htmltoword 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: c47d1b5bc4522ff27b68ab48736b845e1879856e
-  data.tar.gz: 126c012568a4dbb529194e24c1a84ccd11690807
+SHA256:
+  metadata.gz: 0a135dbc0c341e9b4b5825c9e744d2b87be4ed5c9fd8b201c6be2a5d3aea4b2c
+  data.tar.gz: 3e915b1d35d3089492318134721f4c8107734cd5f240574a81e25fe573c18e2f
 SHA512:
-  metadata.gz: 215fce4c96862fecf5be83838ae721e7f99a3f170b23a1f04bc4cd0440fba816cef205cfd5d137f884d7be8def32054684a311f035ced6b944750837a974da25
-  data.tar.gz: 3c802b88efcb2025195b3ce210e7d5addff8c1d63894e370f886b1f0d9bff27229f56c6654f3c2d635dc160d2fb85564a91718920c4eb2a0b71c946b00cb1b41
+  metadata.gz: 46c56d29f481e8a5b0dc69631e1bd3f269af1b5886d9968cc407760967914ac66626649299288044907ac41871da1f825a18a73e1100c2509ae7e59024b2b6c5
+  data.tar.gz: f66e0e6c5e6bb0b29405ce9137850e06fc6d8385991f068e9362b8d6bf5e0963eca49fdf4449190bb256b5337b701dbbf1a3d4464bd625ef734ff79d850b6bb5

data/README.md

@@ -15,7 +15,14 @@ Or install it yourself as:
     $ gem install htmltoword
 
 
-** Note: ** Since version 0.4.0 the ```create``` method will return a string with the contents of the file. If you want to save the file please use ```create_and_save```. See the usage for more
+**Note:** Since version 0.4.0 the ```create``` method will return a string with the contents of the file. If you want to save the file please use ```create_and_save```. See the usage for more
+
+### Security warnings
+In versions `0.7.0` and `1.0.0` we introduced a security vulnerability when allowing
+the use of local images since no check to the files was done, potentially exposing 
+sensitive files in the output zipfile.
+
+Version `1.1.0` doesn't allow the use of local images but uses an insecure `open`
 
 ## Usage
 

data/lib/htmltoword/document.rb

@@ -79,7 +79,7 @@ module Htmltoword
           #stream the image files into the media folder using open-uri
             @image_files.each do |hash|
               out.put_next_entry("word/media/#{hash[:filename]}")
-              open(hash[:url], 'rb') do |f|
+              URI.open(hash[:url], 'rb') do |f|
                 out.write(f.read)
               end
             end

data/lib/htmltoword/version.rb

@@ -1,3 +1,3 @@
 module Htmltoword
-  VERSION = '1.1.0'
+  VERSION = '1.1.1'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: htmltoword
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Nicholas Frandsen, Cristina Matonte
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-24 00:00:00.000000000 Z
+date: 2019-11-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -174,8 +174,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.13
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: This simple gem allows you to create MS Word docx documents from simple html