ndr_import 11.5.0 → 11.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c96ccb2b8ec749a6f0b14836b2ba0e9006f50016988447ffd6833471ef2386ac
-  data.tar.gz: f0602bf4c5f5df488261792843951d4c939e7e05249ea818b0ded27172047741
+  metadata.gz: 0f7ea78a292f3c2ee622bda06d341329c97af0dd0edd36c039ee349a08b74284
+  data.tar.gz: 1dae1db120f401a1cfb85b5d243563fd9ba26f290b313d561d4b6b3327b732b8
 SHA512:
-  metadata.gz: 0aa09835563161998d8d86165bb94346d71528dbf07ee4830ed19c1887466d2b955a583f8ad5e264ae1bc46c69b4025d844c422de391ce72ef942624721e6b62
-  data.tar.gz: 61c1cb4a0959cdcab990f27120493fedf45e4df3c10e243a853ed77ada29374b33cc5aa0e7ab8a1a93d125e195c1e85d7881657f896c923ef80dbcea585c4a16
+  metadata.gz: bb20b9455c14347bd9ce894858693f94f3c7d8d3fa2c2eac390bb948011db5ae1001513ce6654cca1ca2bdbad40cf5dbd5e6c3bb491def911893159447f7fbe9
+  data.tar.gz: 5683e42c10156785a8e58f13269250f59f90c81ca46613840e405f6f7e6c80a7f203e3ccdb4b49fef0eeb1d300394f5120464cb5d5bd193950505f6f36365281

data/CHANGELOG.md

@@ -1,6 +1,10 @@
 ## [Unreleased]
+* no unreleased changes
 
-*no unreleased changes*
+## 11.6.0 / 2026-09-08
+### Fixed
+* `NdrImport::File::SevenZip` was extracting files one directory level too deep
+* Support rubyzip 3
 
 ## 11.5.0 / 2026-06-25
 ### Fixed

data/lib/ndr_import/file/seven_zip.rb

@@ -46,7 +46,7 @@ module NdrImport
             next unless entry.file? && basename.match(@pattern)
 
             unzipped_filename = destination.join(basename)
-            szr.extract([entry], unzipped_filename)
+            szr.extract([entry], destination)
 
             unzipped_files(unzipped_filename, &block)
           end

data/lib/ndr_import/file/xml.rb

@@ -57,8 +57,9 @@ module NdrImport
       def metadata_from_stream(xpath)
         cursor = Cursor.new(xpath, false)
 
-        # If markup isn't well-formed, try to work around it:
-        options = Nokogiri::XML::ParseOptions::RECOVER
+        # If markup isn't well-formed, try to work around it (but keep NONET,
+        # so external entities/DTDs can't trigger network requests):
+        options = Nokogiri::XML::ParseOptions::RECOVER | Nokogiri::XML::ParseOptions::NONET
         reader  = Nokogiri::XML::Reader(@stream, nil, @encoding, options)
 
         reader.each do |node|

data/lib/ndr_import/file/zip.rb

@@ -44,7 +44,11 @@ module NdrImport
           next unless entry.file? && basename.match(@pattern)
 
           unzipped_filename = destination.join(basename)
-          zipfile.extract(entry, unzipped_filename)
+          if zipfile.respond_to?(:extract_v3)
+            zipfile.extract_v3(entry, basename, destination_directory: destination)
+          else
+            zipfile.extract(entry, basename, destination_directory: destination)
+          end
 
           unzipped_files(unzipped_filename, &block)
         end

data/lib/ndr_import/helpers/file/xml_streaming.rb

@@ -183,8 +183,9 @@ module NdrImport
           # Track nesting as the cursor moves through the document:
           cursor = Cursor.new(node_xpath, pattern_match_xpath)
 
-          # If markup isn't well-formed, try to work around it:
-          options = Nokogiri::XML::ParseOptions::RECOVER
+          # If markup isn't well-formed, try to work around it (but keep NONET,
+          # so external entities/DTDs can't trigger network requests):
+          options = Nokogiri::XML::ParseOptions::RECOVER | Nokogiri::XML::ParseOptions::NONET
           reader  = Nokogiri::XML::Reader(io, nil, encoding, options)
 
           reader.each do |node|

data/lib/ndr_import/helpers/file/zip.rb

@@ -9,13 +9,13 @@ module NdrImport
 
         # Unzip the file, creating the destination directory if necessary.
         # A pattern can be provided to only extract required files.
-        def unzip_file(source, destination, pattern = //)
+        def unzip_file(source, destination, pattern = //) # rubocop:disable Metrics/MethodLength
           # SECURE TVB Mon Aug 13 14:41:05 BST 2012 : SafePath will raise exception if insecure
           # path is constructed
           # SafeFile.safepath_to_string will make sure that the arguments are from type SafePath
 
           # SECURE: BNS 2010-09-21 (for external access)
-          fail 'Not allowed in external environment' if defined?(::Rails) && ::Rails.env.external?
+          raise 'Not allowed in external environment' if defined?(::Rails) && ::Rails.env.external? # rubocop:disable Rails/UnknownEnv
 
           require 'zip'
           # TODO: Abort if destination directory already exists...
@@ -25,18 +25,21 @@ module NdrImport
             zipfile.entries.each do |entry|
               # SECURE: TPG 2010-11-1: The path is stripped from the zipfile entry when extracted
               basename = ::File.basename(entry.name)
-              zipfile.extract(entry, destination.join(basename)) if entry.file? && basename.match(pattern)
+              if entry.file? && basename.match(pattern)
+                if zipfile.respond_to?(:extract_v3)
+                  zipfile.extract_v3(entry, basename, destination_directory: destination)
+                else
+                  zipfile.extract(entry, basename, destination_directory: destination)
+                end
+              end
             end
           end
-
-        rescue ::Zip::ZipDestinationFileExistsError
+        rescue (defined?(::Zip::ZipDestinationFileExistsError) ? ::Zip::ZipDestinationFileExistsError : ::Zip::DestinationExistsError)
           # I'm going to ignore this and just overwrite the files.
-        rescue SecurityError => ex
-          raise ex
-        rescue ArgumentError => ex
-          raise ex
-        rescue => ex
-          puts ex
+        rescue ArgumentError, SecurityError => e
+          raise e
+        rescue StandardError => e
+          puts e # rubocop:disable Rails/Output
         end
       end
     end

data/lib/ndr_import/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 # This stores the current version of the NdrImport gem
 module NdrImport
-  VERSION = '11.5.0'
+  VERSION = '11.6.0'
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ndr_import
 version: !ruby/object:Gem::Version
-  version: 11.5.0
+  version: 11.6.0
 platform: ruby
 authors:
 - NCRS Development Team
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-25 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -65,33 +64,45 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '6'
 - !ruby/object:Gem::Dependency
-  name: rubyzip
+  name: roo
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
-  name: roo
+  name: rubyzip
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: avro
   requirement: !ruby/object:Gem::Requirement
@@ -242,16 +253,22 @@ dependencies:
   name: spreadsheet
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.6
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.2.6
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1.4'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -465,7 +482,6 @@ homepage: https://github.com/NHSDigital/ndr_import
 licenses:
 - MIT
 metadata: {}
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -480,8 +496,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: NDR Import
 test_files: []