files.com 1.1.781 → 1.1.782

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ffd672a0d5481d8fa675628cf4b80f3c0859da27de244e1cf8749ddfa066984c
-  data.tar.gz: cdc1c6102a5beb1917888f7fd1885f2d67b9832b0f50003237b9860638fd367d
+  metadata.gz: ddcd318206fe185a4e00ccbfb7d6d2d4655a1f7810800a341bbfbe5132d17a17
+  data.tar.gz: 65523517081a2759ad980a8cf43198e49bbb684609ba5d4512adda9ead3cf78b
 SHA512:
-  metadata.gz: a812771f0ed9ff2822e31c65636de9dd02440aae18a25e1656ea0cede8d041d47d9324be207572db8d2473b4a3ac19ac85859f52d2aa2572decafea24dc2ba0a
-  data.tar.gz: a98a193201652c9a732ad86931528eca0410b1f5a4d32400ec12b751c5acea784cc8ea0e4b6e7811e6bd087056c04df530fc2847de78cb88bd99082d9b6a81e5
+  metadata.gz: 84dabf3483704390c691c4e2cb5b0ba75d7c12ef96e0a0559512cb7ebc674d8cf43813a720df47b7e8b4a3b9518ed0d3bace0f3ffc23fa95acf8e8f5dbcd2617
+  data.tar.gz: 2873fd9698c3b0395217b4463d5613d39b6c42f7c70e0b0cbf29dec4d337095906494feadd85c04ec2a0735f381d248b0ff56a2ce57f6efac30acba0f35e3d1f

data/_VERSION

@@ -1 +1 @@
-1.1.781
+1.1.782

data/lib/files.com/models/file.rb

@@ -5,6 +5,13 @@ module Files
     attr_reader :options, :attributes
     attr_reader :mode
 
+    WINDOWS_DEVICE_NAMES = [
+      "CON", "PRN", "AUX", "NUL", "CONIN$", "CONOUT$",
+      "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "COM\u00b9", "COM\u00b2", "COM\u00b3",
+      "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9", "LPT\u00b9", "LPT\u00b2", "LPT\u00b3"
+    ].freeze
+    private_constant :WINDOWS_DEVICE_NAMES
+
     def self.binread(name, *args)
       new(name).read(*args)
     end
@@ -41,12 +48,24 @@ module Files
     private_class_method def self.default_local_path(path)
       name = PathUtil.normalize(path).split("/").last.to_s
       # On Windows a colon makes the name a drive-relative path or an NTFS
-      # stream, which can write outside the working directory or onto another file.
-      raise InvalidParameterError.new("Bad parameter: local_path is required because #{name.inspect} is not a valid local file name") if Gem.win_platform? && name.include?(":")
+      # stream, which can write outside the working directory or onto another
+      # file, and a device name such as NUL writes to the device instead of a file.
+      raise InvalidParameterError.new("Bad parameter: local_path is required because #{name.inspect} is not a valid local file name") if Gem.win_platform? && (name.include?(":") || windows_device_name?(name))
 
       name
     end
 
+    # A bare device name is always a device. Anything after it, such as the
+    # extension in NUL.txt, makes it a device on some Windows versions and a
+    # file on others, so Windows decides those names: it resolves a device to
+    # a //./ path.
+    private_class_method def self.windows_device_name?(name)
+      base = name.split(".", 2).first.to_s.sub(/ +\z/, "")
+      return false unless WINDOWS_DEVICE_NAMES.include?(base.upcase)
+
+      base == name || ::File.absolute_path(name).start_with?("//./")
+    end
+
     private_class_method def self.underscore_destination_path(root, id, relative_path = nil)
       PathUtil.normalize("_", root, id.to_s, relative_path)
     end

data/lib/files.com/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Files
-  VERSION = "1.1.781"
+  VERSION = "1.1.782"
 end

data/spec/models/file_download_default_path_spec.rb

@@ -11,10 +11,10 @@ RSpec.describe Files::File do
       described_class.download_file("folder/report:2026.txt")
     end
 
-    it "refuses a drive or stream name on Windows" do
+    it "refuses a drive, stream, or device name on Windows" do
       allow(Gem).to receive(:win_platform?).and_return(true)
 
-      [ "folder/C:victim.txt", "C:victim.txt", "folder/victim.txt::$DATA" ].each do |remote_path|
+      [ "folder/C:victim.txt", "C:victim.txt", "folder/victim.txt::$DATA", "folder/NUL", "folder/con", "COM1", "folder/CONIN$" ].each do |remote_path|
         expect { described_class.download_file(remote_path) }.to raise_error(Files::InvalidParameterError)
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: files.com
 version: !ruby/object:Gem::Version
-  version: 1.1.781
+  version: 1.1.782
 platform: ruby
 authors:
 - files.com