stduritemplate 2.0.11 → 2.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6139a327604fe23ea2b1d0d6462a04bb3e39b92dfd6eecaf999478a35c0a14ed
-  data.tar.gz: 318bd34e6a738fa37e9e755f62bae935c38dc4bf787c804ca278d8f3df833db7
+  metadata.gz: 934938b208bf9f45f42db597a4f30ce750c5437ebd7f2e87eb6675437325d2a0
+  data.tar.gz: 6dcde2182655ea5036301dd9645e81d42150f185db0fa62c8442f5df900c05b7
 SHA512:
-  metadata.gz: 6ebad292aec88e02b8c717e727771fafe4b6872460acea41552d29c91e09e1bee66437fd4857fa6649d0452692b316a085f04be19331d83ad8cbc97f9eb0719e
-  data.tar.gz: fa77853017cd993d6b24b3be8a7642ebafaa67256da994e6109df300ddc5971bd30b8581ec3016ceb04ed0de8769246248baf9abd842948d5bd43fa2bfd7ab59
+  metadata.gz: f3c5e97ca93552bd88355caa49ac7278de60eb9a3e9722e27a493352686030c00b35d39967f4dfb6825a1b18d9c6f2f0a6a7ff4783204234f7de6609efcfa7a5
+  data.tar.gz: bc06e9a9e4da9844e72c0e410b74a1250565ec7688efcccff3d56418211e33cdacd70e97e9565df352cf762dd50e3899ff61b3a21f7599fb2f3034f4b2343f52

data/lib/stduritemplate.rb

@@ -37,10 +37,20 @@ module StdUriTemplate
       -1
     else
       begin
-        Integer(value)
+        parsed = Integer(value)
       rescue ArgumentError
         raise ArgumentError, "Cannot parse max chars at col:#{col}"
       end
+
+      if value.start_with?('0')
+        raise ArgumentError, "Leading zeros are not allowed in max chars at col:#{col}"
+      end
+
+      if parsed < 1 || parsed > 9999
+        raise ArgumentError, "Max chars must be between 1 and 9999 at col:#{col}"
+      end
+
+      parsed
     end
   end
 
@@ -82,6 +92,9 @@ module StdUriTemplate
         first_token = true
       when '}'
         if token
+          if !max_char_buffer.nil? && max_char_buffer.empty?
+            raise ArgumentError, "Empty prefix after colon at col:#{i}"
+          end
           expanded = expand_token(operator, token, composite, get_max_char(max_char_buffer, i), first_token, substitutions, result, i)
           first_token = false if expanded && first_token
           token = nil
@@ -93,6 +106,9 @@ module StdUriTemplate
         end
       when ','
         if token
+          if !max_char_buffer.nil? && max_char_buffer.empty?
+            raise ArgumentError, "Empty prefix after colon at col:#{i}"
+          end
           expanded = expand_token(operator, token, composite, get_max_char(max_char_buffer, i), first_token, substitutions, result, i)
           first_token = false if expanded && first_token
           token = ''
@@ -104,7 +120,7 @@ module StdUriTemplate
           if operator.nil?
             operator = get_operator(character, token, i)
           elsif max_char_buffer
-            if character =~ /\d/
+            if character >= '0' && character <= '9'
               max_char_buffer << character
             else
               raise ArgumentError, "Illegal character identified in the token at col:#{i}"
@@ -120,7 +136,11 @@ module StdUriTemplate
             end
           end
         else
-          result << character
+          if character.ord > 0x7F
+            character.encode('UTF-8').bytes.each { |b| result << sprintf("%%%02X", b) }
+          else
+            result << character
+          end
         end
       end
     end
@@ -320,8 +340,35 @@ module StdUriTemplate
     end
   end
 
+  def self.hex_digit?(c)
+    (c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f')
+  end
+
+  def self.check_varname(token, col)
+    if token.start_with?('.') || token.end_with?('.')
+      raise ArgumentError, "Variable name cannot start or end with a dot at col:#{col}"
+    end
+
+    if token.include?('..')
+      raise ArgumentError, "Variable name cannot contain consecutive dots at col:#{col}"
+    end
+
+    i = 0
+    while i < token.length
+      if token[i] == '%'
+        if i + 2 >= token.length || !hex_digit?(token[i + 1]) || !hex_digit?(token[i + 2])
+          raise ArgumentError, "Invalid percent encoding in variable name at col:#{col}"
+        end
+        i += 3
+      else
+        i += 1
+      end
+    end
+  end
+
   def self.expand_token(operator, token, composite, max_char, first_token, substitutions, result, col)
     raise ArgumentError, "Found an empty token at col:#{col}" if token.empty?
+    check_varname(token, col)
 
     value = substitutions[token]
     subst_type = get_substitution_type(value, col)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stduritemplate
 version: !ruby/object:Gem::Version
-  version: 2.0.11
+  version: 2.0.12
 platform: ruby
 authors:
 - Andrea Peruffo
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-07-16 00:00:00.000000000 Z
 dependencies: []
 description: std-uritemplate implementation for Ruby
 email: andrea.peruffo1982@gmail.com