spatial_features 3.11.1 → 3.11.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41ad7ed6a989f41b717e103a1f800a60c776ecdf772d3be54dd65128ac84882c
-  data.tar.gz: 6b741f6c962678db2edf963fdd53a87756c657476159f882af36a0bbb1685798
+  metadata.gz: 0d90a3143573947c3e70f74845fbd475dcddbd871df0baff29dd028d236c9833
+  data.tar.gz: 37bf93eb6f87120a85f2e028efe77debb91772cc3cd77289f75e59deb5d5ab4e
 SHA512:
-  metadata.gz: da7049b48402b343a62045dd9910c334240ebfc9d02f0738c5896d3a0033330b4293badfa5e39b9837c34204d3fb221116a79810a812ffa41b3cbf05c0784367
-  data.tar.gz: 5bf14c630adc5bf960a106e0d1ae17b4490770e62dadbcce24dfeaf0cc711ac0e77ef218266d764744a847e66e7bcd0a22cb81e153c7cf2cba1d176d2a3dc266
+  metadata.gz: 0fa27a478c51fccc0a7c97ecfe5214faeea64e930b8ab0643cddc2fd4e3d2570905503308c6c2f0b1c54b5384054d774e82d48a3df6044fad135ff4688f5c9ea
+  data.tar.gz: e07a9760f62c00fd47dbb350b4b669b067ca4a98cb8c836d7fa8d7deb0432bd6836ae1d647ee025bcf5b494d9b4dbb189174be9cfa6f90efaccbe4947e5a9cd4

data/Rakefile

@@ -16,3 +16,5 @@ RSpec::Core::RakeTask.new(:spec) do |task|
 end
 
 task :default => :spec
+
+Dir['tasks/*.rake'].each { |f| load f }

data/lib/spatial_features/importers/esri_geo_json.rb

@@ -1,4 +1,5 @@
 require 'digest/md5'
+require 'open3'
 require 'spatial_features/importers/geo_json'
 
 module SpatialFeatures
@@ -15,11 +16,9 @@ module SpatialFeatures
       private
 
       def esri_json_to_geojson(url)
-        if URI.parse(url).relative?
-          `ogr2ogr -t_srs EPSG:4326 -f GeoJSON /dev/stdout "#{url}"` # It is a local file path
-        else
-          `ogr2ogr -t_srs EPSG:4326 -f GeoJSON /dev/stdout "#{url}" OGRGeoJSON`
-        end
+        args = ['ogr2ogr', '-t_srs', 'EPSG:4326', '-f', 'GeoJSON', '/dev/stdout', url]
+        args << 'OGRGeoJSON' unless URI.parse(url).relative? # A relative URL is a local file path
+        Open3.capture2(*args).first
       end
     end
   end

data/lib/spatial_features/importers/shapefile.rb

@@ -1,5 +1,6 @@
 require 'ostruct'
 require 'digest/md5'
+require 'open3'
 
 module SpatialFeatures
   module Importers
@@ -55,8 +56,11 @@ module SpatialFeatures
         if proj4 == PROJ4_4326
           data[:geog] = wkt
         else
-          data[:geog] = ActiveRecord::Base.connection.select_value <<-SQL
-            SELECT ST_Transform(ST_GeomFromText('#{wkt}'), '#{proj4}', 4326) AS geog
+          # `proj4` is read out of the uploaded archive's .prj, so it is quoted before it
+          # reaches the statement.
+          conn = ActiveRecord::Base.connection
+          data[:geog] = conn.select_value <<-SQL
+            SELECT ST_Transform(ST_GeomFromText(#{conn.quote(wkt)}), #{conn.quote(proj4)}, 4326) AS geog
           SQL
         end
 
@@ -90,18 +94,27 @@ module SpatialFeatures
       end
 
       # Use OGR2OGR to reproject into EPSG:4326 so we can skip the reprojection step per-feature
+      #
+      # @note Both the projection and the path come from the uploaded archive, so they are
+      #   passed as an argv list and no shell parses them. Assembling a command string here
+      #   would let an uploader run commands of their choosing.
       def project_to_4326(file_path)
         output_path = Tempfile.create([::File.basename(file_path, '.shp') + '_epsg_4326_', '.shp']) { |file| file.path }
         return unless (proj4 = proj4_from_file(file_path))
-        return unless system("ogr2ogr -s_srs '#{proj4}' -t_srs EPSG:4326 '#{output_path}' '#{file_path}'")
+        return unless system('ogr2ogr', '-s_srs', proj4, '-t_srs', 'EPSG:4326', output_path, file_path)
         return ::File.open(output_path)
       end
 
+      # Returns the PROJ.4 projection string GDAL reads out of the file's .prj, or nil when
+      # it can't determine one. Returns nil when `gdalsrsinfo` is not installed, which
+      # `proj4_projection` reports.
       def proj4_from_file(file_path)
         # Sanitize: "'+proj=utm +zone=11 +datum=NAD83 +units=m +no_defs '\n" and lately
         #           "+proj=utm +zone=11 +datum=NAD83 +units=m +no_defs \n" to
         #           "+proj=utm +zone=11 +datum=NAD83 +units=m +no_defs"
-        `gdalsrsinfo "#{file_path}" -o proj4`.strip.remove(/^'|'$/).presence
+        Open3.capture2('gdalsrsinfo', file_path, '-o', 'proj4').first.strip.remove(/^'|'$/).presence
+      rescue Errno::ENOENT
+        nil
       end
 
       # a zip archive may contain multiple SHP files

data/lib/spatial_features/unzip.rb

@@ -1,4 +1,5 @@
 require 'fileutils'
+require 'pathname'
 
 module SpatialFeatures
   module Unzip
@@ -51,16 +52,26 @@ module SpatialFeatures
       end
     end
 
+    # Extracts the archive's entries and returns their paths, skipping entries that a name
+    # cannot place inside `tmpdir`.
+    #
+    # @param tmpdir [String] where to extract to. Must already exist, since the destination
+    #   is resolved before anything is written. Defaults to a fresh temporary directory.
     def self.extract(file_path, tmpdir: nil, downcase: false)
       tmpdir ||= Dir.mktmpdir
+      root = Pathname.new(tmpdir).realpath
+
       [].tap do |paths|
         entries(file_path).each do |entry|
           next if entry.name =~ IGNORED_ENTRY_PATHS
+          next if entry.symlink?
 
           output_filename = entry.name
           output_filename = output_filename.downcase if downcase
 
-          path = "#{tmpdir}/#{output_filename}"
+          path = contained_path(root, output_filename)
+          next unless path
+
           directory = File.dirname(path)
           basename = File.basename(path)
 
@@ -72,6 +83,24 @@ module SpatialFeatures
       end
     end
 
+    # Returns where an entry of this name lands under `root`, or nil when the name would place
+    # it outside. Entry names are stored in the archive verbatim, so they can carry `..`
+    # segments that climb out of the directory we extract into.
+    #
+    # @note `root` must already be a real path, and `::extract` skips symlink entries, so
+    #   nothing beneath it is a symlink. `cleanpath` resolves `..` lexically, so a symlink
+    #   under `root` would let an entry name walk back out of the directory unnoticed.
+    def self.contained_path(root, output_filename)
+      path = root.join(output_filename).cleanpath
+
+      return unless path.to_s.start_with?("#{root}#{File::SEPARATOR}")
+
+      # `cleanpath` drops the trailing separator that marks a directory entry, which
+      # `PathNotFound#extensions` reads to tell directories from the files it reports.
+      output_filename.end_with?(File::SEPARATOR) ? "#{path}#{File::SEPARATOR}" : path.to_s
+    end
+    private_class_method :contained_path
+
     def self.names(file_path)
       entries(file_path).collect(&:name)
     end

data/lib/spatial_features/version.rb

@@ -1,3 +1,3 @@
 module SpatialFeatures
-  VERSION = "3.11.1"
+  VERSION = "3.11.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spatial_features
 version: !ruby/object:Gem::Version
-  version: 3.11.1
+  version: 3.11.2
 platform: ruby
 authors:
 - Ryan Wallace