unmagic-icon 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17b7d09638783ea1144e26806aa2e7915d04e08645ed39c2df6a2f3026a69bdf
-  data.tar.gz: 39b8e9e8fc1a88c494c1336224b88632c0f5153e002fa2a2663b1f476c42f27b
+  metadata.gz: a2816013cd640fd83010c1f0ce16331c76a0cdf511d08ed0fad023625c4e3164
+  data.tar.gz: d7d034d992ccceea401a82b85173dfba4ddbeaf69d693d3394024c50ea2e5ad1
 SHA512:
-  metadata.gz: 58e783d9c8829e92c70149d48f95a012a092123fa85ec2e92f68eb30203d4028722f7db8aad66c487880749b5e9647062c11cc4118c06faf71b5784fd617a9ea
-  data.tar.gz: d5ecd53c6ee72f8aaa9050221d4a619fc58a778f9998896a50530a1cee737564f3667e5bb4435040c69c645861dcb8a0ca829bcb3b923db025d51b32800a1882
+  metadata.gz: d0a7a4a4bafe8628a56d08dc59c442b992599914874af08cffc5e5a2c1cdc2db33b05692a6ba9a0faf6350b5a4d99995fe51d9c41f51deedcc2bd02904dc73d6
+  data.tar.gz: b374951070dde1e5a277bce1c8b7ef2e3166b6fbaf49f3d549d235f82b36a13aaafcdefeffa5c2eeafca83017da52e37e926bc79f6eee62ca17648b6b865b0e6

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.1] - 2026-07-14
+
+### Changed
+- Archives are now extracted in pure Ruby (rubyzip for zips, stdlib
+  `Gem::Package::TarReader`/`Zlib` for tarballs) instead of shelling out to
+  `unzip`/`tar`, so `unmagic:icons:install` works in minimal containers —
+  such as Rails' default slim Docker image — where those binaries aren't
+  installed. Extraction also guards against zip-slip path traversal.
+
+### Added
+- Runtime dependency on `rubyzip` (>= 2.3)
+
 ## [0.2.0] - 2026-06-22
 
 ### Added
@@ -41,6 +53,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   hooks into `assets:precompile`) and `unmagic:icons:download[library]`
 - `Unmagic::Icon::Web`, a Rack app for browsing the configured icon libraries
 
-[Unreleased]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.2.1...HEAD
+[0.2.1]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/unreasonable-magic/unmagic-icon/releases/tag/v0.1.0

data/lib/unmagic/icon/library/source.rb

@@ -6,7 +6,8 @@ require "json"
 require "pathname"
 require "fileutils"
 require "tmpdir"
-require "open3"
+require "zlib"
+require "rubygems/package"
 
 # Terminal progress is a nicety, not a requirement. The downloader runs fine
 # (with plain output) when these sibling gems aren't installed.
@@ -211,19 +212,76 @@ module Unmagic
           end
         end
 
+        # Pure-Ruby extraction — no `unzip`/`tar` binaries required, so this
+        # works in minimal containers (e.g. Rails' default slim Docker image).
         def extract_archive(archive_path, destination, type)
           case type
           when :zip
-            _, stderr, status = Open3.capture3("unzip", "-q", "-o", archive_path, "-d", destination)
-            raise ExtractionError, "Failed to extract zip: #{stderr}" unless status.success?
+            extract_zip(archive_path, destination)
           when :tgz, :tar
-            _, stderr, status = Open3.capture3("tar", "-xzf", archive_path, "-C", destination)
-            raise ExtractionError, "Failed to extract tar: #{stderr}" unless status.success?
+            extract_tar(archive_path, destination)
           else
             raise ExtractionError, "Unknown archive type: #{type}"
           end
         end
 
+        def extract_zip(archive_path, destination)
+          require "zip"
+
+          Zip::File.open(archive_path) do |zip|
+            zip.each do |entry|
+              path = safe_extraction_path(entry.name, destination)
+
+              if entry.directory?
+                FileUtils.mkdir_p(path)
+              elsif entry.file?
+                FileUtils.mkdir_p(File.dirname(path))
+                entry.get_input_stream do |input|
+                  File.open(path, "wb") { |file| IO.copy_stream(input, file) }
+                end
+              end
+            end
+          end
+        rescue Zip::Error => e
+          raise ExtractionError, "Failed to extract zip: #{e.message}"
+        end
+
+        GZIP_MAGIC = "\x1f\x8b".b
+
+        def extract_tar(archive_path, destination)
+          File.open(archive_path, "rb") do |file|
+            stream = file.read(2) == GZIP_MAGIC ? Zlib::GzipReader.new(file.tap(&:rewind)) : file.tap(&:rewind)
+
+            Gem::Package::TarReader.new(stream) do |tar|
+              tar.each do |entry|
+                path = safe_extraction_path(entry.full_name, destination)
+
+                if entry.directory?
+                  FileUtils.mkdir_p(path)
+                elsif entry.file?
+                  FileUtils.mkdir_p(File.dirname(path))
+                  File.open(path, "wb") { |output| IO.copy_stream(entry, output) }
+                end
+              end
+            end
+          end
+        rescue Zlib::Error, Gem::Package::Error => e
+          raise ExtractionError, "Failed to extract tar: #{e.message}"
+        end
+
+        # Guards against zip-slip: entries like "../../etc/passwd" must not
+        # escape the extraction directory.
+        def safe_extraction_path(entry_name, destination)
+          destination = File.expand_path(destination)
+          path = File.expand_path(entry_name, destination)
+
+          unless path == destination || path.start_with?(destination + File::SEPARATOR)
+            raise ExtractionError, "Archive entry escapes extraction directory: #{entry_name}"
+          end
+
+          path
+        end
+
         def count_svgs(directory)
           Dir.glob(File.join(directory, "**", "*.svg")).size
         end

data/lib/unmagic/icon/version.rb

@@ -2,6 +2,6 @@
 
 module Unmagic
   class Icon
-    VERSION = "0.2.0"
+    VERSION = "0.2.1"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unmagic-icon
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Keith Pitt
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-22 00:00:00.000000000 Z
+date: 2026-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -52,6 +52,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.8.5
+- !ruby/object:Gem::Dependency
+  name: rubyzip
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement