valkyrie 3.6.0 → 3.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd992e314f4262841181b047c1069253b9ae74131fe5e88760ff266ee934d7b4
-  data.tar.gz: 0b9d0d17a2853fb2eda435a3afc2a6202af17b19a4d5d0ad4ecfbeaea0e34de5
+  metadata.gz: 6c19142683e0f4cfdc60b4da2e25a5e0caa37ba49916469e86c15fe89ea147d6
+  data.tar.gz: a62e7d67469524073b275e057c69fc3b532ea869779c4a11e80da88142f23a58
 SHA512:
-  metadata.gz: a00872e00399a98d2435b846b6742af2095624e1054c80079e98b94b8ca8fe92d0f114d13f67668b348dfd0d3ab972c00abeef33f58cc5caab90fcc7b94ba76a
-  data.tar.gz: f8c7dcce4c7e2513d272e53a4c187eba830c16d37483dd0678f60921660b6d8b22f3dc051d9e459b6c7d6363b0c4b518c7be6cccec0c8ef854512075e8c2fbea
+  metadata.gz: 7f2b508542a8c1b4b54273de73e37dafddeb453cfb26ececd8dc19f0600fecc140839c9cfe417d82f2dac25aa7d1f8a4c3f8907faf782dc5ec874ec8b4c8808d
+  data.tar.gz: f81fbbe0cafe17915422106dc8046ecd72225646a0cb747d62caa81c449f72c7f8d7674dbde8ac1d01683aa0b934392b63da2cddc19786bed33b7cfe7775c3dc

data/.circleci/config.yml

@@ -26,8 +26,9 @@ jobs:
           JAVA_OPTIONS: "-Djetty.http.port=8988"
       - image: fcrepo/fcrepo:6.5-tomcat9
         environment:
-          CATALINA_OPTS: "-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server -Xms512m -Xmx1024m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:PermSize=256m -XX:MaxPermSize=256m -XX:+DisableExplicitGC -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
-          JAVA_OPTS: "-Djetty.http.port=8978 -Dfcrepo.dynamic.jms.port=61619 -Dfcrepo.dynamic.stomp.port=61615 -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
+          CATALINA_OPTS: "-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server -Xms512m -Xmx1024m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:PermSize=256m -XX:MaxPermSize=256m -XX:+DisableExplicitGC"
+          JAVA_OPTS: "-Djetty.http.port=8978 -Dfcrepo.dynamic.jms.port=61619 -Dfcrepo.dynamic.stomp.port=61615"
+          ENCODED_SOLIDUS_HANDLING: "passthrough"
       - image: solr:9.9.0
         command: bin/solr -cloud -noprompt -f -p 8994
         environment:

data/.lando.yml

@@ -45,6 +45,7 @@ services:
       ports:
       - 8978:8080
       environment:
-        CATALINA_OPTS: "-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server -Xms512m -Xmx1024m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:PermSize=256m -XX:MaxPermSize=256m -XX:+DisableExplicitGC -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
-        JAVA_OPTS: "-Dfcrepo.dynamic.jms.port=61619 -Dfcrepo.dynamic.stomp.port=61615 -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true"
+        CATALINA_OPTS: "-Djava.awt.headless=true -Dfile.encoding=UTF-8 -server -Xms512m -Xmx1024m -XX:NewSize=256m -XX:MaxNewSize=256m -XX:PermSize=256m -XX:MaxPermSize=256m -XX:+DisableExplicitGC"
+        JAVA_OPTS: "-Dfcrepo.dynamic.jms.port=61619 -Dfcrepo.dynamic.stomp.port=61615"
+        ENCODED_SOLIDUS_HANDLING: "passthrough"
     portforward: true

data/Appraisals

@@ -5,8 +5,10 @@ end
 
 appraise "activerecord-8-0" do
   gem "activerecord", "~> 8.0.0"
+  gem "json", "< 3.0"
 end
 
 appraise "activerecord-7-2" do
   gem "activerecord", "~> 7.2.0"
+  gem "json", "< 3.0"
 end

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+# v3.6.2 2026-10-30
+
+* Prevent disk adapter from reading/writing outside base path. ([tpendragon](https://github.com/tpendragon))
+
+# v3.6.1 2026-07-30
+
+* Set binary encoding for fedora storage adapter responses. ([dlpierce](https://github.com/dlpierce))
+* Use new `ENCODED_SOLIDUS_HANDLING` option for OCFL Fedora containers. ([dlpierce](https://github.com/dlpierce))
+* Upgrade to simplecov 1.0. ([dlpierce](https://github.com/dlpierce))
+
 # v3.6.0 2026-07-23
 
 * Update dependencies. ([tpendragon](https://github.com/tpendragon))

data/gemfiles/activerecord_7_2.gemfile

@@ -7,5 +7,6 @@ gem "activerecord", "~> 7.2.0"
 gem "ldp"
 gem "pg"
 gem "rsolr"
+gem "json", "< 3.0"
 
 gemspec path: "../"

data/gemfiles/activerecord_8_0.gemfile

@@ -7,5 +7,6 @@ gem "activerecord", "~> 8.0.0"
 gem "ldp"
 gem "pg"
 gem "rsolr"
+gem "json", "< 3.0"
 
 gemspec path: "../"

data/lib/valkyrie/persistence/fedora.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# :nocov:
+# simplecov:disable
 begin
   gem 'ldp'
 rescue Gem::LoadError => e
@@ -7,7 +7,7 @@ rescue Gem::LoadError => e
         "You are using the Fedora adapter without installing the #{e.name} gem.  "\
         "Add `gem '#{e.name}'` to your Gemfile."
 end
-# :nocov:
+# simplecov:enable
 module Valkyrie::Persistence
   # Implements the DataMapper Pattern to store metadata into Fedora
   module Fedora

data/lib/valkyrie/persistence/postgres.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# :nocov:
+# simplecov:disable
 begin
   gem 'pg'
   gem 'activerecord'
@@ -8,7 +8,7 @@ rescue Gem::LoadError => e
         "You are using the Postgres adapter without installing the #{e.name} gem.  "\
         "Add `gem '#{e.name}'` to your Gemfile."
 end
-# :nocov:
+# simplecov:enable
 module Valkyrie::Persistence
   # Implements the DataMapper Pattern to store metadata into Postgres
   module Postgres

data/lib/valkyrie/persistence/solr.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
-# :nocov:
+# simplecov:disable
 begin
   gem 'rsolr'
 rescue Gem::LoadError => e
@@ -7,7 +7,7 @@ rescue Gem::LoadError => e
         "You are using the Solr adapter without installing the #{e.name} gem.  "\
         "Add `gem '#{e.name}'` to your Gemfile."
 end
-# :nocov:
+# simplecov:enable
 module Valkyrie::Persistence
   # Implements the DataMapper Pattern to store metadata into Solr
   module Solr

data/lib/valkyrie/specs/shared_specs/storage_adapter.rb

@@ -94,6 +94,7 @@ RSpec.shared_examples 'a Valkyrie::StorageAdapter' do
     expect(file).to respond_to(:read).with(0).arguments
     expect(file).to respond_to(:rewind).with(0).arguments
     expect(file.stream).to respond_to(:read)
+    expect(file.stream.external_encoding).to eq(Encoding::ASCII_8BIT)
     new_file = Tempfile.new
     expect { IO.copy_stream(file, new_file) }.not_to raise_error
 

data/lib/valkyrie/storage/disk.rb

@@ -18,6 +18,7 @@ module Valkyrie::Storage
     # @return [Valkyrie::StorageAdapter::File]
     def upload(file:, original_filename:, resource: nil, **_extra_arguments)
       new_path = path_generator.generate(resource: resource, file: file, original_filename: original_filename)
+      raise ArgumentError, "path must be within base_path" unless within_base_path?(new_path)
       FileUtils.mkdir_p(new_path.parent)
       file_mover.call(file.path, new_path)
       find_by(id: Valkyrie::ID.new("#{protocol}#{new_path}"))
@@ -26,7 +27,7 @@ module Valkyrie::Storage
     # @param id [Valkyrie::ID]
     # @return [Boolean] true if this adapter can handle this type of identifer
     def handles?(id:)
-      id.to_s.start_with?("#{protocol}#{base_path}")
+      id.to_s.start_with?(protocol) && within_base_path?(id.to_s.delete_prefix(protocol))
     end
 
     # @param feature [Symbol] Feature to test for.
@@ -41,7 +42,9 @@ module Valkyrie::Storage
     end
 
     def file_path(id)
-      id.to_s.delete_prefix(protocol)
+      path = id.to_s.delete_prefix(protocol)
+      raise Valkyrie::StorageAdapter::FileNotFound unless within_base_path?(path)
+      path
     end
 
     # Return the file associated with the given identifier
@@ -54,6 +57,12 @@ module Valkyrie::Storage
       raise Valkyrie::StorageAdapter::FileNotFound
     end
 
+    def within_base_path?(path)
+      expanded_base_path = File.expand_path(base_path)
+      expanded_path = File.expand_path(path)
+      expanded_path == expanded_base_path || expanded_path.start_with?("#{expanded_base_path}/")
+    end
+
     ## LazyFile takes File.open parameters but doesn't leave a file handle open on
     # instantiation. This way StorageAdapter#find_by doesn't open a handle
     # silently and never clean up after itself.

data/lib/valkyrie/storage/fedora.rb

@@ -196,7 +196,7 @@ module Valkyrie::Storage
 
     # @return [StringIO]
     def response(id:)
-      io = StringIO.new
+      io = StringIO.new.binmode
       response = connection.http.get(fedora_identifier(id: id)) do |request|
         request.options.on_data = proc { |chunk, _size| io.write(chunk) }
       end

data/lib/valkyrie/storage/versioned_disk.rb

@@ -23,6 +23,7 @@ module Valkyrie::Storage
     def upload(file:, original_filename:, resource: nil, paused: false, **extra_arguments)
       version_timestamp = current_timestamp
       new_path = path_generator.generate(resource: resource, file: file, original_filename: "v-#{version_timestamp}-#{original_filename}")
+      raise ArgumentError, "path must be within base_path" unless within_base_path?(new_path)
       # If we've gone faster than milliseconds here, pause a millisecond and
       # re-call. Probably only an issue for test suites.
       return sleep(0.001) && upload(file: file, original_filename: original_filename, resource: resource, paused: true, **extra_arguments) if !paused && File.exist?(new_path)
@@ -58,7 +59,7 @@ module Valkyrie::Storage
     # @param id [Valkyrie::ID]
     # @return [Boolean] true if this adapter can handle this type of identifer
     def handles?(id:)
-      id.to_s.start_with?("#{protocol}#{base_path}")
+      id.to_s.start_with?(protocol) && within_base_path?(id.to_s.delete_prefix(protocol))
     end
 
     # @param feature [Symbol] Feature to test for.
@@ -113,13 +114,22 @@ module Valkyrie::Storage
     end
 
     def file_path(version_id)
-      version_id.to_s.gsub(/^#{Regexp.escape(protocol)}/, '')
+      path = version_id.to_s.gsub(/^#{Regexp.escape(protocol)}/, '')
+      raise Valkyrie::StorageAdapter::FileNotFound unless within_base_path?(path)
+      path
+    end
+
+    def within_base_path?(path)
+      expanded_base_path = File.expand_path(base_path)
+      expanded_path = File.expand_path(path)
+      expanded_path == expanded_base_path || expanded_path.start_with?("#{expanded_base_path}/")
     end
 
     # @return VersionId A VersionId value that's resolved a current reference,
     #   so we can access the `version_id` and current reference.
     def version_id(id)
       id = VersionId.new(id)
+      raise Valkyrie::StorageAdapter::FileNotFound unless within_base_path?(id.file_path)
       return id unless id.versioned?
       id.resolve_current
     end

data/lib/valkyrie/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Valkyrie
-  VERSION = "3.6.0"
+  VERSION = "3.6.2"
 end

data/valkyrie.gemspec

@@ -43,7 +43,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "webmock"
   spec.add_development_dependency "pry-byebug"
   spec.add_development_dependency "database_cleaner"
-  spec.add_development_dependency "simplecov"
+  spec.add_development_dependency "simplecov", "~> 1.0"
   spec.add_development_dependency "bixby"
   spec.add_development_dependency 'yard'
   spec.add_development_dependency 'solr_wrapper'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: valkyrie
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.6.2
 platform: ruby
 authors:
 - Trey Pendragon
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-23 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-struct
@@ -312,16 +312,16 @@ dependencies:
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: bixby
   requirement: !ruby/object:Gem::Requirement