image_processing 1.12.1 → 1.12.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec4b4776480756b2721185419de81f228e5ca927b4bd3077fb4c0a5dcafef15f
-  data.tar.gz: d40b8822b6a7b2b5e1bad182099f7e3b23b25d0cdd6b61b1afa3154b665e76a6
+  metadata.gz: 31d06cb35ac94ec0787b21dd2118626f3a3a96685efab0d7eb58d9079b1fbf2c
+  data.tar.gz: 8f840074b8fe9511e59f4f005d144e39c9aba4d0699a48c29ffc6cb2513ec645
 SHA512:
-  metadata.gz: 77cff245646f56f409d4c1d006d26cee819d11cc9c263b88d86bafb6e480ac691240bfa17542bf9c578891056355d53f63fefddfa1f3eb801e3ddeea20666ae3
-  data.tar.gz: bf3f39c4204d7dcbb6382596a4a8850f8c7d22fee94e8ed77a1782a58bd1f370448268bb4e74028e429ee2e7c6156613b1022f5465faf6d30ab01833751c4df9
+  metadata.gz: 1d0fb1d9363b9b85e1895d05849a5c29b2c50b8213bf9e9d6ff8c2e1391a9bf6448a4e319a4cfd747183ec741ac42d6b1b1b9629ee91d97cc4a287ec6615042c
+  data.tar.gz: dd31dd0ca012ceb35aa276c5e00efd3e9bd2c40246f9b063ea39280ea13c546373fa641518fb55ebcf0e9d00ad6020be995b8d8636c8a3939bda31c643485cef

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 1.12.2 (2022-03-01)
+
+* Prevent remote shell execution when using `#apply` with operations coming from user input (@janko)
+
 ## 1.12.1 (2020-11-06)
 
 * Fix format fallback for files ending with a dot on Ruby 2.7+ (@coding-chimp)

data/README.md

@@ -29,10 +29,18 @@ how to resize and process images.
 
 1. Install ImageMagick and/or libvips:
 
-  ```sh
+In a Mac terminal:
+  
+```sh
   $ brew install imagemagick vips
   ```
 
+ In a debian/ubuntu terminal:
+
+```sh
+  $ sudo apt install imagemagick libvips
+  ```
+
 2. Add the gem to your Gemfile:
 
   ```rb
@@ -181,10 +189,17 @@ pipeline
 
 Our test suite requires both `imagemagick` and `libvips` libraries to be installed.
 
+In a Mac terminal:
+
 ```
 $ brew install imagemagick vips
 ```
 
+In a debian/ubuntu terminal:
+```shell
+sudo apt install imagemagick libvips
+```
+
 Afterwards you can run tests with
 
 ```

data/image_processing.gemspec

@@ -23,5 +23,5 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "minitest", "~> 5.8"
   spec.add_development_dependency "minitest-hooks", ">= 1.4.2"
   spec.add_development_dependency "minispec-metadata"
-  spec.add_development_dependency "phashion" unless RUBY_ENGINE == "jruby"
+  spec.add_development_dependency "dhash-vips"
 end

data/lib/image_processing/chainable.rb

@@ -34,13 +34,13 @@ module ImageProcessing
     def apply(operations)
       operations.inject(self) do |builder, (name, argument)|
         if argument == true || argument == nil
-          builder.send(name)
+          builder.public_send(name)
         elsif argument.is_a?(Array)
-          builder.send(name, *argument)
+          builder.public_send(name, *argument)
         elsif argument.is_a?(Hash)
-          builder.send(name, **argument)
+          builder.public_send(name, **argument)
         else
-          builder.send(name, argument)
+          builder.public_send(name, argument)
         end
       end
     end
@@ -53,7 +53,9 @@ module ImageProcessing
     # Call the defined processing and get the result. Allows specifying
     # the source file and destination.
     def call(file = nil, destination: nil, **call_options)
-      options = { source: file, destination: destination }.compact
+      options = {}
+      options[:source] = file if file
+      options[:destination] = destination if destination
 
       branch(**options).call!(**call_options)
     end

data/lib/image_processing/version.rb

@@ -1,3 +1,3 @@
 module ImageProcessing
-  VERSION = "1.12.1"
+  VERSION = "1.12.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: image_processing
 version: !ruby/object:Gem::Version
-  version: 1.12.1
+  version: 1.12.2
 platform: ruby
 authors:
 - Janko Marohnić
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-11-06 00:00:00.000000000 Z
+date: 2022-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mini_magick
@@ -107,7 +107,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
-  name: phashion
+  name: dhash-vips
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -144,7 +144,7 @@ homepage: https://github.com/janko/image_processing
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -159,8 +159,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
-signing_key: 
+rubygems_version: 3.3.3
+signing_key:
 specification_version: 4
 summary: High-level wrapper for processing images for the web with ImageMagick or
   libvips.