stduritemplate 2.0.11 → 2.0.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6139a327604fe23ea2b1d0d6462a04bb3e39b92dfd6eecaf999478a35c0a14ed
-  data.tar.gz: 318bd34e6a738fa37e9e755f62bae935c38dc4bf787c804ca278d8f3df833db7
+  metadata.gz: f6350d591908f7cd193fd7db8098268534a979bdd3bb4b4e629baf743663428e
+  data.tar.gz: c1a5db3125d5b4ead01eb2afa7bc692f3e5a7db151fbbf05f2dd847e27efb056
 SHA512:
-  metadata.gz: 6ebad292aec88e02b8c717e727771fafe4b6872460acea41552d29c91e09e1bee66437fd4857fa6649d0452692b316a085f04be19331d83ad8cbc97f9eb0719e
-  data.tar.gz: fa77853017cd993d6b24b3be8a7642ebafaa67256da994e6109df300ddc5971bd30b8581ec3016ceb04ed0de8769246248baf9abd842948d5bd43fa2bfd7ab59
+  metadata.gz: 40be665502e60d5e55ba6ee9a5a8dff5a2c5ac04e2be2771ec76e17bf4fbf4dd5531270f4b4a98c6c51b5668b962b87205bf6da17376f598545877917359decb
+  data.tar.gz: 2a14f0acc8067c3386aec291607eb2e2c35974b88afb89e862ba3c71474ba8a8ea5a0bfcd78ccc321ab99b3485110bf868fdb4511b58548998d16dd12ede1c79

data/lib/stduritemplate.rb

@@ -37,10 +37,20 @@ module StdUriTemplate
       -1
     else
       begin
-        Integer(value)
+        parsed = Integer(value)
       rescue ArgumentError
         raise ArgumentError, "Cannot parse max chars at col:#{col}"
       end
+
+      if value.start_with?('0')
+        raise ArgumentError, "Leading zeros are not allowed in max chars at col:#{col}"
+      end
+
+      if parsed < 1 || parsed > 9999
+        raise ArgumentError, "Max chars must be between 1 and 9999 at col:#{col}"
+      end
+
+      parsed
     end
   end
 
@@ -82,6 +92,9 @@ module StdUriTemplate
         first_token = true
       when '}'
         if token
+          if !max_char_buffer.nil? && max_char_buffer.empty?
+            raise ArgumentError, "Empty prefix after colon at col:#{i}"
+          end
           expanded = expand_token(operator, token, composite, get_max_char(max_char_buffer, i), first_token, substitutions, result, i)
           first_token = false if expanded && first_token
           token = nil
@@ -93,18 +106,23 @@ module StdUriTemplate
         end
       when ','
         if token
+          if !max_char_buffer.nil? && max_char_buffer.empty?
+            raise ArgumentError, "Empty prefix after colon at col:#{i}"
+          end
           expanded = expand_token(operator, token, composite, get_max_char(max_char_buffer, i), first_token, substitutions, result, i)
           first_token = false if expanded && first_token
           token = ''
           composite = false
           max_char_buffer = nil
+        else
+          result << character
         end
       else
         if token
           if operator.nil?
             operator = get_operator(character, token, i)
           elsif max_char_buffer
-            if character =~ /\d/
+            if character >= '0' && character <= '9'
               max_char_buffer << character
             else
               raise ArgumentError, "Illegal character identified in the token at col:#{i}"
@@ -120,7 +138,11 @@ module StdUriTemplate
             end
           end
         else
-          result << character
+          if character.ord > 0x7F
+            character.encode('UTF-8').bytes.each { |b| result << sprintf("%%%02X", b) }
+          else
+            result << character
+          end
         end
       end
     end
@@ -320,8 +342,35 @@ module StdUriTemplate
     end
   end
 
+  def self.hex_digit?(c)
+    (c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f')
+  end
+
+  def self.check_varname(token, col)
+    if token.start_with?('.') || token.end_with?('.')
+      raise ArgumentError, "Variable name cannot start or end with a dot at col:#{col}"
+    end
+
+    if token.include?('..')
+      raise ArgumentError, "Variable name cannot contain consecutive dots at col:#{col}"
+    end
+
+    i = 0
+    while i < token.length
+      if token[i] == '%'
+        if i + 2 >= token.length || !hex_digit?(token[i + 1]) || !hex_digit?(token[i + 2])
+          raise ArgumentError, "Invalid percent encoding in variable name at col:#{col}"
+        end
+        i += 3
+      else
+        i += 1
+      end
+    end
+  end
+
   def self.expand_token(operator, token, composite, max_char, first_token, substitutions, result, col)
     raise ArgumentError, "Found an empty token at col:#{col}" if token.empty?
+    check_varname(token, col)
 
     value = substitutions[token]
     subst_type = get_substitution_type(value, col)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stduritemplate
 version: !ruby/object:Gem::Version
-  version: 2.0.11
+  version: 2.0.13
 platform: ruby
 authors:
 - Andrea Peruffo
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies: []
 description: std-uritemplate implementation for Ruby
 email: andrea.peruffo1982@gmail.com