gds-api-adapters 103.3.1 → 103.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a46ff92814cc4c552d487bf3f1601b70596a9f4382acf227d91189a0674b690f
-  data.tar.gz: a3f09b390e4a0ad83b2959dce31bd119681bec91838b694930fbd77f27677053
+  metadata.gz: 0eb796b8332cbddc0dd921c95b922f527d4da64f8b124aefaffb37e8c14cb9c3
+  data.tar.gz: 2cbed0d36be2e00a2f60d53fa6d5229f88f44352e13b6956491a0569d876c109
 SHA512:
-  metadata.gz: c17e7759aebce22b1f80171a3488db204249251830033513a6cc2255a3a6c31972c6349824319bdd495dd75b4492b22c61ca73527098e91c735c894cf8218115
-  data.tar.gz: c8770755230be1e322b17aaa8d891860da839278aff40a87e38f7de9a6d573ac0084437ceacbd3d1cb3969b79bcfabcd50cf661eaae2134d9132ea9652b7fc97
+  metadata.gz: 4aff4d846206a4a7abd063de10490c2f4965425abe2d6af9459eac8b2f10a37f516c3819e48e86e3d324da12027d050b1890f763b9cbf141b3405b34fdd240a4
+  data.tar.gz: e51536e06a6613c51f457f124cb5c01327ea5c04c506bbd287e88525f38c87bc6ca403f5ab18e0758011cad5f510d0fed9898870d56f5fdb2c1000510b112374

data/lib/gds_api/validators/base_path_validator.rb

@@ -0,0 +1,55 @@
+module GdsApi
+  module Validators
+    class BasePathValidator
+      MAX_PATH_LENGTH = 512
+
+      attr_reader :base_path
+
+      def initialize(base_path)
+        @base_path = base_path
+      end
+
+      def valid?
+        !(base_path.nil? || no_leading_slash? || too_long? || potential_path_traversal? || ends_with_a_period? || invalid_chars?)
+      end
+
+      def errors
+        return { base_path_invalid: ["must not be nil"] } if base_path.nil?
+
+        errors = []
+        errors << [:base_path_invalid, "must start with a /"] if no_leading_slash?
+        errors << [:base_path_too_long, "must not be longer than #{MAX_PATH_LENGTH} bytes"] if too_long?
+        errors << [:base_path_invalid, "must not include runs of . and or / characters, which could be penetration attempts"] if potential_path_traversal?
+        errors << [:base_path_invalid, "must not end with a ."] if ends_with_a_period?
+        errors << [:base_path_invalid, "must not include characters that are not lowercase letters, numbers, -, ., or /"] if invalid_chars?
+
+        errors.each_with_object({}) do |err, memo|
+          memo[err[0]] ||= []
+          memo[err[0]] << err[1]
+        end
+      end
+
+    private
+
+      def no_leading_slash?
+        base_path[0] != "/"
+      end
+
+      def too_long?
+        base_path.length > MAX_PATH_LENGTH
+      end
+
+      def potential_path_traversal?
+        base_path =~ /([\/.]{2,})/
+      end
+
+      def ends_with_a_period?
+        base_path[-1] == "."
+      end
+
+      def invalid_chars?
+        base_path !~ /^([\/a-z0-9.-])+$/
+      end
+    end
+  end
+end

data/lib/gds_api/version.rb

@@ -1,3 +1,3 @@
 module GdsApi
-  VERSION = "103.3.1".freeze
+  VERSION = "103.4.0".freeze
 end

data/lib/gds_api.rb

@@ -1,6 +1,7 @@
 require "addressable"
 require "plek"
 require "time"
+require "gds_api/validators/base_path_validator"
 require "gds_api/account_api"
 require "gds_api/asset_manager"
 require "gds_api/calendars"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gds-api-adapters
 version: !ruby/object:Gem::Version
-  version: 103.3.1
+  version: 103.4.0
 platform: ruby
 authors:
 - GOV.UK Dev
@@ -141,14 +141,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.19'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.19'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: minitest-around
   requirement: !ruby/object:Gem::Requirement
@@ -295,14 +295,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
@@ -386,6 +386,7 @@ files:
 - lib/gds_api/test_helpers/search.rb
 - lib/gds_api/test_helpers/support_api.rb
 - lib/gds_api/test_helpers/worldwide.rb
+- lib/gds_api/validators/base_path_validator.rb
 - lib/gds_api/version.rb
 - lib/gds_api/worldwide.rb
 - test/fixtures/finder_api/cma-case-schema.json
@@ -411,7 +412,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.17
 specification_version: 4
 summary: Adapters to work with GDS APIs
 test_files: []