkg
+*.gem
+/Gemfile.lock
 
 ## PROJECT::SPECIFIC

data/Gemfile

@@ -0,0 +1,9 @@
+source 'https://rubygems.org'
+
+# Runtime dependencies are declared in epzip.gemspec.
+gemspec
+
+group :development, :test do
+  gem 'rake'
+  gem 'test-unit'
+end

data/Rakefile

@@ -1,55 +1,10 @@
-require 'rubygems'
-require 'rake'
-
-begin
-  require 'jeweler'
-  Jeweler::Tasks.new do |gem|
-    gem.name = "epzip"
-    gem.summary = %Q{simple EPUB packing tool}
-    gem.description = %Q{epzip is EPUB packing tool. It's just only to do 'zip.'}
-    gem.email = "takahashimm@gmail.com"
-    gem.homepage = "http://github.com/takahashim/epzip"
-    gem.authors = ["Masayoshi Takahashi"]
-
-    gem.add_dependency('rubyzip', '>= 0.9.4')
-
-    # gem is a Gem::Specification... see http://www.rubygems.org/read/chapter/20 for additional settings
-  end
-  Jeweler::GemcutterTasks.new
-rescue LoadError
-  puts "Jeweler (or a dependency) not available. Install it with: gem install jeweler"
-end
-
+require "bundler/gem_tasks"
 require 'rake/testtask'
-Rake::TestTask.new(:test) do |test|
-  test.libs << 'lib' << 'test'
-  test.pattern = 'test/**/test_*.rb'
-  test.verbose = true
-end
 
-begin
-  require 'rcov/rcovtask'
-  Rcov::RcovTask.new do |test|
-    test.libs << 'test'
-    test.pattern = 'test/**/test_*.rb'
-    test.verbose = true
-  end
-rescue LoadError
-  task :rcov do
-    abort "RCov is not available. In order to run rcov, you must: sudo gem install spicycode-rcov"
-  end
+Rake::TestTask.new(:test) do |t|
+  t.libs << 'lib' << 'test'
+  t.pattern = 'test/**/test_*.rb'
+  t.verbose = true
 end
 
-task :test => :check_dependencies
-
-task :default => :test
-
-require 'rake/rdoctask'
-Rake::RDocTask.new do |rdoc|
-  version = File.exist?('VERSION') ? File.read('VERSION') : ""
-
-  rdoc.rdoc_dir = 'rdoc'
-  rdoc.title = "epzip #{version}"
-  rdoc.rdoc_files.include('README*')
-  rdoc.rdoc_files.include('lib/**/*.rb')
-end
+task default: :test

data/bin/epunzip

@@ -1,12 +1,10 @@
 #!/usr/bin/env ruby
-# encoding: utf-8
 
-require 'rubygems'
 require 'epzip'
 
 def error_and_exit(msg)
-  STDERR.puts msg
-  exit
+  warn msg
+  exit 1
 end
 
 def usage()
@@ -18,12 +16,12 @@ if !(ARGV.size == 1 or ARGV.size == 2)
 end
 
 file = ARGV.shift
-if !File.exists? file
+if !File.exist? file
   error_and_exit "No such file: #{file}"
 end
 
 dir = ARGV.shift
-if dir and File.exists? dir
+if dir and File.exist? dir
   error_and_exit "Directory already exists: #{dir}"
 end
 

data/bin/epzip

@@ -1,13 +1,11 @@
 #!/usr/bin/env ruby
-# encoding: utf-8
 
-require 'rubygems'
 require 'epzip'
 
 def error_and_exit(msg)
-  STDERR.puts msg
-  exit
-end	
+  warn msg
+  exit 1
+end
 
 def usage()
     error_and_exit "usage: epzip <srcdir> [filename]"
@@ -18,12 +16,12 @@ if !(ARGV.size == 1 or ARGV.size == 2)
 end
 
 dir = ARGV.shift
-if !File.exists? dir
+if !File.exist? dir
   error_and_exit "No such directory: #{dir}"
 end
 
 file = ARGV.shift
-if file and File.exists? file
+if file and File.exist? file
   error_and_exit "File already exists: #{file}"
 end
 

data/epzip.gemspec

@@ -1,57 +1,22 @@
-# Generated by jeweler
-# DO NOT EDIT THIS FILE DIRECTLY
-# Instead, edit Jeweler::Tasks in Rakefile, and run the gemspec command
 # -*- encoding: utf-8 -*-
 
+require_relative "lib/epzip/version"
+
 Gem::Specification.new do |s|
-  s.name = %q{epzip}
-  s.version = "0.7.1"
+  s.name        = "epzip"
+  s.version     = Epzip::VERSION
+  s.authors     = ["Masayoshi Takahashi"]
+  s.email       = "takahashimm@gmail.com"
+  s.homepage    = "https://github.com/takahashim/epzip"
+  s.summary     = "simple EPUB packing tool"
+  s.description = "epzip is an EPUB packing tool. It's just only to do 'zip.'"
+  s.license     = "MIT"
+
+  s.required_ruby_version = ">= 2.6"
 
-  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
-  s.authors = ["Masayoshi Takahashi"]
-  s.date = %q{2010-10-03}
-  s.description = %q{epzip is EPUB packing tool. It's just only to do 'zip.'}
-  s.email = %q{takahashimm@gmail.com}
+  s.files       = `git ls-files -z`.split("\x0")
   s.executables = ["epunzip", "epzip"]
-  s.extra_rdoc_files = [
-    "LICENSE",
-     "README.rdoc"
-  ]
-  s.files = [
-    ".document",
-     ".gitignore",
-     "LICENSE",
-     "README.rdoc",
-     "Rakefile",
-     "VERSION",
-     "bin/epunzip",
-     "bin/epzip",
-     "epzip.gemspec",
-     "lib/epzip.rb",
-     "test/helper.rb",
-     "test/test_epzip.rb"
-  ]
-  s.homepage = %q{http://github.com/takahashim/epzip}
-  s.rdoc_options = ["--charset=UTF-8"]
   s.require_paths = ["lib"]
-  s.rubygems_version = %q{1.3.7}
-  s.summary = %q{simple EPUB packing tool}
-  s.test_files = [
-    "test/helper.rb",
-     "test/test_epzip.rb"
-  ]
 
-  if s.respond_to? :specification_version then
-    current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
-    s.specification_version = 3
-
-    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
-      s.add_runtime_dependency(%q<rubyzip>, [">= 0.9.4"])
-    else
-      s.add_dependency(%q<rubyzip>, [">= 0.9.4"])
-    end
-  else
-    s.add_dependency(%q<rubyzip>, [">= 0.9.4"])
-  end
+  s.add_runtime_dependency "rubyzip", ">= 1.0", "< 3.0"
 end
-

data/lib/epzip/version.rb

@@ -0,0 +1,3 @@
+class Epzip
+  VERSION = "0.9.0"
+end

data/lib/epzip.rb

@@ -1,59 +1,60 @@
-require 'rubygems'
-require 'zip/zip'
+require 'zip'
+require 'fileutils'
+require 'epzip/version'
 
 class Epzip
-  MIMETYPE_FILENAME = 'mimetype'
-  
+  MIMETYPE_FILENAME = 'mimetype'.freeze
+  MIMETYPE_CONTENT  = 'application/epub+zip'.freeze
+
   def self.zip(epubdir, epubfile = nil)
-    if !File.exists? epubdir
+    unless File.exist?(epubdir)
       raise ArgumentError, "No such directory -- #{epubdir}"
     end
 
-    epubfile ||= epubdir+".epub"
-
-    Zip::ZipOutputStream.open(epubfile) do |f|
+    epubfile ||= epubdir + ".epub"
 
-      f.put_next_entry(MIMETYPE_FILENAME, nil, nil, Zip::ZipEntry::STORED)
-      f << "application/epub+zip"
-      puts MIMETYPE_FILENAME
+    Zip::OutputStream.open(epubfile) do |zos|
+      # The mimetype entry must come first and be stored uncompressed.
+      zos.put_next_entry(MIMETYPE_FILENAME, nil, nil, Zip::Entry::STORED)
+      zos << MIMETYPE_CONTENT
 
       Dir.chdir(epubdir) do
-        Dir.glob("**/*") do |dir|
-          next if dir == MIMETYPE_FILENAME
-          next if !File.file? dir
-          puts dir
-          f.put_next_entry dir
-          f << File.read(dir)
+        Dir.glob("**/*") do |path|
+          next if path == MIMETYPE_FILENAME
+          next unless File.file?(path)
+
+          zos.put_next_entry(path)
+          zos << File.binread(path)
         end
       end
     end
 
     epubfile
-    
   end
 
   def self.unzip(epubfile, epubdir = nil)
-    if epubdir
-      FileUtils.mkdir_p(epubdir)
-    else
-      epubdir = Dir.pwd
-    end
+    epubdir ||= Dir.pwd
+    FileUtils.mkdir_p(epubdir)
 
-    Zip::ZipInputStream.open(epubfile) do |f|
-      while entry = f.get_next_entry
-        next if entry.directory?
-        next if entry.name[-1] == "/"
-        sep = "/"
-        if entry.name[0] == "/"
-          sep = ""
+    root = File.expand_path(epubdir)
+
+    Zip::File.open(epubfile) do |zip|
+      zip.each do |entry|
+        next if entry.name_is_directory?
+
+        filepath = File.expand_path(File.join(epubdir, entry.name))
+        # Guard against Zip Slip: rubyzip skips its own name check when an
+        # explicit destination path is given, so reject entries that would
+        # escape the target directory.
+        unless filepath == root || filepath.start_with?(root + File::SEPARATOR)
+          raise ArgumentError, "Illegal entry name -- #{entry.name}"
         end
-        filepath = epubdir + sep + entry.name
-        dir = File.dirname(filepath)
-        FileUtils.mkdir_p(dir)
-        entry.extract(filepath)
+
+        FileUtils.mkdir_p(File.dirname(filepath))
+        entry.extract(filepath) { true }
       end
     end
 
+    epubdir
   end
-
 end

data/test/helper.rb

@@ -1,9 +1,2 @@
-require 'rubygems'
 require 'test/unit'
-
-$LOAD_PATH.unshift(File.dirname(__FILE__))
-$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
 require 'epzip'
-
-class Test::Unit::TestCase
-end

data/test/test_epzip.rb

@@ -1,4 +1,6 @@
 require 'helper'
+require 'tmpdir'
+require 'fileutils'
 
 class TestEpzip < Test::Unit::TestCase
   def test_zip_should_use_existed_dir
@@ -6,4 +8,63 @@ class TestEpzip < Test::Unit::TestCase
       Epzip.zip("unknown_dir")
     end
   end
+
+  def test_unzip_rejects_path_traversal_entry
+    Dir.mktmpdir do |base|
+      # Craft an archive with an entry that escapes the target directory.
+      evil = File.join(base, "evil.zip")
+      Zip::File.open(evil, Zip::File::CREATE) do |zip|
+        zip.get_output_stream("../escaped.txt") { |os| os.write("pwned") }
+      end
+
+      dest = File.join(base, "out")
+      assert_raise ArgumentError do
+        Epzip.unzip(evil, dest)
+      end
+      assert !File.exist?(File.join(base, "escaped.txt")), "must not write outside dest"
+    end
+  end
+
+  def test_zip_and_unzip_roundtrip
+    Dir.mktmpdir do |base|
+      src = File.join(base, "book")
+      FileUtils.mkdir_p(File.join(src, "META-INF"))
+      FileUtils.mkdir_p(File.join(src, "OEBPS"))
+      File.write(File.join(src, "META-INF", "container.xml"), "<container/>\n")
+      File.write(File.join(src, "OEBPS", "content.opf"), "<package/>\n")
+      File.binwrite(File.join(src, "OEBPS", "img.bin"), (0..255).to_a.pack("C*"))
+
+      epub = File.join(base, "out.epub")
+      assert_equal epub, Epzip.zip(src, epub)
+      assert File.exist?(epub)
+
+      dest = File.join(base, "unpacked")
+      Epzip.unzip(epub, dest)
+
+      %w[META-INF/container.xml OEBPS/content.opf OEBPS/img.bin].each do |rel|
+        assert File.exist?(File.join(dest, rel)), "#{rel} extracted"
+        assert_equal File.binread(File.join(src, rel)),
+                     File.binread(File.join(dest, rel)),
+                     "#{rel} content matches"
+      end
+    end
+  end
+
+  def test_zip_stores_mimetype_first_and_uncompressed
+    Dir.mktmpdir do |base|
+      src = File.join(base, "book")
+      FileUtils.mkdir_p(File.join(src, "OEBPS"))
+      File.write(File.join(src, "OEBPS", "content.opf"), "<package/>\n")
+
+      epub = File.join(base, "out.epub")
+      Epzip.zip(src, epub)
+
+      Zip::File.open(epub) do |zip|
+        first = zip.entries.first
+        assert_equal Epzip::MIMETYPE_FILENAME, first.name
+        assert_equal Zip::Entry::STORED, first.compression_method
+        assert_equal Epzip::MIMETYPE_CONTENT, first.get_input_stream.read
+      end
+    end
+  end
 end

metadata

@@ -1,92 +1,75 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: epzip
-version: !ruby/object:Gem::Version 
-  prerelease: false
-  segments: 
-  - 0
-  - 7
-  - 1
-  version: 0.7.1
+version: !ruby/object:Gem::Version
+  version: 0.9.0
 platform: ruby
-authors: 
+authors:
 - Masayoshi Takahashi
-autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2010-10-03 00:00:00 +09:00
-default_executable: 
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: rubyzip
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
     - - ">="
-      - !ruby/object:Gem::Version 
-        segments: 
-        - 0
-        - 9
-        - 4
-        version: 0.9.4
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :runtime
-  version_requirements: *id001
-description: epzip is EPUB packing tool. It's just only to do 'zip.'
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: epzip is an EPUB packing tool. It's just only to do 'zip.'
 email: takahashimm@gmail.com
-executables: 
+executables:
 - epunzip
 - epzip
 extensions: []
-
-extra_rdoc_files: 
-- LICENSE
-- README.rdoc
-files: 
-- .document
-- .gitignore
+extra_rdoc_files: []
+files:
+- ".github/dependabot.yml"
+- ".github/workflows/ruby.yml"
+- ".gitignore"
+- Gemfile
 - LICENSE
 - README.rdoc
 - Rakefile
-- VERSION
 - bin/epunzip
 - bin/epzip
 - epzip.gemspec
 - lib/epzip.rb
+- lib/epzip/version.rb
 - test/helper.rb
 - test/test_epzip.rb
-has_rdoc: true
-homepage: http://github.com/takahashim/epzip
-licenses: []
-
-post_install_message: 
-rdoc_options: 
-- --charset=UTF-8
-require_paths: 
+homepage: https://github.com/takahashim/epzip
+licenses:
+- MIT
+metadata: {}
+rdoc_options: []
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
   - - ">="
-    - !ruby/object:Gem::Version 
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
-  none: false
-  requirements: 
+    - !ruby/object:Gem::Version
+      version: '2.6'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
   - - ">="
-    - !ruby/object:Gem::Version 
-      segments: 
-      - 0
-      version: "0"
+    - !ruby/object:Gem::Version
+      version: '0'
 requirements: []
-
-rubyforge_project: 
-rubygems_version: 1.3.7
-signing_key: 
-specification_version: 3
+rubygems_version: 4.0.10
+specification_version: 4
 summary: simple EPUB packing tool
-test_files: 
-- test/helper.rb
-- test/test_epzip.rb
+test_files: []

data/.document

@@ -1,5 +0,0 @@
-README.rdoc
-lib/**/*.rb
-bin/*
-features/**/*.feature
-LICENSE

data/VERSION

@@ -1 +0,0 @@
-0.7.1