measured 3.2.0 → 3.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d08724bae7ca2587e6ac427df7588e08fcec42dfecbd5d0fd9858560b7d1ec1f
-  data.tar.gz: aa934b2932b9df4648acbd6d65378fdd00add45840834e5ef9119bfd2e627ff9
+  metadata.gz: 1e8794e944fe077ce5f8fe1271de15dbd7aae08e9faa25870d5a2f1df2fecfe3
+  data.tar.gz: d6250b4975dbf4a2972b998cc68971b983f6ee2d45c2a22fe7839d672c951233
 SHA512:
-  metadata.gz: 5aea963586e68d4806e06d98993b2122b13fd19c79a825c035d413b908c8d30213d7fe4d23d4485b7cfdcd63c448db98150f11941bbb32d461a773e781ed5120
-  data.tar.gz: 55dd6b127ae8dcba52fca728246116a55274549bf0ee0ac31931a12393783554cb05dd5b7521714573e9d3c24350f6c88883a30a0110921e1594325660156f42
+  metadata.gz: 30590d0e624813f1cbc0bc8bbe5a397b0197e799cd36070c91eba906890cea07fbf2b1755db57fc73aea8e1ce5bbf220edd608cf27ee809afccc0d18a0abafe7
+  data.tar.gz: 4197246ef6225ab834396b9287e705d1e12878f90ed9892a372d552c566ab387cfee24b083f0a6018a4e6515d1245167db548f123521c510af1671a835373599

data/.github/dependabot.yml

@@ -11,6 +11,10 @@ registries:
     username: ${{secrets.DEPENDENCIES_GITHUB_USER}}
     password: ${{secrets.DEPENDENCIES_GITHUB_TOKEN}}
 updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
   - package-ecosystem: bundler
     directory: "/"
     schedule:

data/.github/workflows/ci.yml

@@ -26,9 +26,9 @@ jobs:
 
     name: Ruby ${{ matrix.ruby }} ${{ matrix.gemfile }}
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       - name: Set up Ruby ${{ matrix.ruby }}
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@e34163cd15f4bb403dcd72d98e295997e6a55798 # v1.238.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true

data/.github/workflows/dependabot_auto_merge.yml

@@ -8,7 +8,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.6.0
+        uses: dependabot/fetch-metadata@c9c4182bf1b97f5224aee3906fd373f6b61b4526 # v1.6.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
@@ -16,7 +16,7 @@ jobs:
         id: check_ci_failure
         continue-on-error: true
         if: ${{ steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-group == 'auto_merge' }}
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             function sleep(ms) {
@@ -62,7 +62,7 @@ jobs:
             core.setOutput("ci_state", ci_state)
       - name: Send Slack notification if auto-merge failed
         if: ${{ steps.check_ci_failure.outputs.ci_state == 'false' }}
-        uses: ruby/action-slack@v3.0.0
+        uses: ruby/action-slack@b6882ea6ef8f556f9f9af9ec1220d3f1ced74acf # v3.0.0
         with:
           payload: |
             {
@@ -77,7 +77,7 @@ jobs:
 
       - name: Approve and merge
         if: ${{ steps.check_ci_failure.outputs.ci_state == 'true' && (steps.metadata.outputs.update-type == 'version-update:semver-patch' || steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.dependency-group == 'auto_merge') }}
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             await github.rest.pulls.createReview({

data/CHANGELOG.md

@@ -1,6 +1,10 @@
 Unreleased
 -----
 
+3.2.1
+-----
+* Restrict Measured::Cache::Json initializer to valid filenames. (@caseyshop)
+
 3.2.0
 -----
 * Make the ActiveRecord validation errors have the correct type. (@alexcarruthers)

data/lib/measured/cache/json.rb

@@ -5,7 +5,8 @@ module Measured::Cache
 
     def initialize(filename)
       @filename = filename
-      @path = Pathname.new(File.join(File.dirname(__FILE__), "../../../cache", @filename)).cleanpath
+      raise ArgumentError, "Invalid cache file: #{filename}" unless %w[length.json weight.json volume.json test.json].include?(filename.to_s)
+      @path = Pathname.new(File.join(File.dirname(__FILE__), "../../../cache", filename)).cleanpath
     end
 
     def exist?

data/lib/measured/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Measured
-  VERSION = "3.2.0"
+  VERSION = "3.2.1"
 end

data/test/cache/json_test.rb

@@ -14,6 +14,24 @@ class Measured::Cache::JsonTest < ActiveSupport::TestCase
     refute_match "../", @cache.path.to_s
   end
 
+  test "#initialize accepts valid cache filenames for Measured::Measurable.subclasses, and test file" do
+    valid_files = %w[length.json weight.json volume.json test.json]
+    valid_files.each do |filename|
+      assert_nothing_raised do
+        Measured::Cache::Json.new(filename)
+      end
+    end
+  end
+
+  test "#initialize rejects invalid cache filenames" do
+    invalid_files = ["volum.json", "../volume.json", "other.txt"]
+    invalid_files.each do |filename|
+      assert_raises ArgumentError do
+        Measured::Cache::Json.new(filename)
+      end
+    end
+  end
+
   test "#exist? returns false if the file does not exist" do
     File.expects(:exist?).with(@cache.path).returns(false)
     refute_predicate @cache, :exist?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: measured
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.2.1
 platform: ruby
 authors:
 - Kevin McPhillips
@@ -9,7 +9,7 @@ authors:
 - Javier Honduvilla Coto
 bindir: bin
 cert_chain: []
-date: 2025-01-28 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -240,7 +240,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.3
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Encapsulate measurements with their units in Ruby
 test_files: