rubyzip 3.3.1 → 3.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05f84643ff59429233f25e059dc64a55006ef51a7ff77163993fa03fa5bd0fb3
-  data.tar.gz: 182f12bf76a7bf64bb589d002195bb64a00ef0309aaa415670182c59db05b8f5
+  metadata.gz: 31692c3a3abbfc979783a52acfad553e88440ef25ef3375e2e7f2355407999ef
+  data.tar.gz: 16f79be412b8048c8db41fb4a9807b6743adf390f80d2ee73580eb98cf5c7073
 SHA512:
-  metadata.gz: b6bbacb2a7f5be8886a00f6a0a29bf8777ab82f1002912bcbe9b80e5405ab54d6cf6434d26c6472a041542f90938317d62249d0a9a9b151d908f8c45d421a298
-  data.tar.gz: 90575f372b006b74d1f437b9950b48888a011f89d8110e231a225952d558e88fe4f5f1a84953f95b8caf6009c83325b4d0e8c40cdd8fc4c36b1df1b9dd1af14f
+  metadata.gz: 614763745e03176e441f401d739c79bd4df37483d7d3d9fd0821a8119906048f2b3ebbbd9604653e273e7c115e41176b1d3a3ea3f5199d6701cda2f9b30bb777
+  data.tar.gz: e704da45a03de72a67e108a037aac218bb397f1a625f50ca8ea6dbce842bb1a312de6679662bc4154afbb9229f4f5136f3aac981d651615dbde6c7b9a66dade7

data/Changelog.md

@@ -1,3 +1,20 @@
+# 3.4.0 (2026-06-14)
+
+- Prevent entries from being extracted outside specified directory. [#664](https://github.com/rubyzip/rubyzip/issues/664). Thanks to @connorshea for additional reporting on this.
+- Use `SecureRandom` in place of insecure `Random`.
+- Stop reading the central directory on first error.
+- Add a check on number of declared entries in a zip file. Thanks to @connorshea for reporting this.
+- Add note to README re reporting security issues privately.
+- Add lib/rubyzip.rb for Bundler auto-require. [#660](https://github.com/rubyzip/rubyzip/pull/660)
+
+Tooling/internal:
+
+- Replace the test Excel spreadsheet fixture.
+- Use `assert_silent` shorthand when expecting no output from a test.
+- Clean up CentralDirectory instance variables.
+- Add Ruby 4.0 to the Windows CI and update CI matrix in the README.
+- List ZIP docs that we store here and link to online versions. [#657](https://github.com/rubyzip/rubyzip/issues/657)
+
 # 3.3.1 (2026-05-30)
 
 - Reinstate default param for `InputStream#sysread`. [#663](https://github.com/rubyzip/rubyzip/issues/663)

data/README.md

@@ -11,6 +11,10 @@ Rubyzip is a ruby library for reading and writing zip files.
 
 ## Important notes
 
+### Reporting security issues with this library
+
+If you think you have found a security issue with this library, please don't submit a public issue or PR. Email me directly at hainesr@gmail.com with as much information as you can provide - steps for replication are particularly helpful if you can - and we'll get it sorted ASAP. Thank you.
+
 ### Updating to version 3.0
 
 The public API of some classes has been modernized to use named parameters for optional arguments. Please check your usage of the following Rubyzip classes:
@@ -40,9 +44,12 @@ gem install rubyzip
 Or in your Gemfile:
 
 ```ruby
-gem 'rubyzip'
+gem 'rubyzip', require: 'zip' # For versions before 3.4.
+gem 'rubyzip'                 # For version 3.4 and after.
 ```
 
+From version 3.4 onwards, you can `require` either 'zip' or 'rubyzip' to use this library. Before version 3.4 you need to `require 'zip'` explicitly.
+
 ## Usage
 
 ### Basic zip archive creation
@@ -363,7 +370,19 @@ Some zip files might have an invalid date format, which will raise a warning. Yo
 Zip.warn_invalid_date = false
 ```
 
-### Size Validation
+### Validating Declared Number of Entries
+
+When reading a zip file it is potentially dangerous to trust what it tells you about how many entries it contains. A malformed zip file could claim a high number of entries in an attempt to waste internal resources, or crash the processing application.
+
+By default rubyzip will warn if the number of declared entries is impossible based on the actual size of the Central Directory headers. You can set this check to raise an error:
+
+```ruby
+Zip.validate_declared_number_of_entries = true
+```
+
+It is likely that the default behaviour for this check will be changed to raise an error in version 4.
+
+### Entry Size Validation
 
 By default (in rubyzip >= 2.0), rubyzip's `extract` method checks that an entry's reported uncompressed size is not (significantly) smaller than its actual size. This is to help you protect your application against [zip bombs](https://en.wikipedia.org/wiki/Zip_bomb). Before `extract`ing an entry, you should check that its size is in the range you expect. For example, if your application supports processing up to 100 files at once, each up to 10MiB, your zip extraction code might look like:
 
@@ -445,11 +464,12 @@ Rubyzip 2.4 is known to work on MRI 2.4 to 3.4 on Linux and Mac, and JRuby and T
 
 Please see the table below for what we think the current situation is. Note: an empty cell means "unknown", not "does not work".
 
-| OS/Ruby | 3.0 | 3.1 | 3.2 | 3.3 | 3.4 | Head | JRuby 10.0.1.0 | JRuby Head | Truffleruby 24.2.1 | Truffleruby Head |
-|---------|-----|-----|-----|-----|-----|------|---------------|------------|--------------------|------------------|
-|Ubuntu 24.04| CI | CI | CI | CI | CI | ci | CI | ci | CI | ci |
-|Mac OS 14.7.6| CI | CI | CI | CI | CI | ci | x |  | x |  |
-|Windows Server 2022| CI |  |  |  | CI&nbsp;mswin</br>CI&nbsp;ucrt |  |  |  |  |  |
+| OS/Ruby | 3.0 | 3.1 | 3.2 | 3.3 | 3.4 | 4.0 | Head | JRuby 10.0.1.0 | JRuby Head | Truffleruby 34.0.1 | Truffleruby Head |
+|---------|-----|-----|-----|-----|-----|-----|------|----------------|------------|-------------------|------------------|
+|Ubuntu 24.04| CI | CI | CI | CI | CI | CI | ci | CI | ci | CI | ci |
+|Mac OS 15.7.7| CI | x | x | CI | CI | CI | ci | x |  | x |  |
+|Windows Server 2022| CI |  |  |  |  |  |  |  |  |  |  |
+|Windows Server 2025|  |  |  | CI |  | CI | CI&nbsp;mswin</br>CI&nbsp;ucrt |  |  |  |  |
 
 Key: `CI` - tested in CI, should work; `ci` - tested in CI, might fail; `x` - known working; `o` - known failing.
 

data/lib/rubyzip.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative 'zip'

data/lib/zip/central_directory.rb

@@ -114,18 +114,20 @@ module Zip
 
     def unpack_64_e_o_c_d(buffer) # :nodoc:
       _, # ZIP64_END_OF_CD_SIG. We know we have this at this point.
-      @size_of_zip64_e_o_c_d,
-      @version_made_by,
-      @version_needed_for_extract,
-      @number_of_this_disk,
-      @number_of_disk_with_start_of_cdir,
-      @total_number_of_entries_in_cdir_on_this_disk,
+      size_of_zip64_e_o_c_d,
+      _version_made_by,
+      _version_needed_for_extract,
+      _number_of_this_disk,
+      _number_of_disk_with_start_of_cdir,
+      _total_number_of_entries_in_cdir_on_this_disk,
       @size,
-      @size_in_bytes,
+      size_in_bytes,
       @cdir_offset = buffer.unpack('VQ<vvVVQ<Q<Q<Q<')
 
+      validate_size!(@size, size_in_bytes)
+
       zip64_extensible_data_size =
-        @size_of_zip64_e_o_c_d - ZIP64_STATIC_EOCD_SIZE + 12
+        size_of_zip64_e_o_c_d - ZIP64_STATIC_EOCD_SIZE + 12
       @zip64_extensible_data = if zip64_extensible_data_size.zero?
                                  ''
                                else
@@ -145,25 +147,29 @@ module Zip
 
     # Unpack the EOCD and return a boolean indicating whether this header is
     # complete without needing Zip64 extensions.
-    def unpack_e_o_c_d(buffer) # :nodoc: # rubocop:disable Naming/PredicateMethod
+    def unpack_e_o_c_d(buffer) # :nodoc:
       _, # END_OF_CD_SIG. We know we have this at this point.
-      @number_of_this_disk,
-      @number_of_disk_with_start_of_cdir,
-      @total_number_of_entries_in_cdir_on_this_disk,
+      number_of_this_disk,
+      number_of_disk_with_start_of_cdir,
+      total_number_of_entries_in_cdir_on_this_disk,
       @size,
-      @size_in_bytes,
+      size_in_bytes,
       @cdir_offset,
       comment_length = buffer.unpack('VvvvvVVv')
 
+      complete = !([number_of_this_disk, number_of_disk_with_start_of_cdir,
+                    total_number_of_entries_in_cdir_on_this_disk, @size].any?(0xFFFF) ||
+                    size_in_bytes == 0xFFFFFFFF || @cdir_offset == 0xFFFFFFFF)
+
+      validate_size!(@size, size_in_bytes) if complete
+
       @comment = if comment_length.positive?
                    buffer.slice(STATIC_EOCD_SIZE, comment_length)
                  else
                    ''
                  end
 
-      !([@number_of_this_disk, @number_of_disk_with_start_of_cdir,
-         @total_number_of_entries_in_cdir_on_this_disk, @size].any?(0xFFFF) ||
-         @size_in_bytes == 0xFFFFFFFF || @cdir_offset == 0xFFFFFFFF)
+      complete
     end
 
     def read_central_directory_entries(io) # :nodoc:
@@ -180,7 +186,7 @@ module Zip
       @entry_set = EntrySet.new
       @size.times do
         entry = Entry.read_c_dir_entry(io)
-        next unless entry
+        break unless entry
 
         offset = if entry.zip64?
                    entry.extra[:zip64].relative_header_offset
@@ -258,6 +264,15 @@ module Zip
 
       [io.tell, io.read]
     end
+
+    def validate_size!(size, size_in_bytes)
+      return if size * CDIR_ENTRY_STATIC_HEADER_LENGTH <= size_in_bytes
+
+      error = EntryNumberMismatchError.new(size, size_in_bytes)
+      raise error if Zip.validate_declared_number_of_entries
+
+      warn error.message
+    end
   end
 end
 

data/lib/zip/crypto/traditional_encryption.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'securerandom'
+
 module Zip
   module TraditionalEncryption # :nodoc:
     def initialize(password)
@@ -44,7 +46,7 @@ module Zip
     def header(mtime)
       [].tap do |header|
         (header_bytesize - 2).times do
-          header << Random.rand(0..255)
+          header << SecureRandom.rand(0..255)
         end
         header << (mtime.to_binary_dos_time & 0xff)
         header << (mtime.to_binary_dos_time >> 8)

data/lib/zip/entry.rb

@@ -290,7 +290,7 @@ module Zip
       dest_dir = ::File.absolute_path(destination_directory || '.')
       extract_path = ::File.absolute_path(::File.join(dest_dir, entry_path))
 
-      unless extract_path.start_with?(dest_dir)
+      unless extract_path.start_with?(dest_dir + ::File::SEPARATOR) || dest_dir == ::File::SEPARATOR
         warn "WARNING: skipped extracting '#{@name}' to '#{extract_path}' as unsafe."
         return self
       end

data/lib/zip/errors.rb

@@ -109,6 +109,22 @@ module Zip
     end
   end
 
+  class EntryNumberMismatchError < Error
+    # Create a new EntryNumberMismatchError with the specified size and size in bytes.
+    def initialize(size, size_in_bytes)
+      super()
+      @size = size
+      @size_in_bytes = size_in_bytes
+    end
+
+    # The message returned by this error.
+    def message
+      "Zip consistency problem: an impossibly high number of entries (#{@size}) " \
+        'is declared in this file, compared to the size of the central directory ' \
+        "(#{@size_in_bytes} bytes)."
+    end
+  end
+
   # Error raised if a split archive is read. Rubyzip does not support reading
   # split archives.
   class SplitArchiveError < Error

data/lib/zip/version.rb

@@ -2,5 +2,5 @@
 
 module Zip
   # The version of the Rubyzip library.
-  VERSION = '3.3.1'
+  VERSION = '3.4.0'
 end

data/lib/zip.rb

@@ -54,7 +54,8 @@ module Zip
                 :warn_invalid_date,
                 :case_insensitive_match,
                 :force_entry_names_encoding,
-                :validate_entry_sizes
+                :validate_entry_sizes,
+                :validate_declared_number_of_entries
 
   DEFAULT_RESTORE_OPTIONS = {
     restore_ownership:   false,
@@ -78,6 +79,7 @@ module Zip
     @case_insensitive_match = false
     @force_entry_names_encoding = nil
     @validate_entry_sizes = true
+    @validate_declared_number_of_entries = false # Set this to `true` in v4.0.0?
   end
 
   # Set options for RubyZip in one block.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubyzip
 version: !ruby/object:Gem::Version
-  version: 3.3.1
+  version: 3.4.0
 platform: ruby
 authors:
 - Robert Haines
@@ -135,6 +135,7 @@ files:
 - LICENSE.md
 - README.md
 - Rakefile
+- lib/rubyzip.rb
 - lib/zip.rb
 - lib/zip/central_directory.rb
 - lib/zip/compressor.rb
@@ -195,9 +196,9 @@ licenses:
 - BSD-2-Clause
 metadata:
   bug_tracker_uri: https://github.com/rubyzip/rubyzip/issues
-  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.3.1/Changelog.md
-  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.3.1
-  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.3.1
+  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.4.0/Changelog.md
+  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.4.0
+  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.4.0
   wiki_uri: https://github.com/rubyzip/rubyzip/wiki
   rubygems_mfa_required: 'true'
 rdoc_options: []