html2odt 0.3.3 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d6e392a2bb293ff1f5ddade2b2584369040903a6
-  data.tar.gz: a95aa2ca695d94b779ea9357cdc9a282871e1a52
+  metadata.gz: 17739952ee2010c4787bc33475552edf2f4a4053
+  data.tar.gz: 3e5140a764870fe43268d1089cb926315f8cfc85
 SHA512:
-  metadata.gz: 6bd769ca10d9cb05d365da4fc37dced0136b5509e94ff21e527ae50f920cb3c470cc4031e4b534856ff5d86ab96f402f6abe88f9df77da12ae07052c989f6ee0
-  data.tar.gz: 201dc464672f62141c80486f8a6984e89f56d793829936eedfe23c97b5e6eb86187bf56d2febbf0273c1eda938414a92b90c64ec59c7594e77709ed5e8634f46
+  metadata.gz: 8b2d33e402c811c8b0705e90f914e40bb5cdcecb21dadc15af0b49fdccdeeb21a3a2afb4c35be7f66f91c09155d65e7c245e3729fa99d4d9cfcf766f115c17f3
+  data.tar.gz: 1f0bbca292059d5f856c5460ad4819f7dd4ee830f28fc8e1efd301fa65d5ba050d16d03a6c229564d1a2e5234c082a66c6ad222e2a5f12142708adccf6638578

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# v0.4.0 - 2017-03-30
+
+Bump required nokogiri version
+
 # v0.3.3 - 2016-06-07
 
 Properly handle HTTP errors on remote image handling. Improved handling of top

data/README.md

@@ -160,14 +160,27 @@ file locations.
 doc = Html2Odt::Document.new
 
 doc.image_location_mapping = lambda do |src|
-  # Attention! Add protection against directory traversal attacks
-  "/var/www/mywebsite/#{src}"
+  root = "/var/www/mywebsite/public"
+  path = File.join(root, src)
+
+  # File.realpath raises Errno::ENOENT, if `path` does not exist in file system.
+  valid = File.realpath(path).starts_with?(root) rescue false
+
+  valid ? path : nil
 end
 ```
 
 Registering an `image_location_mapping` callback will deactivate the default
 behaviour of including images with `file` and `http` URLs automatically.
 
+**Attention:** Be careful! Without a `image_location_mapping` Proc, `html2odt`
+will include any local or remote image into the the resulting ODT. This may
+cause all kinds of vulnerabilities and should only be used with well known
+inputs. When registering an `image_location_mapping` callback, this default
+behaviour is deactivated, but please make sure, that your custom code, does not
+introduce [path traversal](https://en.wikipedia.org/wiki/Directory_traversal_attack)
+vulnerabilities. Following the above example code should be a good start.
+
 
 ## License
 

data/html2odt.gemspec

@@ -20,7 +20,7 @@ Gem::Specification.new do |spec|
   spec.executables   << "html2odt.rb"
 
   spec.add_dependency "dimensions", "~> 1.3.0"
-  spec.add_dependency "nokogiri", "~> 1.6.8"
+  spec.add_dependency "nokogiri", "~> 1.7.1"
   spec.add_dependency "rubyzip", "~> 1.0"
 
   spec.add_development_dependency "bundler", "~> 1.12"

data/lib/html2odt/version.rb

@@ -1,3 +1,3 @@
 module Html2Odt
-  VERSION = "0.3.3"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,111 +1,111 @@
 --- !ruby/object:Gem::Specification
 name: html2odt
 version: !ruby/object:Gem::Version
-  version: 0.3.3
+  version: 0.4.0
 platform: ruby
 authors:
 - Gregor Schmidt (Planio)
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-06-07 00:00:00.000000000 Z
+date: 2017-03-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dimensions
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: 1.3.0
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.6.8
+        version: 1.7.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.6.8
+        version: 1.7.1
 - !ruby/object:Gem::Dependency
   name: rubyzip
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.12'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.12'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '10.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '10.0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '5.0'
 - !ruby/object:Gem::Dependency
   name: fakeweb
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ~>
+    - - "~>"
       - !ruby/object:Gem::Version
         version: '1.3'
 description: html2odt generates ODT documents based on HTML fragments using xhtml2odt
@@ -117,8 +117,8 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
-- .travis.yml
+- ".gitignore"
+- ".travis.yml"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
@@ -170,17 +170,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.8
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: html2odt generates ODT documents based on HTML fragments