rubyzip 3.2.2 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67852d915e2ec168efb617d7577ac60196bf7433b3c2800981a14c5a43b939c5
-  data.tar.gz: '039b39e7e9e7f46e056da4d0070554eba081e26a4dd99e3dd47d76428628d29f'
+  metadata.gz: 31692c3a3abbfc979783a52acfad553e88440ef25ef3375e2e7f2355407999ef
+  data.tar.gz: 16f79be412b8048c8db41fb4a9807b6743adf390f80d2ee73580eb98cf5c7073
 SHA512:
-  metadata.gz: ba24363c26265acbd295289685d5baa4d351a913d98de67064171c35f0055f04ac34b2e6db384af248e124b12abc505bac558205eadb2975d3d4da59178b9a54
-  data.tar.gz: b654167d21076c70ea58b6a185f4be83a6ef172d208bf4f8a8928ac82aa909773b20df462870dc833b1182f669334e18fd7283e23cf4040b770faea1a49d1e6a
+  metadata.gz: 614763745e03176e441f401d739c79bd4df37483d7d3d9fd0821a8119906048f2b3ebbbd9604653e273e7c115e41176b1d3a3ea3f5199d6701cda2f9b30bb777
+  data.tar.gz: e704da45a03de72a67e108a037aac218bb397f1a625f50ca8ea6dbce842bb1a312de6679662bc4154afbb9229f4f5136f3aac981d651615dbde6c7b9a66dade7

data/Changelog.md

@@ -1,3 +1,34 @@
+# 3.4.0 (2026-06-14)
+
+- Prevent entries from being extracted outside specified directory. [#664](https://github.com/rubyzip/rubyzip/issues/664). Thanks to @connorshea for additional reporting on this.
+- Use `SecureRandom` in place of insecure `Random`.
+- Stop reading the central directory on first error.
+- Add a check on number of declared entries in a zip file. Thanks to @connorshea for reporting this.
+- Add note to README re reporting security issues privately.
+- Add lib/rubyzip.rb for Bundler auto-require. [#660](https://github.com/rubyzip/rubyzip/pull/660)
+
+Tooling/internal:
+
+- Replace the test Excel spreadsheet fixture.
+- Use `assert_silent` shorthand when expecting no output from a test.
+- Clean up CentralDirectory instance variables.
+- Add Ruby 4.0 to the Windows CI and update CI matrix in the README.
+- List ZIP docs that we store here and link to online versions. [#657](https://github.com/rubyzip/rubyzip/issues/657)
+
+# 3.3.1 (2026-05-30)
+
+- Reinstate default param for `InputStream#sysread`. [#663](https://github.com/rubyzip/rubyzip/issues/663)
+
+# 3.3.0 (2026-05-02)
+
+- Refactor `InputStream` and `AbstractInputStream`.
+ [#661](https://github.com/rubyzip/rubyzip/pull/661)
+
+Tooling/internal:
+
+- Update Actions to use checkout@v5.
+- Add Ruby4.0 to the CI matrix. [#659](https://github.com/rubyzip/rubyzip/pull/659)
+
 # 3.2.2 (2025-11-02)
 
 - Fix reading EOCDs when header signatures are in an Entry payload. [#656](https://github.com/rubyzip/rubyzip/issues/656)

data/LICENSE.md

@@ -1,6 +1,6 @@
 BSD 2-Clause License
 
-Copyright (c) 2002-2025, The Rubyzip Developers
+Copyright (c) 2002-2026, The Rubyzip Developers
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are met:

data/README.md

@@ -11,6 +11,10 @@ Rubyzip is a ruby library for reading and writing zip files.
 
 ## Important notes
 
+### Reporting security issues with this library
+
+If you think you have found a security issue with this library, please don't submit a public issue or PR. Email me directly at hainesr@gmail.com with as much information as you can provide - steps for replication are particularly helpful if you can - and we'll get it sorted ASAP. Thank you.
+
 ### Updating to version 3.0
 
 The public API of some classes has been modernized to use named parameters for optional arguments. Please check your usage of the following Rubyzip classes:
@@ -40,9 +44,12 @@ gem install rubyzip
 Or in your Gemfile:
 
 ```ruby
-gem 'rubyzip'
+gem 'rubyzip', require: 'zip' # For versions before 3.4.
+gem 'rubyzip'                 # For version 3.4 and after.
 ```
 
+From version 3.4 onwards, you can `require` either 'zip' or 'rubyzip' to use this library. Before version 3.4 you need to `require 'zip'` explicitly.
+
 ## Usage
 
 ### Basic zip archive creation
@@ -363,7 +370,19 @@ Some zip files might have an invalid date format, which will raise a warning. Yo
 Zip.warn_invalid_date = false
 ```
 
-### Size Validation
+### Validating Declared Number of Entries
+
+When reading a zip file it is potentially dangerous to trust what it tells you about how many entries it contains. A malformed zip file could claim a high number of entries in an attempt to waste internal resources, or crash the processing application.
+
+By default rubyzip will warn if the number of declared entries is impossible based on the actual size of the Central Directory headers. You can set this check to raise an error:
+
+```ruby
+Zip.validate_declared_number_of_entries = true
+```
+
+It is likely that the default behaviour for this check will be changed to raise an error in version 4.
+
+### Entry Size Validation
 
 By default (in rubyzip >= 2.0), rubyzip's `extract` method checks that an entry's reported uncompressed size is not (significantly) smaller than its actual size. This is to help you protect your application against [zip bombs](https://en.wikipedia.org/wiki/Zip_bomb). Before `extract`ing an entry, you should check that its size is in the range you expect. For example, if your application supports processing up to 100 files at once, each up to 10MiB, your zip extraction code might look like:
 
@@ -445,11 +464,12 @@ Rubyzip 2.4 is known to work on MRI 2.4 to 3.4 on Linux and Mac, and JRuby and T
 
 Please see the table below for what we think the current situation is. Note: an empty cell means "unknown", not "does not work".
 
-| OS/Ruby | 3.0 | 3.1 | 3.2 | 3.3 | 3.4 | Head | JRuby 10.0.1.0 | JRuby Head | Truffleruby 24.2.1 | Truffleruby Head |
-|---------|-----|-----|-----|-----|-----|------|---------------|------------|--------------------|------------------|
-|Ubuntu 24.04| CI | CI | CI | CI | CI | ci | CI | ci | CI | ci |
-|Mac OS 14.7.6| CI | CI | CI | CI | CI | ci | x |  | x |  |
-|Windows Server 2022| CI |  |  |  | CI&nbsp;mswin</br>CI&nbsp;ucrt |  |  |  |  |  |
+| OS/Ruby | 3.0 | 3.1 | 3.2 | 3.3 | 3.4 | 4.0 | Head | JRuby 10.0.1.0 | JRuby Head | Truffleruby 34.0.1 | Truffleruby Head |
+|---------|-----|-----|-----|-----|-----|-----|------|----------------|------------|-------------------|------------------|
+|Ubuntu 24.04| CI | CI | CI | CI | CI | CI | ci | CI | ci | CI | ci |
+|Mac OS 15.7.7| CI | x | x | CI | CI | CI | ci | x |  | x |  |
+|Windows Server 2022| CI |  |  |  |  |  |  |  |  |  |  |
+|Windows Server 2025|  |  |  | CI |  | CI | CI&nbsp;mswin</br>CI&nbsp;ucrt |  |  |  |  |
 
 Key: `CI` - tested in CI, should work; `ci` - tested in CI, might fail; `x` - known working; `o` - known failing.
 

data/lib/rubyzip.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative 'zip'

data/lib/zip/central_directory.rb

@@ -114,18 +114,20 @@ module Zip
 
     def unpack_64_e_o_c_d(buffer) # :nodoc:
       _, # ZIP64_END_OF_CD_SIG. We know we have this at this point.
-      @size_of_zip64_e_o_c_d,
-      @version_made_by,
-      @version_needed_for_extract,
-      @number_of_this_disk,
-      @number_of_disk_with_start_of_cdir,
-      @total_number_of_entries_in_cdir_on_this_disk,
+      size_of_zip64_e_o_c_d,
+      _version_made_by,
+      _version_needed_for_extract,
+      _number_of_this_disk,
+      _number_of_disk_with_start_of_cdir,
+      _total_number_of_entries_in_cdir_on_this_disk,
       @size,
-      @size_in_bytes,
+      size_in_bytes,
       @cdir_offset = buffer.unpack('VQ<vvVVQ<Q<Q<Q<')
 
+      validate_size!(@size, size_in_bytes)
+
       zip64_extensible_data_size =
-        @size_of_zip64_e_o_c_d - ZIP64_STATIC_EOCD_SIZE + 12
+        size_of_zip64_e_o_c_d - ZIP64_STATIC_EOCD_SIZE + 12
       @zip64_extensible_data = if zip64_extensible_data_size.zero?
                                  ''
                                else
@@ -145,25 +147,29 @@ module Zip
 
     # Unpack the EOCD and return a boolean indicating whether this header is
     # complete without needing Zip64 extensions.
-    def unpack_e_o_c_d(buffer) # :nodoc: # rubocop:disable Naming/PredicateMethod
+    def unpack_e_o_c_d(buffer) # :nodoc:
       _, # END_OF_CD_SIG. We know we have this at this point.
-      @number_of_this_disk,
-      @number_of_disk_with_start_of_cdir,
-      @total_number_of_entries_in_cdir_on_this_disk,
+      number_of_this_disk,
+      number_of_disk_with_start_of_cdir,
+      total_number_of_entries_in_cdir_on_this_disk,
       @size,
-      @size_in_bytes,
+      size_in_bytes,
       @cdir_offset,
       comment_length = buffer.unpack('VvvvvVVv')
 
+      complete = !([number_of_this_disk, number_of_disk_with_start_of_cdir,
+                    total_number_of_entries_in_cdir_on_this_disk, @size].any?(0xFFFF) ||
+                    size_in_bytes == 0xFFFFFFFF || @cdir_offset == 0xFFFFFFFF)
+
+      validate_size!(@size, size_in_bytes) if complete
+
       @comment = if comment_length.positive?
                    buffer.slice(STATIC_EOCD_SIZE, comment_length)
                  else
                    ''
                  end
 
-      !([@number_of_this_disk, @number_of_disk_with_start_of_cdir,
-         @total_number_of_entries_in_cdir_on_this_disk, @size].any?(0xFFFF) ||
-         @size_in_bytes == 0xFFFFFFFF || @cdir_offset == 0xFFFFFFFF)
+      complete
     end
 
     def read_central_directory_entries(io) # :nodoc:
@@ -180,7 +186,7 @@ module Zip
       @entry_set = EntrySet.new
       @size.times do
         entry = Entry.read_c_dir_entry(io)
-        next unless entry
+        break unless entry
 
         offset = if entry.zip64?
                    entry.extra[:zip64].relative_header_offset
@@ -258,6 +264,15 @@ module Zip
 
       [io.tell, io.read]
     end
+
+    def validate_size!(size, size_in_bytes)
+      return if size * CDIR_ENTRY_STATIC_HEADER_LENGTH <= size_in_bytes
+
+      error = EntryNumberMismatchError.new(size, size_in_bytes)
+      raise error if Zip.validate_declared_number_of_entries
+
+      warn error.message
+    end
   end
 end
 

data/lib/zip/crypto/decrypted_io.rb

@@ -8,13 +8,13 @@ module Zip
       @io = io
       @decrypter = decrypter
       @bytes_remaining = compressed_size
-      @buffer = +''
+      @buffer = +''.b
     end
 
-    def read(length = nil, outbuf = +'')
-      return (length.nil? || length.zero? ? '' : nil) if eof?
+    def read(maxlen = nil)
+      return (maxlen.nil? || maxlen.zero? ? '' : nil) if eof?
 
-      while length.nil? || (@buffer.bytesize < length)
+      while maxlen.nil? || (@buffer.bytesize < maxlen)
         break if input_finished?
 
         @buffer << produce_input
@@ -22,7 +22,7 @@ module Zip
 
       @decrypter.check_integrity!(@io) if input_finished?
 
-      outbuf.replace(@buffer.slice!(0...(length || @buffer.bytesize)))
+      @buffer.slice!(0...(maxlen || @buffer.bytesize))
     end
 
     private

data/lib/zip/crypto/traditional_encryption.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'securerandom'
+
 module Zip
   module TraditionalEncryption # :nodoc:
     def initialize(password)
@@ -44,7 +46,7 @@ module Zip
     def header(mtime)
       [].tap do |header|
         (header_bytesize - 2).times do
-          header << Random.rand(0..255)
+          header << SecureRandom.rand(0..255)
         end
         header << (mtime.to_binary_dos_time & 0xff)
         header << (mtime.to_binary_dos_time >> 8)

data/lib/zip/entry.rb

@@ -290,7 +290,7 @@ module Zip
       dest_dir = ::File.absolute_path(destination_directory || '.')
       extract_path = ::File.absolute_path(::File.join(dest_dir, entry_path))
 
-      unless extract_path.start_with?(dest_dir)
+      unless extract_path.start_with?(dest_dir + ::File::SEPARATOR) || dest_dir == ::File::SEPARATOR
         warn "WARNING: skipped extracting '#{@name}' to '#{extract_path}' as unsafe."
         return self
       end
@@ -751,21 +751,20 @@ module Zip
 
     def create_file(dest_path, _continue_on_exists_proc = proc { Zip.continue_on_exists_proc })
       if ::File.exist?(dest_path) && !yield(self, dest_path)
-        raise ::Zip::DestinationExistsError, dest_path
+        raise DestinationExistsError, dest_path
       end
 
       ::File.open(dest_path, 'wb') do |os|
         get_input_stream do |is|
           bytes_written = 0
           warned = false
-          buf = +''
-          while (buf = is.sysread(::Zip::Decompressor::CHUNK_SIZE, buf))
+          while (buf = is.sysread(Decompressor::CHUNK_SIZE))
             os << buf
             bytes_written += buf.bytesize
             next unless bytes_written > size && !warned
 
-            error = ::Zip::EntrySizeError.new(self)
-            raise error if ::Zip.validate_entry_sizes
+            error = EntrySizeError.new(self)
+            raise error if Zip.validate_entry_sizes
 
             warn "WARNING: #{error.message}"
             warned = true

data/lib/zip/errors.rb

@@ -109,6 +109,22 @@ module Zip
     end
   end
 
+  class EntryNumberMismatchError < Error
+    # Create a new EntryNumberMismatchError with the specified size and size in bytes.
+    def initialize(size, size_in_bytes)
+      super()
+      @size = size
+      @size_in_bytes = size_in_bytes
+    end
+
+    # The message returned by this error.
+    def message
+      "Zip consistency problem: an impossibly high number of entries (#{@size}) " \
+        'is declared in this file, compared to the size of the central directory ' \
+        "(#{@size_in_bytes} bytes)."
+    end
+  end
+
   # Error raised if a split archive is read. Rubyzip does not support reading
   # split archives.
   class SplitArchiveError < Error

data/lib/zip/inflater.rb

@@ -5,20 +5,20 @@ module Zip
     def initialize(*args)
       super
 
-      @buffer = +''
+      @buffer = +''.b
       @zlib_inflater = ::Zlib::Inflate.new(-Zlib::MAX_WBITS)
     end
 
-    def read(length = nil, outbuf = +'')
-      return (length.nil? || length.zero? ? '' : nil) if eof?
+    def read(maxlen = nil)
+      return (maxlen.nil? || maxlen.zero? ? '' : nil) if eof?
 
-      while length.nil? || (@buffer.bytesize < length)
+      while maxlen.nil? || (@buffer.bytesize < maxlen)
         break if input_finished?
 
         @buffer << produce_input
       end
 
-      outbuf.replace(@buffer.slice!(0...(length || @buffer.bytesize)))
+      @buffer.slice!(0...(maxlen || @buffer.bytesize))
     end
 
     def eof?

data/lib/zip/input_stream.rb

@@ -89,9 +89,29 @@ module Zip
       open_entry
     end
 
-    # Modeled after IO.sysread
-    def sysread(length = nil, outbuf = +'')
-      @decompressor.read(length, outbuf)
+    # Modelled after IO#sysread.
+    #
+    # Reads up to maxlen bytes from the stream; returns a string
+    # (either a new string or the given out_string).
+    # Its encoding is the unchanged encoding of out_string, if out_string is
+    # given; ASCII-8BIT, otherwise. Output contains maxlen bytes from the
+    # stream, if available; otherwise contains all available bytes, if any
+    # available; otherwise is an empty string.
+    #
+    # This method should not be used with buffered input stream-reader methods,
+    # such as #read, #readline, #gets.
+    def sysread(maxlen = nil, out_string = nil)
+      # Remove the default value for maxlen for version 4.
+      return (maxlen.nil? || maxlen.zero? ? '' : nil) if eof?
+
+      output = produce_input(maxlen)
+
+      if out_string.nil?
+        output.force_encoding(Encoding::ASCII_8BIT)
+      else
+        encoding = out_string.encoding
+        out_string.replace(output).force_encoding(encoding)
+      end
     end
 
     # Returns the size of the current entry, or `nil` if there isn't one.
@@ -197,8 +217,8 @@ module Zip
       decompressor_class.new(io, decompressed_size)
     end
 
-    def produce_input # :nodoc:
-      @decompressor.read(CHUNK_SIZE)
+    def produce_input(maxlen = CHUNK_SIZE) # :nodoc:
+      @decompressor.read(maxlen)
     end
 
     def input_finished? # :nodoc:

data/lib/zip/ioextras/abstract_input_stream.rb

@@ -3,126 +3,208 @@
 module Zip
   module IOExtras # :nodoc:
     # Implements many of the convenience methods of IO
-    # such as gets, getc, readline and readlines
+    # such as gets, getc, read, readline and readlines
     # depends on: input_finished?, produce_input and read
-    module AbstractInputStream # :nodoc:
+    module AbstractInputStream
       include Enumerable
       include FakeIO
 
-      def initialize
+      def initialize # :nodoc:
         super
         @lineno        = 0
         @pos           = 0
-        @output_buffer = +''
+        @output_buffer = +''.b
       end
 
+      # Returns (or sets) the current line number in the decompressed
+      # (possibly decrypted) data stream. See the Line Number documentation
+      # for the IO class for more information.
       attr_accessor :lineno
+
+      # Returns the current position (in bytes) in the decompressed (possibly
+      # decrypted) data stream.
       attr_reader :pos
 
-      def read(number_of_bytes = nil, buf = +'')
+      # Reads bytes from the stream decompressed (possibly decrypted) data
+      # stream. If `maxlen` is `nil`, reads all bytes; otherwise, reads up to
+      # `maxlen` bytes. If `maxlen` is zero, returns an empty string.
+      #
+      # Returns a string (either a new string or the given `out_string`)
+      # containing the bytes read. The string's encoding is the unchanged
+      # encoding of `out_string`, if `out_string` is given; `ASCII-8BIT`,
+      # otherwise.
+      def read(maxlen = nil, out_string = nil) # rubocop:disable Metrics/PerceivedComplexity
+        return (maxlen.nil? || maxlen.zero? ? '' : nil) if eof?
+
         tbuf = if @output_buffer.bytesize > 0
-                 if number_of_bytes && number_of_bytes <= @output_buffer.bytesize
-                   @output_buffer.slice!(0, number_of_bytes)
+                 if maxlen && maxlen <= @output_buffer.bytesize
+                   @output_buffer.slice!(0, maxlen)
                  else
-                   number_of_bytes -= @output_buffer.bytesize if number_of_bytes
-                   rbuf = sysread(number_of_bytes, buf)
+                   maxlen -= @output_buffer.bytesize if maxlen
+                   rbuf = produce_input(maxlen)
                    out  = @output_buffer
                    out << rbuf if rbuf
-                   @output_buffer = ''
+                   @output_buffer = +''.b
                    out
                  end
                else
-                 sysread(number_of_bytes, buf)
+                 produce_input(maxlen)
                end
 
         if tbuf.nil? || tbuf.empty?
-          return nil if number_of_bytes&.positive?
+          return nil if maxlen&.positive?
 
           return ''
         end
 
         @pos += tbuf.length
 
-        if buf
-          buf.replace(tbuf)
+        if out_string.nil?
+          tbuf.force_encoding(Encoding::ASCII_8BIT)
         else
-          buf = tbuf
+          encoding = out_string.encoding
+          out_string.replace(tbuf).force_encoding(encoding)
         end
-        buf
       end
 
-      def readlines(a_sep_string = $INPUT_RECORD_SEPARATOR)
-        ret_val = []
-        each_line(a_sep_string) { |line| ret_val << line }
-        ret_val
+      # Reads and returns all remaining lines from the stream. See the Line IO
+      # documentation in the IO class for more information.
+      #
+      # With no arguments given, returns lines as determined by line
+      # separator `$/`, or `nil` if none.
+      #
+      # With only string argument `sep` given, returns lines as
+      # determined by line separator `sep`, or `nil` if none. See the
+      # Line Separator documentation in the IO class for more information.
+      # The two special values for `sep` (`nil` and `""`) are honoured.
+      #
+      # With only integer argument `limit` given, limits the number of bytes
+      # in each line; see the Line Limit documentation in the IO class for more
+      # information.
+      #
+      # With arguments `sep` and `limit` given, combines the two behaviors.
+      #
+      # Optional keyword argument `chomp` specifies whether line separators
+      # are to be omitted.
+      def readlines(sep = $INPUT_RECORD_SEPARATOR, limit = nil, chomp: false)
+        each(sep, limit, chomp: chomp).to_a
       end
 
-      def gets(a_sep_string = $INPUT_RECORD_SEPARATOR, number_of_bytes = nil)
-        @lineno = @lineno.next
+      # Reads and returns a line from the stream. See the Line IO
+      # documentation in the IO class for more information.
+      #
+      # With no arguments given, returns the next line as determined by line
+      # separator `$/`, or `nil` if none.
+      #
+      # With only string argument `sep` given, returns the next line as
+      # determined by line separator `sep`, or `nil` if none. See the
+      # Line Separator documentation in the IO class for more information.
+      # The two special values for `sep` (`nil` and `""`) are honoured.
+      #
+      # With only integer argument `limit` given, limits the number of bytes
+      # in the line; see the Line Limit documentation in the IO class for more
+      # information.
+      #
+      # With arguments `sep` and `limit` given, combines the two behaviors.
+      #
+      # Optional keyword argument `chomp` specifies whether line separators
+      # are to be omitted.
+      def gets(sep = $INPUT_RECORD_SEPARATOR, limit = nil, chomp: false)
+        if sep.nil?
+          return nil if eof?
+
+          @lineno = @lineno.next
+          return read(limit)
+        end
 
-        if number_of_bytes.respond_to?(:to_int)
-          number_of_bytes = number_of_bytes.to_int
-          a_sep_string = a_sep_string.to_str if a_sep_string
-        elsif a_sep_string.respond_to?(:to_int)
-          number_of_bytes = a_sep_string.to_int
-          a_sep_string    = $INPUT_RECORD_SEPARATOR
-        else
-          number_of_bytes = nil
-          a_sep_string = a_sep_string.to_str if a_sep_string
+        if sep.respond_to?(:to_int)
+          limit = sep.to_int
+          sep   = $INPUT_RECORD_SEPARATOR
+        elsif sep&.empty?
+          sep = "#{$INPUT_RECORD_SEPARATOR}#{$INPUT_RECORD_SEPARATOR}"
         end
 
-        return read(number_of_bytes) if a_sep_string.nil?
+        buffer_index = 0
+        while (sep_index = @output_buffer.index(sep, buffer_index)).nil?
+          break if limit && @output_buffer.bytesize >= limit
 
-        a_sep_string = "#{$INPUT_RECORD_SEPARATOR}#{$INPUT_RECORD_SEPARATOR}" if a_sep_string.empty?
+          if input_finished?
+            return nil if @output_buffer.empty?
 
-        buffer_index = 0
-        over_limit   = number_of_bytes && @output_buffer.bytesize >= number_of_bytes
-        while (match_index = @output_buffer.index(a_sep_string, buffer_index)).nil? && !over_limit
-          buffer_index = [buffer_index, @output_buffer.bytesize - a_sep_string.bytesize].max
-          return @output_buffer.empty? ? nil : flush if input_finished?
+            @lineno = @lineno.next
+            @pos += @output_buffer.bytesize
+            return @output_buffer.slice!(0..)
+          end
 
+          buffer_index = [buffer_index, @output_buffer.bytesize - sep.bytesize].max
           @output_buffer << produce_input
-          over_limit = number_of_bytes && @output_buffer.bytesize >= number_of_bytes
         end
-        sep_index = [
-          match_index + a_sep_string.bytesize,
-          number_of_bytes || @output_buffer.bytesize
-        ].min
-        @pos += sep_index
-        @output_buffer.slice!(0...sep_index)
+
+        limit ||= @output_buffer.bytesize
+        cut_index = sep_index ? [sep_index + sep.bytesize, limit].min : limit
+        @lineno = @lineno.next
+        @pos += cut_index
+        chomp ? @output_buffer.slice!(0, cut_index).chomp(sep) : @output_buffer.slice!(0, cut_index)
       end
 
-      def ungetc(byte)
+      def ungetc(byte) # :nodoc:
         @output_buffer = byte.chr + @output_buffer
       end
 
-      def flush
-        ret_val        = @output_buffer
-        @output_buffer = +''
-        ret_val
+      def flush # :nodoc:
+        @output_buffer.slice!(0..)
       end
 
-      def readline(a_sep_string = $INPUT_RECORD_SEPARATOR)
-        ret_val = gets(a_sep_string)
-        raise EOFError unless ret_val
+      # Reads a line as with #gets, but raises `EOFError` if already at
+      # end-of-stream.
+      #
+      # Optional keyword argument `chomp` specifies whether line separators
+      # are to be omitted.
+      def readline(sep = $INPUT_RECORD_SEPARATOR, limit = nil, chomp: false)
+        raise EOFError if eof?
 
-        ret_val
+        gets(sep, limit, chomp: chomp)
       end
 
-      def each_line(a_sep_string = $INPUT_RECORD_SEPARATOR)
-        loop { yield readline(a_sep_string) }
-      rescue EOFError
-        # We just need to catch this; we don't need to handle it.
+      # Calls the block with each remaining line read from the stream.
+      # Does nothing if already at end-of-stream. See the Line IO
+      # documentation in the IO class for more information.
+      #
+      # With no arguments given, reads lines as determined by line separator
+      # `$/`. With only string argument `sep` given, reads lines as determined
+      # by line separator `sep`. See the Line Separator documentation in the
+      # IO class for more information. The two special values for `sep`
+      # (`nil` and `""`) are honoured.
+      #
+      # With only integer argument `limit` given, limits the number of bytes
+      # in each line; see the Line Limit documentation in the IO class for
+      # more information.
+      #
+      # With arguments `sep` and `limit` given, combines the two behaviors.
+      #
+      # Optional keyword argument `chomp` specifies whether line separators
+      # are to be omitted.
+      #
+      # Returns an `Enumerator` if no block is given.
+      def each(sep = $INPUT_RECORD_SEPARATOR, limit = nil, chomp: false)
+        return to_enum(:each, sep, limit, chomp: chomp) unless block_given?
+
+        while (line = gets(sep, limit, chomp: chomp))
+          yield line
+        end
       end
 
-      alias each each_line
+      alias each_line each
 
+      # Returns `true` if the stream is positioned at its end, `false`
+      # otherwise. See Position documentation in the IO class for more
+      # information.
       def eof?
         @output_buffer.empty? && input_finished?
       end
 
       # Alias for compatibility. Remove for version 4.
-      alias eof eof?
+      alias eof eof? # :nodoc:
     end
   end
 end

data/lib/zip/pass_thru_decompressor.rb

@@ -7,15 +7,15 @@ module Zip
       @read_so_far = 0
     end
 
-    def read(length = nil, outbuf = +'')
-      return (length.nil? || length.zero? ? '' : nil) if eof?
+    def read(maxlen = nil)
+      return (maxlen.nil? || maxlen.zero? ? '' : nil) if eof?
 
-      if length.nil? || (@read_so_far + length) > decompressed_size
-        length = decompressed_size - @read_so_far
+      if maxlen.nil? || (@read_so_far + maxlen) > decompressed_size
+        maxlen = decompressed_size - @read_so_far
       end
 
-      @read_so_far += length
-      input_stream.read(length, outbuf)
+      @read_so_far += maxlen
+      input_stream.read(maxlen)
     end
 
     def eof?

data/lib/zip/version.rb

@@ -2,5 +2,5 @@
 
 module Zip
   # The version of the Rubyzip library.
-  VERSION = '3.2.2'
+  VERSION = '3.4.0'
 end

data/lib/zip.rb

@@ -54,7 +54,8 @@ module Zip
                 :warn_invalid_date,
                 :case_insensitive_match,
                 :force_entry_names_encoding,
-                :validate_entry_sizes
+                :validate_entry_sizes,
+                :validate_declared_number_of_entries
 
   DEFAULT_RESTORE_OPTIONS = {
     restore_ownership:   false,
@@ -78,6 +79,7 @@ module Zip
     @case_insensitive_match = false
     @force_entry_names_encoding = nil
     @validate_entry_sizes = true
+    @validate_declared_number_of_entries = false # Set this to `true` in v4.0.0?
   end
 
   # Set options for RubyZip in one block.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubyzip
 version: !ruby/object:Gem::Version
-  version: 3.2.2
+  version: 3.4.0
 platform: ruby
 authors:
 - Robert Haines
@@ -135,6 +135,7 @@ files:
 - LICENSE.md
 - README.md
 - Rakefile
+- lib/rubyzip.rb
 - lib/zip.rb
 - lib/zip/central_directory.rb
 - lib/zip/compressor.rb
@@ -195,9 +196,9 @@ licenses:
 - BSD-2-Clause
 metadata:
   bug_tracker_uri: https://github.com/rubyzip/rubyzip/issues
-  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.2.2/Changelog.md
-  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.2.2
-  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.2.2
+  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.4.0/Changelog.md
+  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.4.0
+  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.4.0
   wiki_uri: https://github.com/rubyzip/rubyzip/wiki
   rubygems_mfa_required: 'true'
 rdoc_options: []