tzinfo 2.0.4 → 2.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7546cb5c3ebb595feafce0630fc925d58abba65b66bbd72f2f84e9a67128b7f1
-  data.tar.gz: 11a8bacf90d980fb3e278f95cf6090d9dc54da7dacaaed4e4c59f30bdbcc8b8e
+  metadata.gz: 15d9fc81161265595f6a97ed55898742c0b8f912052bffe58aca4528c08855c8
+  data.tar.gz: adf8f44066cfd018a145416f53b510615d8143bad62a3105dcabfb37c900a2e8
 SHA512:
-  metadata.gz: 40bc69496e52eff6e8790e3c03ba3df3c6915daec5ea182d630cfe820bd5e52b83bde35b21240e1482460e8bc3176c75782374376a96ce7e7cd27d4c0aa62c6c
-  data.tar.gz: e3b19c05c5d47e648f6986092e8acca5fe5a3f95420287ab06b5c68dfefa8993b2996767323cf212e705b0cbe20062cfdf98fcfdd9120219075e9a01dab16d60
+  metadata.gz: d5a124cea3cb29e8e6227bc72527da598d4047801a32998a3cb427d3dae4bfdc241e070f95c0db556db504f773f470a3855b2e4579bded1b5e00e68c33f2733b
+  data.tar.gz: 6f00d941afda6034a23a125ec06a175c60c0c50e0c7cf9b8b1f2a7adad82b9bd768d2c46b3d44bf1b2f0dc8b690ccf410d979a9821d3959e370b2c93e41163b8

data/CHANGES.md

@@ -1,8 +1,25 @@
 # Changes
 
+## Version 2.0.6 - 28-Jan-2023
+
+* Eliminate `Object#untaint` deprecation warnings on JRuby 9.4.0.0. #145.
+
+
+## Version 2.0.5 - 19-Jul-2022
+
+* Changed `DateTime` results to always use the proleptic Gregorian calendar.
+  This affects `DateTime` results prior to 1582-10-15 and any arithmetic
+  performed on the results that would produce a secondary result prior to
+  1582-10-15.
+* Added support for eager loading all the time zone and country data by calling
+  either `TZInfo::DataSource#eager_load!` or `TZInfo.eager_load!`. Compatible
+  with Ruby On Rails' `eager_load_namespaces`. #129.
+* Ignore the SECURITY file from Arch Linux's tzdata package. #134.
+
+
 ## Version 2.0.4 - 16-Dec-2020
 
-* Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a
+* Fixed an incorrect `InvalidTimezoneIdentifier` exception raised when loading a
   zoneinfo file that includes rules specifying an additional transition to the
   final defined offset (for example, Africa/Casablanca in version 2018e of the
   Time Zone Database). #123.
@@ -182,9 +199,23 @@
   `TZInfo::Country.get('US').zone_identifiers` should be used instead.
 
 
+## Version 1.2.11 - 28-Jan-2023
+
+* Eliminate `Object#untaint` deprecation warnings on JRuby 9.4.0.0. #145.
+
+
+## Version 1.2.10 - 19-Jul-2022
+
+* Fixed a relative path traversal bug that could cause arbitrary files to be
+  loaded with `require` when used with `RubyDataSource`. Please refer to
+  <https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx> for
+  details. CVE-2022-31163.
+* Ignore the SECURITY file from Arch Linux's tzdata package. #134.
+
+
 ## Version 1.2.9 - 16-Dec-2020
 
-* Fixed an incorrect InvalidTimezoneIdentifier exception raised when loading a
+* Fixed an incorrect `InvalidTimezoneIdentifier` exception raised when loading a
   zoneinfo file that includes rules specifying an additional transition to the
   final defined offset (for example, Africa/Casablanca in version 2018e of the
   Time Zone Database). #123.
@@ -340,10 +371,32 @@
   use other `TimezonePeriod` instance methods instead (issue #7655).
 
 
+## Version 0.3.61 (tzdata v2022a) - 19-Jul-2022
+
+* Fixed a relative path traversal bug that could cause arbitrary files to be
+  loaded with `require` from the Ruby load path. Please refer to
+  <https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx> for
+  details. CVE-2022-31163.
+* Updated to tzdata version 2022a
+  (<https://mm.icann.org/pipermail/tz-announce/2022-March/000070.html>).
+
+
+## Version 0.3.60 (tzdata v2021a) - 6-Feb-2021
+
+* Updated to tzdata version 2021a
+  (<https://mm.icann.org/pipermail/tz-announce/2021-January/000065.html>).
+
+
+## Version 0.3.59 (tzdata v2020e) - 24-Dec-2020
+
+* Updated to tzdata version 2020e
+  (<https://mm.icann.org/pipermail/tz-announce/2020-December/000063.html>).
+
+
 ## Version 0.3.58 (tzdata v2020d) - 8-Nov-2020
 
 * Updated to tzdata version 2020d
-  (https://mm.icann.org/pipermail/tz-announce/2020-October/000062.html).
+  (<https://mm.icann.org/pipermail/tz-announce/2020-October/000062.html>).
 
 
 ## Version 0.3.57 (tzdata v2020a) - 17-May-2020

data/LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2005-2020 Philip Ross
+Copyright (c) 2005-2023 Philip Ross
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

data/README.md

@@ -1,6 +1,6 @@
 # TZInfo - Ruby Time Zone Library
 
-[![RubyGems](https://img.shields.io/gem/v/tzinfo)](https://rubygems.org/gems/tzinfo) [![Travis CI Build](https://img.shields.io/travis/com/tzinfo/tzinfo?logo=travis)](https://travis-ci.com/github/tzinfo/tzinfo) [![AppVeyor Build](https://img.shields.io/appveyor/build/philr/tzinfo?logo=appveyor)](https://ci.appveyor.com/project/philr/tzinfo)
+[![RubyGems](https://img.shields.io/gem/v/tzinfo?logo=rubygems&label=Gem)](https://rubygems.org/gems/tzinfo) [![Tests](https://github.com/tzinfo/tzinfo/workflows/Tests/badge.svg?branch=master&event=push)](https://github.com/tzinfo/tzinfo/actions?query=workflow%3ATests+branch%3Amaster+event%3Apush)
 
 [TZInfo](https://tzinfo.github.io) is a Ruby library that provides access to
 time zone data and allows times to be converted using time zone rules.
@@ -36,7 +36,7 @@ documentation for further details.
 ## Installation
 
 The TZInfo gem can be installed by running `gem install tzinfo` or by adding
-to `gem 'tzinfo'` to your `Gemfile` and running `bundle install`.
+`gem 'tzinfo'` to your `Gemfile` and running `bundle install`.
 
 To use the Ruby modules as the data source, TZInfo::Data will also need to be
 installed by running `gem install tzinfo-data` or by adding `gem 'tzinfo-data'`

data/lib/tzinfo/data_source.rb

@@ -247,6 +247,17 @@ module TZInfo
       raise_invalid_data_source('country_codes')
     end
 
+    # Loads all timezone and country data into memory.
+    #
+    # This may be desirable in production environments to improve copy-on-write
+    # performance and to avoid flushing the constant cache every time a new
+    # timezone or country is loaded from {DataSources::RubyDataSource}.
+    def eager_load!
+      timezone_identifiers.each {|identifier| load_timezone_info(identifier) }
+      country_codes.each {|code| load_country_info(code) }
+      nil
+    end
+
     # @return [String] a description of the {DataSource}.
     def to_s
       "Default DataSource"

data/lib/tzinfo/data_sources/posix_time_zone_parser.rb

@@ -4,10 +4,6 @@
 require 'strscan'
 
 module TZInfo
-  # Use send as a workaround for erroneous 'wrong number of arguments' errors
-  # with JRuby 9.0.5.0 when calling methods with Java implementations. See #114.
-  send(:using, UntaintExt) if TZInfo.const_defined?(:UntaintExt)
-
   module DataSources
     # An {InvalidPosixTimeZone} exception is raised if an invalid POSIX-style
     # time zone string is encountered.
@@ -43,12 +39,12 @@ module TZInfo
 
         s = StringScanner.new(tz_string)
         check_scan(s, /([^-+,\d<][^-+,\d]*) | <([^>]+)>/x)
-        std_abbrev = @string_deduper.dedupe((s[1] || s[2]).untaint)
+        std_abbrev = @string_deduper.dedupe(RubyCoreSupport.untaint(s[1] || s[2]))
         check_scan(s, /([-+]?\d+)(?::(\d+)(?::(\d+))?)?/)
         std_offset = get_offset_from_hms(s[1], s[2], s[3])
 
         if s.scan(/([^-+,\d<][^-+,\d]*) | <([^>]+)>/x)
-          dst_abbrev = @string_deduper.dedupe((s[1] || s[2]).untaint)
+          dst_abbrev = @string_deduper.dedupe(RubyCoreSupport.untaint(s[1] || s[2]))
 
           if s.scan(/([-+]?\d+)(?::(\d+)(?::(\d+))?)?/)
             dst_offset = get_offset_from_hms(s[1], s[2], s[3])

data/lib/tzinfo/data_sources/ruby_data_source.rb

@@ -2,10 +2,6 @@
 # frozen_string_literal: true
 
 module TZInfo
-  # Use send as a workaround for erroneous 'wrong number of arguments' errors
-  # with JRuby 9.0.5.0 when calling methods with Java implementations. See #114.
-  send(:using, UntaintExt) if TZInfo.const_defined?(:UntaintExt)
-
   module DataSources
     # A {TZInfoDataNotFound} exception is raised if the tzinfo-data gem could
     # not be found (i.e. `require 'tzinfo/data'` failed) when selecting the Ruby
@@ -52,7 +48,7 @@ module TZInfo
           data_file = File.join('', 'tzinfo', 'data.rb')
           path = $".reverse_each.detect {|p| p.end_with?(data_file) }
           if path
-            @base_path = File.join(File.dirname(path), 'data').untaint
+            @base_path = RubyCoreSupport.untaint(File.join(File.dirname(path), 'data'))
           else
             @base_path = 'tzinfo/data'
           end
@@ -116,14 +112,14 @@ module TZInfo
       # @param identifier [Array<string>] the component parts of a time zone
       #   identifier (split on /). This must have already been validated.
       def require_definition(identifier)
-        require_data(*(['definitions'] + identifier))
+        require_data('definitions', *identifier)
       end
 
       # Requires an index by its name.
       #
       # @param name [String] an index name.
       def require_index(name)
-        require_data(*['indexes', name])
+        require_data('indexes', name)
       end
 
       # Requires a file from tzinfo/data.

data/lib/tzinfo/data_sources/zoneinfo_data_source.rb

@@ -2,10 +2,6 @@
 # frozen_string_literal: true
 
 module TZInfo
-  # Use send as a workaround for erroneous 'wrong number of arguments' errors
-  # with JRuby 9.0.5.0 when calling methods with Java implementations. See #114.
-  send(:using, UntaintExt) if TZInfo.const_defined?(:UntaintExt)
-
   module DataSources
     # An {InvalidZoneinfoDirectory} exception is raised if {ZoneinfoDataSource}
     # is initialized with a specific zoneinfo path that is not a valid zoneinfo
@@ -78,6 +74,30 @@ module TZInfo
       DEFAULT_ALTERNATE_ISO3166_TAB_SEARCH_PATH = ['/usr/share/misc/iso3166.tab', '/usr/share/misc/iso3166'].freeze
       private_constant :DEFAULT_ALTERNATE_ISO3166_TAB_SEARCH_PATH
 
+      # Files and directories in the top level zoneinfo directory that will be
+      # excluded from the list of available time zones:
+      #
+      #   - +VERSION is included on Mac OS X.
+      #   - leapseconds is a list of leap seconds.
+      #   - localtime is the current local timezone (may be a link).
+      #   - posix, posixrules and right are directories containing other
+      #     versions of the zoneinfo files.
+      #   - SECURITY is included in the Arch Linux tzdata package.
+      #   - src is a directory containing the tzdata source included on Solaris.
+      #   - timeconfig is a symlink included on Slackware.
+      EXCLUDED_FILENAMES = [
+        '+VERSION',
+        'leapseconds',
+        'localtime',
+        'posix',
+        'posixrules',
+        'right',
+        'SECURITY',
+        'src',
+        'timeconfig'
+      ].freeze
+      private_constant :EXCLUDED_FILENAMES
+
       # Paths to be checked to find the system zoneinfo directory.
       #
       # @private
@@ -394,15 +414,7 @@ module TZInfo
       def load_timezone_identifiers
         index = []
 
-        # Ignoring particular files:
-        # +VERSION is included on Mac OS X.
-        # leapseconds is a list of leap seconds.
-        # localtime is the current local timezone (may be a link).
-        # posix, posixrules and right are directories containing other versions of the zoneinfo files.
-        # src is a directory containing the tzdata source included on Solaris.
-        # timeconfig is a symlink included on Slackware.
-
-        enum_timezones([], ['+VERSION', 'leapseconds', 'localtime', 'posix', 'posixrules', 'right', 'src', 'timeconfig']) do |identifier|
+        enum_timezones([], EXCLUDED_FILENAMES) do |identifier|
           index << identifier.join('/').freeze
         end
 
@@ -428,7 +440,7 @@ module TZInfo
           end
 
           unless entry =~ /\./ || exclude.include?(entry)
-            entry.untaint
+            RubyCoreSupport.untaint(entry)
             path = dir + [entry]
             full_path = File.join(@zoneinfo_dir, *path)
 

data/lib/tzinfo/data_sources/zoneinfo_reader.rb

@@ -2,10 +2,6 @@
 # frozen_string_literal: true
 
 module TZInfo
-  # Use send as a workaround for erroneous 'wrong number of arguments' errors
-  # with JRuby 9.0.5.0 when calling methods with Java implementations. See #114.
-  send(:using, UntaintExt) if TZInfo.const_defined?(:UntaintExt)
-
   module DataSources
     # An {InvalidZoneinfoFile} exception is raised if an attempt is made to load
     # an invalid zoneinfo file.
@@ -448,7 +444,7 @@ module TZInfo
           abbrev_end = abbrev.index("\0", abbrev_start)
           raise InvalidZoneinfoFile, "Missing abbreviation null terminator in file '#{file.path}'." unless abbrev_end
 
-          abbr = @string_deduper.dedupe(abbrev[abbrev_start...abbrev_end].force_encoding(Encoding::UTF_8).untaint)
+          abbr = @string_deduper.dedupe(RubyCoreSupport.untaint(abbrev[abbrev_start...abbrev_end].force_encoding(Encoding::UTF_8)))
 
           TimezoneOffset.new(base_utc_offset, std_offset, abbr)
         end

data/lib/tzinfo/ruby_core_support.rb

@@ -0,0 +1,38 @@
+module TZInfo
+
+  # Methods to support different versions of Ruby.
+  #
+  # @private
+  module RubyCoreSupport #:nodoc:
+    class << self
+      # Object#untaint is deprecated and becomes a no-op in Ruby >= 2.7. It has
+      # been removed from Ruby 3.2.
+      if !Object.new.respond_to?(:untaint) || RUBY_VERSION =~ /\A(\d+)\.(\d+)(?:\.|\z)/ && ($1 == '2' && $2.to_i >= 7 || $1.to_i >= 3)
+        # :nocov_functional_untaint:
+
+        # Returns the supplied `Object`
+        #
+        # @param o [Object] the `Object` to untaint.
+        # @return [Object] `o`.
+        def untaint(o)
+          o
+        end
+
+        # :nocov_functional_untaint:
+      else
+        # :nocov_no_functional_untaint:
+
+        # Untaints and returns the supplied `Object`.
+        #
+        # @param o [Object] the `Object` to untaint.
+        # @return [Object] `o`.
+        def untaint(o)
+          o.untaint
+        end
+
+        # :nocov_no_functional_untaint:
+      end
+    end
+  end
+  private_constant :RubyCoreSupport
+end

data/lib/tzinfo/timestamp.rb

@@ -3,10 +3,11 @@
 
 module TZInfo
   # A time represented as an `Integer` number of seconds since 1970-01-01
-  # 00:00:00 UTC (ignoring leap seconds), the fraction through the second
-  # (sub_second as a `Rational`) and an optional UTC offset. Like Ruby's `Time`
-  # class, {Timestamp} can distinguish between a local time with a zero offset
-  # and a time specified explicitly as UTC.
+  # 00:00:00 UTC (ignoring leap seconds and using the proleptic Gregorian
+  # calendar), the fraction through the second (sub_second as a `Rational`) and
+  # an optional UTC offset. Like Ruby's `Time` class, {Timestamp} can
+  # distinguish between a local time with a zero offset and a time specified
+  # explicitly as UTC.
   class Timestamp
     include Comparable
 
@@ -16,8 +17,8 @@ module TZInfo
     private_constant :JD_EPOCH
 
     class << self
-      # Returns a new {Timestamp} representing the (Gregorian calendar) date and
-      # time specified by the supplied parameters.
+      # Returns a new {Timestamp} representing the (proleptic Gregorian
+      # calendar) date and time specified by the supplied parameters.
       #
       # If `utc_offset` is `nil`, `:utc` or 0, the date and time parameters will
       # be interpreted as representing a UTC date and time. Otherwise the date
@@ -37,7 +38,7 @@ module TZInfo
       #   specified offset, an offset from UTC specified as an `Integer` number
       #   of seconds or the `Symbol` `:utc`).
       # @return [Timestamp] a new {Timestamp} representing the specified
-      #   (Gregorian calendar) date and time.
+      #   (proleptic Gregorian calendar) date and time.
       # @raise [ArgumentError] if either of `year`, `month`, `day`, `hour`,
       #   `minute`, or `second` is not an `Integer`.
       # @raise [ArgumentError] if `sub_second` is not a `Rational`, or the
@@ -84,7 +85,8 @@ module TZInfo
       # When called with a block, the {Timestamp} representation of `value` is
       # passed to the block. The block must then return a {Timestamp}, which
       # will be converted back to the type of the initial value. If the initial
-      # value was a {Timestamp}, the block result will just be returned.
+      # value was a {Timestamp}, the block result will be returned. If the
+      # initial value was a `DateTime`, a Gregorian `DateTime` will be returned.
       #
       # The UTC offset of `value` can either be preserved (the {Timestamp}
       # representation will have the same UTC offset as `value`), ignored (the
@@ -396,11 +398,11 @@ module TZInfo
       end
     end
 
-    # Converts this {Timestamp} to a `DateTime`.
+    # Converts this {Timestamp} to a Gregorian `DateTime`.
     #
-    # @return [DateTime] a DateTime representation of this {Timestamp}. If the
-    #   UTC offset of this {Timestamp} is not specified, a UTC `DateTime` will
-    #   be returned.
+    # @return [DateTime] a Gregorian `DateTime` representation of this
+    #   {Timestamp}. If the UTC offset of this {Timestamp} is not specified, a
+    #   UTC `DateTime` will be returned.
     def to_datetime
       new_datetime
     end
@@ -408,7 +410,7 @@ module TZInfo
     # Converts this {Timestamp} to an `Integer` number of seconds since
     # 1970-01-01 00:00:00 UTC (ignoring leap seconds).
     #
-    # @return [Integer] an Integer representation of this {Timestamp} (the
+    # @return [Integer] an `Integer` representation of this {Timestamp} (the
     #   number of seconds since 1970-01-01 00:00:00 UTC ignoring leap seconds).
     def to_i
       value
@@ -492,7 +494,9 @@ module TZInfo
     #
     # @private
     def new_datetime(klass = DateTime)
-      datetime = klass.jd(JD_EPOCH + ((@value.to_r + @sub_second) / 86400))
+      # Can't specify the start parameter unless the jd parameter is an exact number of days.
+      # Use #gregorian instead.
+      datetime = klass.jd(JD_EPOCH + ((@value.to_r + @sub_second) / 86400)).gregorian
       @utc_offset && @utc_offset != 0 ? datetime.new_offset(Rational(@utc_offset, 86400)) : datetime
     end
 

data/lib/tzinfo/version.rb

@@ -3,5 +3,5 @@
 
 module TZInfo
   # The TZInfo version number.
-  VERSION = '2.0.4'
+  VERSION = '2.0.6'
 end

data/lib/tzinfo.rb

@@ -3,14 +3,22 @@
 
 # The top level module for TZInfo.
 module TZInfo
+  class << self
+    # Instructs the current {DataSource} to load all timezone and country data
+    # into memory (initializing the {DataSource} first if not previously
+    # accessed or set).
+    #
+    # This may be desirable in production environments to improve copy-on-write
+    # performance and to avoid flushing the constant cache every time a new
+    # timezone or country is loaded from {DataSources::RubyDataSource}.
+    def eager_load!
+      DataSource.get.eager_load!
+    end
+  end
 end
 
-# Object#untaint is a deprecated no-op in Ruby >= 2.7 and will be removed in
-# 3.2. Add a refinement to either silence the warning, or supply the method if
-# needed.
-if !Object.new.respond_to?(:untaint) || RUBY_VERSION =~ /\A(\d+)\.(\d+)(?:\.|\z)/ && ($1 == '2' && $2.to_i >= 7 || $1.to_i >= 3)
-  require_relative 'tzinfo/untaint_ext'
-end
+
+require_relative 'tzinfo/ruby_core_support'
 
 require_relative 'tzinfo/version'
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tzinfo
 version: !ruby/object:Gem::Version
-  version: 2.0.4
+  version: 2.0.6
 platform: ruby
 authors:
 - Philip Ross
@@ -29,7 +29,7 @@ cert_chain:
   J3Zn/kSTjTekiaspyGbczC3PUaeJNxr+yCvR4sk71Xmk/GaKKGOHedJ1uj/LAXrA
   MR0mpl7b8zCg0PFC1J73uw==
   -----END CERTIFICATE-----
-date: 2020-12-16 00:00:00.000000000 Z
+date: 2023-01-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -94,6 +94,7 @@ files:
 - lib/tzinfo/info_timezone.rb
 - lib/tzinfo/linked_timezone.rb
 - lib/tzinfo/offset_timezone_period.rb
+- lib/tzinfo/ruby_core_support.rb
 - lib/tzinfo/string_deduper.rb
 - lib/tzinfo/time_with_offset.rb
 - lib/tzinfo/timestamp.rb
@@ -105,7 +106,6 @@ files:
 - lib/tzinfo/timezone_transition.rb
 - lib/tzinfo/transition_rule.rb
 - lib/tzinfo/transitions_timezone_period.rb
-- lib/tzinfo/untaint_ext.rb
 - lib/tzinfo/version.rb
 - lib/tzinfo/with_offset.rb
 homepage: https://tzinfo.github.io
@@ -114,9 +114,9 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/tzinfo/tzinfo/issues
   changelog_uri: https://github.com/tzinfo/tzinfo/blob/master/CHANGES.md
-  documentation_uri: https://rubydoc.info/gems/tzinfo/2.0.4
+  documentation_uri: https://rubydoc.info/gems/tzinfo/2.0.6
   homepage_uri: https://tzinfo.github.io
-  source_code_uri: https://github.com/tzinfo/tzinfo/tree/v2.0.4
+  source_code_uri: https://github.com/tzinfo/tzinfo/tree/v2.0.6
 post_install_message: 
 rdoc_options:
 - "--title"
@@ -136,7 +136,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.4.5
 signing_key: 
 specification_version: 4
 summary: Time Zone Library

data/lib/tzinfo/untaint_ext.rb

@@ -1,18 +0,0 @@
-# encoding: UTF-8
-# frozen_string_literal: true
-
-module TZInfo
-  # Object#untaint is deprecated in Ruby >= 2.7 and will be removed in 3.2.
-  # UntaintExt adds a refinement to make Object#untaint a no-op and avoid the
-  # warning.
-  #
-  # @private
-  module UntaintExt # :nodoc:
-    refine Object do
-      def untaint
-        self
-      end
-    end
-  end
-  private_constant :UntaintExt
-end