shrine-zip-guard 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: '08688c20b1b8190ce44c95079e5d71a302b42f18f635876f1f8265381650e086'
+  data.tar.gz: 3c5fa541d7cfe9620b405e33ce7457ede9df3f37503583492a0e0089e7ee0f35
+SHA512:
+  metadata.gz: d5571ca6c940dc80e911a826bc4231aa6fbb712841d5038a355a4fa8ed0664caf0fa6e506e27d90e73784e77ee690f60d44e5e0904560c7a3ff1d8d8a8fa0252
+  data.tar.gz: 3228249ed0d1246cc04976fd2a7fb7b600bdfe3b20ca5ea343c8c60bda85a540ea1b42808445c2cc4b7a663e8e4908aa91ef3d579128f827f13314888bd0c1e0

data/.rspec

@@ -0,0 +1,3 @@
+--format documentation
+--color
+--require spec_helper

data/.rubocop.yml

@@ -0,0 +1,22 @@
+AllCops:
+  TargetRubyVersion: 3.1
+  NewCops: enable
+  SuggestExtensions: false
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes
+
+Naming/FileName:
+  Exclude:
+    - lib/shrine-zip-guard.rb
+
+Metrics/BlockLength:
+  Exclude:
+    - spec/**/*.rb
+    - shrine-zip-guard.gemspec
+
+Style/Documentation:
+  Enabled: false

data/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## [Unreleased]
+
+## [0.1.0] - 2026-08-06
+
+### Added
+- Initial release of `shrine-zip-guard`.
+- `Shrine::Plugins::ZipGuard.with_zip` helper for safe ZIP processing.
+- Automatic validation via `plugin :zip_guard, required_files: [...]`.
+- `EncryptedZipError` for password-protected archives.
+- `MissingFileError` for missing required files, with glob pattern support.
+- Configurable error fallback handler.
+- Default Rails error reporter integration for unexpected errors.
+- English I18n translations.

data/CODE_OF_CONDUCT.md

@@ -0,0 +1,132 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official email address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+[INSERT CONTACT METHOD].
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq][FAQ]. Translations are available at
+[https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Martin Dobrovodský
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,107 @@
+# Shrine::ZipGuard
+
+A [Shrine](https://shrinerb.com/) plugin for safe ZIP derivative processing.
+
+It catches common ZIP errors during derivative creation — password-protected
+archives and missing required files — and converts them into friendly, I18n-ready
+error messages attached to `attacher.errors`.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem "shrine-zip-guard"
+```
+
+And then execute:
+
+```bash
+bundle install
+```
+
+## Usage
+
+### Automatic validation
+
+If you only need to validate that the uploaded ZIP contains certain files, enable
+the plugin with `required_files`:
+
+```ruby
+class XmlUploader < Shrine
+  plugin :derivatives
+  plugin :zip_guard, required_files: ["**/*.xml"]
+end
+```
+
+This will automatically check that the ZIP is not password-protected and that it
+contains at least one file matching each glob pattern.
+
+### Custom processing with `with_zip`
+
+If you need to run your own logic (for example extracting files, checking
+specific paths, or adding custom error rules), use the `with_zip` helper inside
+your `Attacher.derivatives` block:
+
+```ruby
+class XmlUploader < Shrine
+  plugin :derivatives
+  plugin :zip_guard
+
+  Attacher.derivatives do |original|
+    Shrine::Plugins::ZipGuard.with_zip(original, required_files: ["**/*.xml"]) do |zip_file|
+      xmls = zip_file.glob("*.xml")
+
+      # Your custom rule — for example requiring the file to be at the root level
+      raise ZipUploadErrors::NestedFileError if xmls.empty? && zip_file.glob("**/*.xml").any?
+
+      if xmls.size == 1
+        extracted = Tempfile.new(["extracted", ".xml"], binmode: true)
+        extracted.write(xmls.first.get_input_stream.read)
+        extracted.rewind
+        { extracted_xml: extracted }
+      else
+        {}
+      end
+    end
+  end
+end
+```
+
+## Error messages
+
+All user-facing errors are translated via I18n. The gem ships with English
+defaults. Add your own translations under the `shrine.zip_guard` key:
+
+```yaml
+en:
+  shrine:
+    zip_guard:
+      password_protected: "ZIP file is password protected. Please upload an unprotected file."
+      missing_file: "Archive does not contain required file matching '%{pattern}'."
+      processing_failed: "File could not be processed. Please try again or contact support."
+```
+
+## Custom fallback for unexpected errors
+
+By default, unexpected `ZipGuard::Error` subclasses are reported to the Rails error
+reporter (if available) and a generic `processing_failed` message is added to
+`attacher.errors`. You can override this with your own handler:
+
+```ruby
+plugin :zip_guard,
+       required_files: ["**/*.xml"],
+       fallback: lambda { |error, attacher|
+         Sentry.capture_exception(error)
+         attacher.errors << "Custom processing error: #{error.message}"
+       }
+```
+
+## Supported versions
+
+- Ruby >= 3.1
+- Shrine >= 3.0, < 4.0
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](LICENSE.txt).

data/Rakefile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+require "rubocop/rake_task"
+
+RuboCop::RakeTask.new
+
+task default: %i[spec rubocop]

data/config/locales/en.yml

@@ -0,0 +1,6 @@
+en:
+  shrine:
+    zip_guard:
+      password_protected: "ZIP file is password protected. Please upload an unprotected file."
+      missing_file: "Archive does not contain required file matching '%{pattern}'."
+      processing_failed: "File could not be processed. Please try again or contact support."

data/lib/shrine/plugins/zip_guard.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "shrine"
+require "zip"
+
+class Shrine
+  module Plugins
+    module ZipGuard
+      class Error < StandardError; end
+      class EncryptedZipError < Error; end
+
+      class MissingFileError < Error
+        attr_reader :pattern
+
+        def initialize(pattern)
+          @pattern = pattern
+          super("Archive does not contain required file matching '#{pattern}'")
+        end
+      end
+
+      class << self
+        def with_zip(original, required_files: nil, &)
+          return yield(nil) unless zip?(original)
+
+          Zip::File.open(original.path) do |zip_file|
+            raise EncryptedZipError if zip_file.any?(&:encrypted?)
+
+            if required_files
+              Array(required_files).each do |pattern|
+                raise MissingFileError, pattern unless zip_file.glob(pattern).any?
+              end
+            end
+
+            yield zip_file
+          end
+        end
+
+        private
+
+        def zip?(original)
+          return false unless original.respond_to?(:path)
+
+          File.extname(original.path).downcase == ".zip"
+        end
+      end
+
+      module AttacherMethods
+        def create_derivatives(*args, **options, &)
+          super
+        rescue ZipGuard::EncryptedZipError
+          errors << I18n.t("shrine.zip_guard.password_protected")
+          {}
+        rescue ZipGuard::MissingFileError => e
+          errors << I18n.t("shrine.zip_guard.missing_file", pattern: e.pattern)
+          {}
+        rescue ZipGuard::Error => e
+          handle_zip_guard_error(e)
+          {}
+        end
+
+        private
+
+        def handle_zip_guard_error(error)
+          fallback = shrine_class.opts[:zip_guard][:fallback]
+
+          if fallback
+            fallback.call(error, self)
+          else
+            report_fallback(error)
+            errors << I18n.t("shrine.zip_guard.processing_failed")
+          end
+        end
+
+        def report_fallback(error)
+          return unless defined?(Rails) && Rails.respond_to?(:error) && Rails.error.respond_to?(:report)
+
+          Rails.error.report(error)
+        end
+      end
+
+      def self.configure(uploader, **opts)
+        uploader.opts[:zip_guard] = {
+          fallback: opts[:fallback],
+          required_files: opts[:required_files]
+        }
+
+        return unless opts[:required_files]
+
+        uploader::Attacher.derivatives do |original|
+          ZipGuard.with_zip(original, required_files: opts[:required_files]) do |_zip_file|
+            {}
+          end
+        end
+      end
+
+      def self.load_dependencies(uploader, **)
+        uploader.plugin :derivatives
+        uploader.plugin :validation
+      end
+    end
+
+    register_plugin(:zip_guard, ZipGuard)
+  end
+end

data/lib/shrine-zip-guard/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module ShrineZipGuard
+  VERSION = "0.1.0"
+end

data/lib/shrine-zip-guard.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require "shrine"
+require "i18n"
+
+require_relative "shrine-zip-guard/version"
+require_relative "shrine/plugins/zip_guard"
+
+I18n.load_path += Dir[File.expand_path("../../config/locales/*.yml", __dir__)]

metadata

@@ -0,0 +1,111 @@
+--- !ruby/object:Gem::Specification
+name: shrine-zip-guard
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Martin Dobrovodský
+autorequire:
+bindir: exe
+cert_chain: []
+date: 2026-08-06 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: i18n
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rubyzip
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+- !ruby/object:Gem::Dependency
+  name: shrine
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.0'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
+description: Shrine plugin that catches encrypted ZIPs and missing files during derivatives.
+email:
+- dobrovodsky.martin@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".rspec"
+- ".rubocop.yml"
+- CHANGELOG.md
+- CODE_OF_CONDUCT.md
+- LICENSE.txt
+- README.md
+- Rakefile
+- config/locales/en.yml
+- lib/shrine-zip-guard.rb
+- lib/shrine-zip-guard/version.rb
+- lib/shrine/plugins/zip_guard.rb
+homepage: https://github.com/MaNi4/shrine-zip-guard
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/MaNi4/shrine-zip-guard
+  changelog_uri: https://github.com/MaNi4/shrine-zip-guard/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.1.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.16
+signing_key:
+specification_version: 4
+summary: Shrine plugin for safe ZIP derivative processing
+test_files: []