text-hyphen 1.5.0 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6691be16764f973315c67ddd1da98d90bfe79921546b519d2d0eeac65ec4b9c2
-  data.tar.gz: b5c789b5d5e18db0e1408f7de1c24b5ad2431594edd8311a263b0ae093ef96ad
+  metadata.gz: 4f68be6e32a2f84b2525e443f3a4963aca956a8aa6519bc8626ef5e8e55bf852
+  data.tar.gz: 8fdb6d4b5e5824426f62742f8233cc03497a43c39ea08f97524f591ca4a4bd36
 SHA512:
-  metadata.gz: b921231d274be4e5c614ddf038edd6f701d4693853eaf72a572827f3052cab456f98e6416ad751b8266b8eb59e92f298c00659f875e267ab0968b1ecab6fa3ba
-  data.tar.gz: 4608df3088f90f42af612eb01b947d28cd98be40eb393d64d812f3044c5026257066290efe46423351d3fe2688c11895f343280541a02efc04aadacbfd8a10ef
+  metadata.gz: 7db44199be83d41accb98ad1c6daa2133544e147c6e5b8791d8e46bd3c60aee93746cc41b3a9d68f34c385c19097186c35d12409a6c92f23d22f076a6041e702
+  data.tar.gz: 31bae791ccc11da74136baf39c429a327b14fb6553aa7d911ddd89398d3e6eb86ea147aabb1fb0ed252899be7e0f5cf67e7f318cadde24c70485ce469db30253

data/History.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.6.0 / 2026-10-23
+
+- Security:
+
+  - Language codes are validated before they are passed to `require`. A
+    crafted code such as `../../foo` could load any Ruby file on the load path
+    (GHSA-x432-p2c9-v84r). Codes may now only contain lowercase letters,
+    digits and underscores; anything else raises `ArgumentError`.
+
+- Changes:
+
+  - Unknown language codes raise `ArgumentError` instead of `LoadError`.
+
+  - Language codes with dashes (`en-us`) are normalised as documented.
+
 ## 1.5.0 / 2023-03-18
 
 - 1 new feature:

data/lib/text/hyphen.rb

@@ -19,7 +19,7 @@ class Text::Hyphen
     require File.join(p, v, f)
   end
 
-  VERSION = "1.5.0"
+  VERSION = "1.6.0"
 
   DEFAULT_MIN_LEFT = 2
   DEFAULT_MIN_RIGHT = 2
@@ -276,20 +276,36 @@ The language '%s' contains %d total hyphenation patterns.
     return if @first_load
 
     @iso_language ||= "en_us"
+    @iso_language = @iso_language.to_s.downcase.tr("-", "_")
+
+    unless valid_language?(@iso_language)
+      raise ArgumentError, "invalid language: #{@iso_language.inspect}"
+    end
 
     unless @language
-      require "text/hyphen/language/#{@iso_language}"
-      @language = Text::Hyphen::Language.const_get(@iso_language.upcase)
+      @language = require_language_definition(@iso_language)
       @iso_language = @language.isocode if @language.isocode
     end
 
-    @left ||= @language.left
+    @left  ||= @language.left
     @right ||= @language.right
-
     @iso_language
   end
   private :load_language
 
+  def valid_language?(language)
+    language.match?(/\A[a-z][a-z0-9_]+\z/) && !language.end_with?("_")
+  end
+  private :valid_language?
+
+  def require_language_definition(language)
+    require "text/hyphen/language/#{language}"
+    Text::Hyphen::Language.const_get(language.upcase)
+  rescue LoadError
+    raise ArgumentError, "unknown language: #{language.inspect}"
+  end
+  private :require_language_definition
+
   def split_phrase(phrase)
     phrase.split(/[[:space:]]+/)
   end

data/test/test_text_hyphen.rb

@@ -85,4 +85,9 @@ class TestTextHyphen < Test::Unit::TestCase
     a = Text::Hyphen.new(:left => 0, :right => 0).visualize("This useful library supports phrases and sentences.")
     assert_equal "This use-ful li-brary sup-port-s phras-es and sen-tences.", a
   end
+
+  def test_iso_language_uses_language_isocode
+    assert_equal "de", Text::Hyphen.new(:language => "de1").iso_language
+    assert_equal "hu", Text::Hyphen.new(:language => "hu1").iso_language
+  end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: text-hyphen
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.6.0
 platform: ruby
 authors:
 - Austin Ziegler
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-18 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: hoe
@@ -140,20 +139,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '7'
+        version: '9'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '7.0'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '7'
+        version: '9'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
@@ -168,7 +167,7 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.21'
-description: |-
+description: |
   Text::Hyphen is a Ruby library to hyphenate words in various languages using
   Ruby-fied versions of TeX hyphenation patterns. It will properly hyphenate
   various words according to the rules of the language the word is written in. The
@@ -184,6 +183,8 @@ description: |-
   Ruby 1.8.7 and Ruby 1.9.2 support (but please read below). In short, Ruby 1.8
   support is deprecated and I will not be providing any bug fixes related to Ruby
   1.8. New features will be developed and tested against Ruby 1.9 only.
+
+  ==== To Install:
 email:
 - halostatue@gmail.com
 executables:
@@ -194,7 +195,6 @@ extra_rdoc_files:
 - Contributing.md
 - History.md
 - Licence.md
-- Manifest.txt
 - README.md
 files:
 - ".standard.yml"
@@ -313,13 +313,11 @@ files:
 - test/data/bug_9807_utf-8.rb
 - test/test_bugs.rb
 - test/test_text_hyphen.rb
-homepage: https://rubygems.org/gems/text-hyphen
 licenses:
 - MIT
 - Various
 metadata:
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options:
 - "--main"
 - README.md
@@ -336,8 +334,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.6
-signing_key:
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Text::Hyphen is a Ruby library to hyphenate words in various languages using
   Ruby-fied versions of TeX hyphenation patterns