ndr_import 11.4.1 → 11.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 126526e53b9a41befd988c332ee181142e5917c491daa0310341e1b9ee9d9728
-  data.tar.gz: 6fa42ce8d1bff9030f13b3498cbd3c783cd73484d04246a5ed2c6c8b48e66b07
+  metadata.gz: 0f7ea78a292f3c2ee622bda06d341329c97af0dd0edd36c039ee349a08b74284
+  data.tar.gz: 1dae1db120f401a1cfb85b5d243563fd9ba26f290b313d561d4b6b3327b732b8
 SHA512:
-  metadata.gz: d2ef81755bc31b84725d3e170ca4b88de89d78b98518eaae72b6e8048ec28ab3b39f01afe2bf61bc31362573d470b576529d8fb614c8e85dffbc5b5da209c5d9
-  data.tar.gz: f12ebb30d9943a653dcd9d97706678f03702072ab2de7e673e002d70c9dc1c113e8c1886b29d3870e2d8c40510ecf1316bd9531c7ea47f4cbaf1df594c7429e8
+  metadata.gz: bb20b9455c14347bd9ce894858693f94f3c7d8d3fa2c2eac390bb948011db5ae1001513ce6654cca1ca2bdbad40cf5dbd5e6c3bb491def911893159447f7fbe9
+  data.tar.gz: 5683e42c10156785a8e58f13269250f59f90c81ca46613840e405f6f7e6c80a7f203e3ccdb4b49fef0eeb1d300394f5120464cb5d5bd193950505f6f36365281

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 ## [Unreleased]
-*no unreleased changes*
+* no unreleased changes
+
+## 11.6.0 / 2026-09-08
+### Fixed
+* `NdrImport::File::SevenZip` was extracting files one directory level too deep
+* Support rubyzip 3
+
+## 11.5.0 / 2026-06-25
+### Fixed
+* Support Rails 8.1, Ruby 4.0. Drop support for Ruby 3.2
+* Allow direct assignment of `table.table_metadata`
 
 ## 11.4.1 / 2025-11-05
 ### Fixed

data/SECURITY.md

@@ -0,0 +1,35 @@
+# Security
+
+NHS England takes security and the protection of private data extremely seriously. If you believe you have found a vulnerability or other issue which has compromised or could compromise the security of any of our systems and/or private data managed by our systems, please do not hesitate to contact us using the methods outlined below.
+
+## Table of Contents
+
+- [Security](#security)
+  - [Table of Contents](#table-of-contents)
+  - [Reporting a vulnerability](#reporting-a-vulnerability)
+    - [Email](#email)
+    - [NCSC](#ncsc)
+  - [General Security Enquiries](#general-security-enquiries)
+
+## Reporting a vulnerability
+
+Please note, email is our preferred method of receiving reports.
+
+### Email
+
+If you wish to notify us of a vulnerability via email, please include detailed information on the nature of the vulnerability and any steps required to reproduce it.
+
+You can reach us at:
+
+- [Brian.Shand@nhs.net](mailto:Brian.Shand@nhs.net)
+- [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)
+
+### NCSC
+
+You can send your report to the National Cyber Security Centre, who will assess your report and pass it on to NHS England if necessary.
+
+You can report vulnerabilities here: [https://www.ncsc.gov.uk/information/vulnerability-reporting](https://www.ncsc.gov.uk/information/vulnerability-reporting)
+
+## General Security Enquiries
+
+If you have general enquiries regarding our cybersecurity, please reach out to us at [cybersecurity@nhs.net](mailto:cybersecurity@nhs.net)

data/lib/ndr_import/file/seven_zip.rb

@@ -46,7 +46,7 @@ module NdrImport
             next unless entry.file? && basename.match(@pattern)
 
             unzipped_filename = destination.join(basename)
-            szr.extract([entry], unzipped_filename)
+            szr.extract([entry], destination)
 
             unzipped_files(unzipped_filename, &block)
           end

data/lib/ndr_import/file/xml.rb

@@ -57,8 +57,9 @@ module NdrImport
       def metadata_from_stream(xpath)
         cursor = Cursor.new(xpath, false)
 
-        # If markup isn't well-formed, try to work around it:
-        options = Nokogiri::XML::ParseOptions::RECOVER
+        # If markup isn't well-formed, try to work around it (but keep NONET,
+        # so external entities/DTDs can't trigger network requests):
+        options = Nokogiri::XML::ParseOptions::RECOVER | Nokogiri::XML::ParseOptions::NONET
         reader  = Nokogiri::XML::Reader(@stream, nil, @encoding, options)
 
         reader.each do |node|

data/lib/ndr_import/file/zip.rb

@@ -44,7 +44,11 @@ module NdrImport
           next unless entry.file? && basename.match(@pattern)
 
           unzipped_filename = destination.join(basename)
-          zipfile.extract(entry, unzipped_filename)
+          if zipfile.respond_to?(:extract_v3)
+            zipfile.extract_v3(entry, basename, destination_directory: destination)
+          else
+            zipfile.extract(entry, basename, destination_directory: destination)
+          end
 
           unzipped_files(unzipped_filename, &block)
         end

data/lib/ndr_import/helpers/file/xml_streaming.rb

@@ -183,8 +183,9 @@ module NdrImport
           # Track nesting as the cursor moves through the document:
           cursor = Cursor.new(node_xpath, pattern_match_xpath)
 
-          # If markup isn't well-formed, try to work around it:
-          options = Nokogiri::XML::ParseOptions::RECOVER
+          # If markup isn't well-formed, try to work around it (but keep NONET,
+          # so external entities/DTDs can't trigger network requests):
+          options = Nokogiri::XML::ParseOptions::RECOVER | Nokogiri::XML::ParseOptions::NONET
           reader  = Nokogiri::XML::Reader(io, nil, encoding, options)
 
           reader.each do |node|

data/lib/ndr_import/helpers/file/zip.rb

@@ -9,13 +9,13 @@ module NdrImport
 
         # Unzip the file, creating the destination directory if necessary.
         # A pattern can be provided to only extract required files.
-        def unzip_file(source, destination, pattern = //)
+        def unzip_file(source, destination, pattern = //) # rubocop:disable Metrics/MethodLength
           # SECURE TVB Mon Aug 13 14:41:05 BST 2012 : SafePath will raise exception if insecure
           # path is constructed
           # SafeFile.safepath_to_string will make sure that the arguments are from type SafePath
 
           # SECURE: BNS 2010-09-21 (for external access)
-          fail 'Not allowed in external environment' if defined?(::Rails) && ::Rails.env.external?
+          raise 'Not allowed in external environment' if defined?(::Rails) && ::Rails.env.external? # rubocop:disable Rails/UnknownEnv
 
           require 'zip'
           # TODO: Abort if destination directory already exists...
@@ -25,18 +25,21 @@ module NdrImport
             zipfile.entries.each do |entry|
               # SECURE: TPG 2010-11-1: The path is stripped from the zipfile entry when extracted
               basename = ::File.basename(entry.name)
-              zipfile.extract(entry, destination.join(basename)) if entry.file? && basename.match(pattern)
+              if entry.file? && basename.match(pattern)
+                if zipfile.respond_to?(:extract_v3)
+                  zipfile.extract_v3(entry, basename, destination_directory: destination)
+                else
+                  zipfile.extract(entry, basename, destination_directory: destination)
+                end
+              end
             end
           end
-
-        rescue ::Zip::ZipDestinationFileExistsError
+        rescue (defined?(::Zip::ZipDestinationFileExistsError) ? ::Zip::ZipDestinationFileExistsError : ::Zip::DestinationExistsError)
           # I'm going to ignore this and just overwrite the files.
-        rescue SecurityError => ex
-          raise ex
-        rescue ArgumentError => ex
-          raise ex
-        rescue => ex
-          puts ex
+        rescue ArgumentError, SecurityError => e
+          raise e
+        rescue StandardError => e
+          puts e # rubocop:disable Rails/Output
         end
       end
     end

data/lib/ndr_import/table.rb

@@ -11,9 +11,9 @@ module NdrImport
     include NdrImport::Mapper
 
     def self.all_valid_options
-      %w[canonical_name delimiter liberal_parsing filename_pattern file_password last_data_column
-         tablename_pattern header_lines footer_lines format klass columns slurp row_identifier
-         significant_mapped_fields]
+      %w[canonical_name delimiter liberal_parsing filename_pattern file_password
+         last_data_column tablename_pattern header_lines footer_lines
+         format klass columns slurp row_identifier significant_mapped_fields table_metadata]
     end
 
     def all_valid_options

data/lib/ndr_import/universal_importer_helper.rb

@@ -72,7 +72,7 @@ module NdrImport
 
     # This method does the table row yielding for the extract method, setting the notifier
     # so that we can monitor progress
-    def yield_tables_and_their_content(filename, tables, &block)
+    def yield_tables_and_their_content(filename, tables, &)
       return enum_for(:yield_tables_and_their_content, filename, tables) unless block_given?
 
       tables.each do |tablename, table_content, file_metadata|
@@ -80,7 +80,9 @@ module NdrImport
         next if mapping.nil?
 
         mapping.notifier = get_notifier(record_total(filename, table_content))
-        mapping.table_metadata = file_metadata || {}
+        # Merge file_metadata (from VCF or XML) with directly assigned table_metadata
+        # to form `table_metadata`
+        mapping.table_metadata = (mapping.table_metadata || {}).merge(file_metadata || {})
         yield(mapping, table_content)
       end
     end

data/lib/ndr_import/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 # This stores the current version of the NdrImport gem
 module NdrImport
-  VERSION = '11.4.1'
+  VERSION = '11.6.0'
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ndr_import
 version: !ruby/object:Gem::Version
-  version: 11.4.1
+  version: 11.6.0
 platform: ruby
 authors:
 - NCRS Development Team
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-11-05 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -33,7 +32,7 @@ dependencies:
         version: '7.1'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.1'
+        version: '8.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -43,7 +42,7 @@ dependencies:
         version: '7.1'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.1'
+        version: '8.2'
 - !ruby/object:Gem::Dependency
   name: ndr_support
   requirement: !ruby/object:Gem::Requirement
@@ -65,33 +64,45 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '6'
 - !ruby/object:Gem::Dependency
-  name: rubyzip
+  name: roo
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
-  name: roo
+  name: rubyzip
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: avro
   requirement: !ruby/object:Gem::Requirement
@@ -242,16 +253,22 @@ dependencies:
   name: spreadsheet
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.6
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.6
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -406,6 +423,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- SECURITY.md
 - exe/pdf_acro_form_to_yaml
 - exe/pdf_to_text
 - exe/word_to_text
@@ -464,7 +482,6 @@ homepage: https://github.com/NHSDigital/ndr_import
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -472,15 +489,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '3.2'
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: NDR Import
 test_files: []