rubyzip 1.2.4 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 971ff85e75ec367c6d983a2c5fdcb24f8c5d1a4a450068b6b925a2df735cd1aa
-  data.tar.gz: 665b1e4f89f765cd9138222b08ac7759ee8e3ad4ad6e7c68171f2afb523b2f9f
+  metadata.gz: 4e2be8aa3dea85f1e99fa26b5b2530ede874228f35379181d5219eb3864a0e33
+  data.tar.gz: '0985b8cd0b421a0bdf83953ba907ddad52d236948a81a242f322f0f5fa2145a6'
 SHA512:
-  metadata.gz: 4322b88da024f5625fa1824c80a8ee8b07e9970baea5937b5a11004d21038a590aeb07c4beb2296d639fb67c1146f2ace736bef7faffb87afcc065538df37afb
-  data.tar.gz: 77ba210a9a4d66b35fa43a75ac72126c0df5fb65d04e79c50e2168698aeae66a8cf19c27fb86ccb39a6670a3e079bda953c22fd9917ed7a7b0f33c83753e3107
+  metadata.gz: c870bef8352ddb4e706a847f66da596fe556938d1b1422c3541f8ab24aa10bbdb6be577cd031853459101e24a4290aa816436834d1cae66dd26238b451f41d15
+  data.tar.gz: bb5c8ca7d286346bfad64a6e1bd637cb8a40a99974bc62fbd76ea1a5ee139d16dcf52a8480cc219e48e311d84046feafab2c497cfbeb0721940a06a5c7a163a2

data/README.md

@@ -20,7 +20,7 @@ gem 'zip-zip' # will load compatibility for old rubyzip API.
 
 ## Requirements
 
-- Ruby 1.9.2 or greater
+- Ruby 2.4 or greater (for rubyzip 2.0; use 1.x for older rubies)
 
 ## Installation
 
@@ -152,12 +152,15 @@ When modifying a zip archive the file permissions of the archive are preserved.
 ### Reading a Zip file
 
 ```ruby
+MAX_SIZE = 1024**2 # 1MiB (but of course you can increase this)
 Zip::File.open('foo.zip') do |zip_file|
   # Handle entries one by one
   zip_file.each do |entry|
-    # Extract to file/directory/symlink
     puts "Extracting #{entry.name}"
-    entry.extract(dest_file)
+    raise 'File too large when extracted' if entry.size > MAX_SIZE
+
+    # Extract to file or directory based on name in the archive
+    entry.extract
 
     # Read into memory
     content = entry.get_input_stream.read
@@ -165,6 +168,7 @@ Zip::File.open('foo.zip') do |zip_file|
 
   # Find specific entry
   entry = zip_file.glob('*.csv').first
+  raise 'File too large when extracted' if entry.size > MAX_SIZE
   puts entry.get_input_stream.read
 end
 ```
@@ -219,6 +223,8 @@ File.open(new_path, "wb") {|f| f.write(buffer.string) }
 
 ## Configuration
 
+### Existing Files
+
 By default, rubyzip will not overwrite files if they already exist inside of the extracted path. To change this behavior, you may specify a configuration option like so:
 
 ```ruby
@@ -233,18 +239,57 @@ Additionally, if you want to configure rubyzip to overwrite existing files while
 Zip.continue_on_exists_proc = true
 ```
 
+### Non-ASCII Names
+
 If you want to store non-english names and want to open them on Windows(pre 7) you need to set this option:
 
 ```ruby
 Zip.unicode_names = true
 ```
 
+Sometimes file names inside zip contain non-ASCII characters. If you can assume which encoding was used for such names and want to be able to find such entries using `find_entry` then you can force assumed encoding like so:
+
+```ruby
+Zip.force_entry_names_encoding = 'UTF-8'
+```
+
+Allowed encoding names are the same as accepted by `String#force_encoding`
+
+### Date Validation
+
 Some zip files might have an invalid date format, which will raise a warning. You can hide this warning with the following setting:
 
 ```ruby
 Zip.warn_invalid_date = false
 ```
 
+### Size Validation
+
+By default (in rubyzip >= 2.0), rubyzip's `extract` method checks that an entry's reported uncompressed size is not (significantly) smaller than its actual size. This is to help you protect your application against [zip bombs](https://en.wikipedia.org/wiki/Zip_bomb). Before `extract`ing an entry, you should check that its size is in the range you expect. For example, if your application supports processing up to 100 files at once, each up to 10MiB, your zip extraction code might look like:
+
+```ruby
+MAX_FILE_SIZE = 10 * 1024**2 # 10MiB
+MAX_FILES = 100
+Zip::File.open('foo.zip') do |zip_file|
+  num_files = 0
+  zip_file.each do |entry|
+    num_files += 1 if entry.file?
+    raise 'Too many extracted files' if num_files > MAX_FILES
+    raise 'File too large when extracted' if entry.size > MAX_FILE_SIZE
+    entry.extract
+  end
+end
+```
+
+If you need to extract zip files that report incorrect uncompressed sizes and you really trust them not too be too large, you can disable this setting with
+```ruby
+Zip.validate_entry_sizes = false
+```
+
+Note that if you use the lower level `Zip::InputStream` interface, `rubyzip` does *not* check the entry `size`s. In this case, the caller is responsible for making sure it does not read more data than expected from the input stream.
+
+### Default Compression
+
 You can set the default compression level like so:
 
 ```ruby
@@ -253,13 +298,17 @@ Zip.default_compression = Zlib::DEFAULT_COMPRESSION
 
 It defaults to `Zlib::DEFAULT_COMPRESSION`. Possible values are `Zlib::BEST_COMPRESSION`, `Zlib::DEFAULT_COMPRESSION` and `Zlib::NO_COMPRESSION`
 
-Sometimes file names inside zip contain non-ASCII characters. If you can assume which encoding was used for such names and want to be able to find such entries using `find_entry` then you can force assumed encoding like so:
+### Zip64 Support
+
+By default, Zip64 support is disabled for writing. To enable it do this:
 
 ```ruby
-Zip.force_entry_names_encoding = 'UTF-8'
+Zip.write_zip64_support = true
 ```
 
-Allowed encoding names are the same as accepted by `String#force_encoding`
+_NOTE_: If you will enable Zip64 writing then you will need zip extractor with Zip64 support to extract archive.
+
+### Block Form
 
 You can set multiple settings at the same time by using a block:
 
@@ -272,14 +321,6 @@ You can set multiple settings at the same time by using a block:
   end
 ```
 
-By default, Zip64 support is disabled for writing. To enable it do this:
-
-```ruby
-Zip.write_zip64_support = true
-```
-
-_NOTE_: If you will enable Zip64 writing then you will need zip extractor with Zip64 support to extract archive.
-
 ## Developing
 
 To run the test you need to do this:

data/lib/zip.rb

@@ -42,7 +42,8 @@ module Zip
                 :write_zip64_support,
                 :warn_invalid_date,
                 :case_insensitive_match,
-                :force_entry_names_encoding
+                :force_entry_names_encoding,
+                :validate_entry_sizes
 
   def reset!
     @_ran_once = false
@@ -54,6 +55,7 @@ module Zip
     @write_zip64_support = false
     @warn_invalid_date = true
     @case_insensitive_match = false
+    @validate_entry_sizes = true
   end
 
   def setup

data/lib/zip/entry.rb

@@ -603,9 +603,21 @@ module Zip
         get_input_stream do |is|
           set_extra_attributes_on_path(dest_path)
 
+          bytes_written = 0
+          warned = false
           buf = ''.dup
           while (buf = is.sysread(::Zip::Decompressor::CHUNK_SIZE, buf))
             os << buf
+            bytes_written += buf.bytesize
+            if bytes_written > size && !warned
+              message = "Entry #{name} should be #{size}B but is larger when inflated"
+              if ::Zip.validate_entry_sizes
+                raise ::Zip::EntrySizeError, message
+              else
+                puts "WARNING: #{message}"
+                warned = true
+              end
+            end
           end
         end
       end

data/lib/zip/errors.rb

@@ -4,6 +4,7 @@ module Zip
   class DestinationFileExistsError < Error; end
   class CompressionMethodError < Error; end
   class EntryNameError < Error; end
+  class EntrySizeError < Error; end
   class InternalError < Error; end
   class GPFBit3Error < Error; end
 

data/lib/zip/file.rb

@@ -287,6 +287,13 @@ module Zip
       @entry_set << new_entry
     end
 
+    # Convenience method for adding the contents of a file to the archive
+    # in Stored format (uncompressed)
+    def add_stored(entry, src_path, &continue_on_exists_proc)
+      entry = ::Zip::Entry.new(@name, entry.to_s, nil, nil, nil, nil, ::Zip::Entry::STORED)
+      add(entry, src_path, &continue_on_exists_proc)
+    end
+
     # Removes the specified entry.
     def remove(entry)
       @entry_set.delete(get_entry(entry))

data/lib/zip/version.rb

@@ -1,3 +1,3 @@
 module Zip
-  VERSION = '1.2.4'
+  VERSION = '2.0.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubyzip
 version: !ruby/object:Gem::Version
-  version: 1.2.4
+  version: 2.0.0
 platform: ruby
 authors:
 - Alexander Simonov
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-09-06 00:00:00.000000000 Z
+date: 2019-09-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -134,84 +134,15 @@ files:
 - samples/qtzip.rb
 - samples/write_simple.rb
 - samples/zipfind.rb
-- test/basic_zip_file_test.rb
-- test/case_sensitivity_test.rb
-- test/central_directory_entry_test.rb
-- test/central_directory_test.rb
-- test/crypto/null_encryption_test.rb
-- test/crypto/traditional_encryption_test.rb
-- test/data/WarnInvalidDate.zip
-- test/data/file1.txt
-- test/data/file1.txt.deflatedData
-- test/data/file2.txt
-- test/data/globTest.zip
-- test/data/globTest/foo.txt
-- test/data/globTest/foo/bar/baz/foo.txt
-- test/data/globTest/food.txt
-- test/data/gpbit3stored.zip
-- test/data/mimetype
-- test/data/notzippedruby.rb
-- test/data/ntfs.zip
-- test/data/oddExtraField.zip
-- test/data/path_traversal/Makefile
-- test/data/path_traversal/jwilk/README.md
-- test/data/path_traversal/jwilk/absolute1.zip
-- test/data/path_traversal/jwilk/absolute2.zip
-- test/data/path_traversal/jwilk/dirsymlink.zip
-- test/data/path_traversal/jwilk/dirsymlink2a.zip
-- test/data/path_traversal/jwilk/dirsymlink2b.zip
-- test/data/path_traversal/jwilk/relative0.zip
-- test/data/path_traversal/jwilk/relative2.zip
-- test/data/path_traversal/jwilk/symlink.zip
-- test/data/path_traversal/relative1.zip
-- test/data/path_traversal/tilde.zip
-- test/data/path_traversal/tuzovakaoff/README.md
-- test/data/path_traversal/tuzovakaoff/absolutepath.zip
-- test/data/path_traversal/tuzovakaoff/symlink.zip
-- test/data/rubycode.zip
-- test/data/rubycode2.zip
-- test/data/test.xls
-- test/data/testDirectory.bin
-- test/data/zip64-sample.zip
-- test/data/zipWithDirs.zip
-- test/data/zipWithEncryption.zip
-- test/deflater_test.rb
-- test/encryption_test.rb
-- test/entry_set_test.rb
-- test/entry_test.rb
-- test/errors_test.rb
-- test/extra_field_test.rb
-- test/file_extract_directory_test.rb
-- test/file_extract_test.rb
-- test/file_permissions_test.rb
-- test/file_split_test.rb
-- test/file_test.rb
-- test/filesystem/dir_iterator_test.rb
-- test/filesystem/directory_test.rb
-- test/filesystem/file_mutating_test.rb
-- test/filesystem/file_nonmutating_test.rb
-- test/filesystem/file_stat_test.rb
-- test/gentestfiles.rb
-- test/inflater_test.rb
-- test/input_stream_test.rb
-- test/ioextras/abstract_input_stream_test.rb
-- test/ioextras/abstract_output_stream_test.rb
-- test/ioextras/fake_io_test.rb
-- test/local_entry_test.rb
-- test/output_stream_test.rb
-- test/pass_thru_compressor_test.rb
-- test/pass_thru_decompressor_test.rb
-- test/path_traversal_test.rb
-- test/samples/example_recursive_test.rb
-- test/settings_test.rb
-- test/test_helper.rb
-- test/unicode_file_names_and_comments_test.rb
-- test/zip64_full_test.rb
-- test/zip64_support_test.rb
 homepage: http://github.com/rubyzip/rubyzip
 licenses:
 - BSD 2-Clause
-metadata: {}
+metadata:
+  bug_tracker_uri: https://github.com/rubyzip/rubyzip/issues
+  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v2.0.0/Changelog.md
+  documentation_uri: https://www.rubydoc.info/gems/rubyzip/2.0.0
+  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v2.0.0
+  wiki_uri: https://github.com/rubyzip/rubyzip/wiki
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -220,7 +151,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 1.9.2
+      version: '2.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
@@ -231,78 +162,4 @@ rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: rubyzip is a ruby module for reading and writing zip files
-test_files:
-- test/file_permissions_test.rb
-- test/path_traversal_test.rb
-- test/ioextras/abstract_input_stream_test.rb
-- test/ioextras/fake_io_test.rb
-- test/ioextras/abstract_output_stream_test.rb
-- test/central_directory_test.rb
-- test/central_directory_entry_test.rb
-- test/crypto/traditional_encryption_test.rb
-- test/crypto/null_encryption_test.rb
-- test/input_stream_test.rb
-- test/file_extract_directory_test.rb
-- test/basic_zip_file_test.rb
-- test/inflater_test.rb
-- test/file_extract_test.rb
-- test/pass_thru_compressor_test.rb
-- test/filesystem/file_nonmutating_test.rb
-- test/filesystem/file_stat_test.rb
-- test/filesystem/file_mutating_test.rb
-- test/filesystem/dir_iterator_test.rb
-- test/filesystem/directory_test.rb
-- test/extra_field_test.rb
-- test/zip64_support_test.rb
-- test/local_entry_test.rb
-- test/samples/example_recursive_test.rb
-- test/entry_test.rb
-- test/case_sensitivity_test.rb
-- test/zip64_full_test.rb
-- test/pass_thru_decompressor_test.rb
-- test/settings_test.rb
-- test/gentestfiles.rb
-- test/encryption_test.rb
-- test/file_test.rb
-- test/deflater_test.rb
-- test/test_helper.rb
-- test/errors_test.rb
-- test/file_split_test.rb
-- test/data/file2.txt
-- test/data/testDirectory.bin
-- test/data/globTest/foo.txt
-- test/data/globTest/foo/bar/baz/foo.txt
-- test/data/globTest/food.txt
-- test/data/file1.txt
-- test/data/rubycode.zip
-- test/data/WarnInvalidDate.zip
-- test/data/zipWithDirs.zip
-- test/data/rubycode2.zip
-- test/data/mimetype
-- test/data/zipWithEncryption.zip
-- test/data/path_traversal/tilde.zip
-- test/data/path_traversal/Makefile
-- test/data/path_traversal/relative1.zip
-- test/data/path_traversal/jwilk/dirsymlink.zip
-- test/data/path_traversal/jwilk/symlink.zip
-- test/data/path_traversal/jwilk/README.md
-- test/data/path_traversal/jwilk/relative2.zip
-- test/data/path_traversal/jwilk/relative0.zip
-- test/data/path_traversal/jwilk/absolute2.zip
-- test/data/path_traversal/jwilk/dirsymlink2b.zip
-- test/data/path_traversal/jwilk/absolute1.zip
-- test/data/path_traversal/jwilk/dirsymlink2a.zip
-- test/data/path_traversal/tuzovakaoff/symlink.zip
-- test/data/path_traversal/tuzovakaoff/README.md
-- test/data/path_traversal/tuzovakaoff/absolutepath.zip
-- test/data/oddExtraField.zip
-- test/data/gpbit3stored.zip
-- test/data/ntfs.zip
-- test/data/notzippedruby.rb
-- test/data/globTest.zip
-- test/data/file1.txt.deflatedData
-- test/data/test.xls
-- test/data/zip64-sample.zip
-- test/unicode_file_names_and_comments_test.rb
-- test/entry_set_test.rb
-- test/output_stream_test.rb
+test_files: []

data/test/basic_zip_file_test.rb

@@ -1,60 +0,0 @@
-require 'test_helper'
-
-class BasicZipFileTest < MiniTest::Test
-  include AssertEntry
-
-  def setup
-    @zip_file = ::Zip::File.new(TestZipFile::TEST_ZIP2.zip_name)
-    @testEntryNameIndex = 0
-  end
-
-  def test_entries
-    assert_equal(TestZipFile::TEST_ZIP2.entry_names.sort,
-                 @zip_file.entries.entries.sort.map { |e| e.name })
-  end
-
-  def test_each
-    count = 0
-    visited = {}
-    @zip_file.each do |entry|
-      assert(TestZipFile::TEST_ZIP2.entry_names.include?(entry.name))
-      assert(!visited.include?(entry.name))
-      visited[entry.name] = nil
-      count = count.succ
-    end
-    assert_equal(TestZipFile::TEST_ZIP2.entry_names.length, count)
-  end
-
-  def test_foreach
-    count = 0
-    visited = {}
-    ::Zip::File.foreach(TestZipFile::TEST_ZIP2.zip_name) do |entry|
-      assert(TestZipFile::TEST_ZIP2.entry_names.include?(entry.name))
-      assert(!visited.include?(entry.name))
-      visited[entry.name] = nil
-      count = count.succ
-    end
-    assert_equal(TestZipFile::TEST_ZIP2.entry_names.length, count)
-  end
-
-  def test_get_input_stream
-    count = 0
-    visited = {}
-    @zip_file.each do |entry|
-      assert_entry(entry.name, @zip_file.get_input_stream(entry), entry.name)
-      assert(!visited.include?(entry.name))
-      visited[entry.name] = nil
-      count = count.succ
-    end
-    assert_equal(TestZipFile::TEST_ZIP2.entry_names.length, count)
-  end
-
-  def test_get_input_stream_block
-    fileAndEntryName = @zip_file.entries.first.name
-    @zip_file.get_input_stream(fileAndEntryName) do |zis|
-      assert_entry_contents_for_stream(fileAndEntryName,
-                                       zis,
-                                       fileAndEntryName)
-    end
-  end
-end