valkyrie 3.6.1 → 3.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 837b79c2c60f40a910f3aa60a9bc4a4ae66bd803d13c6ccbaac65d41ad060179
-  data.tar.gz: f503d2fdadbb6eebd349e09d474736e786d6243a7277d9c9e23b7a55a8a0789c
+  metadata.gz: 6c19142683e0f4cfdc60b4da2e25a5e0caa37ba49916469e86c15fe89ea147d6
+  data.tar.gz: a62e7d67469524073b275e057c69fc3b532ea869779c4a11e80da88142f23a58
 SHA512:
-  metadata.gz: 7995dcb171664fa75652e9493e20fcdb73a56737b53781a4cda51bb31ccf692b6430d2207ff6e9ac3b745c62b628b6c4f88bdb8927a9c7503befcc86b3d92105
-  data.tar.gz: 3efdae4dabe1cc27f8ac2311c6a5dd9bd55f2b839699b677b4d7098c7c58cb65bc44fa1d3213053fdc984cfee4d9428444035a5f918945c97a69721f3eef5be3
+  metadata.gz: 7f2b508542a8c1b4b54273de73e37dafddeb453cfb26ececd8dc19f0600fecc140839c9cfe417d82f2dac25aa7d1f8a4c3f8907faf782dc5ec874ec8b4c8808d
+  data.tar.gz: f81fbbe0cafe17915422106dc8046ecd72225646a0cb747d62caa81c449f72c7f8d7674dbde8ac1d01683aa0b934392b63da2cddc19786bed33b7cfe7775c3dc

data/Appraisals

@@ -5,8 +5,10 @@ end
 
 appraise "activerecord-8-0" do
   gem "activerecord", "~> 8.0.0"
+  gem "json", "< 3.0"
 end
 
 appraise "activerecord-7-2" do
   gem "activerecord", "~> 7.2.0"
+  gem "json", "< 3.0"
 end

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# v3.6.2 2026-10-30
+
+* Prevent disk adapter from reading/writing outside base path. ([tpendragon](https://github.com/tpendragon))
+
 # v3.6.1 2026-07-30
 
 * Set binary encoding for fedora storage adapter responses. ([dlpierce](https://github.com/dlpierce))

data/gemfiles/activerecord_7_2.gemfile

@@ -7,5 +7,6 @@ gem "activerecord", "~> 7.2.0"
 gem "ldp"
 gem "pg"
 gem "rsolr"
+gem "json", "< 3.0"
 
 gemspec path: "../"

data/gemfiles/activerecord_8_0.gemfile

@@ -7,5 +7,6 @@ gem "activerecord", "~> 8.0.0"
 gem "ldp"
 gem "pg"
 gem "rsolr"
+gem "json", "< 3.0"
 
 gemspec path: "../"

data/lib/valkyrie/storage/disk.rb

@@ -18,6 +18,7 @@ module Valkyrie::Storage
     # @return [Valkyrie::StorageAdapter::File]
     def upload(file:, original_filename:, resource: nil, **_extra_arguments)
       new_path = path_generator.generate(resource: resource, file: file, original_filename: original_filename)
+      raise ArgumentError, "path must be within base_path" unless within_base_path?(new_path)
       FileUtils.mkdir_p(new_path.parent)
       file_mover.call(file.path, new_path)
       find_by(id: Valkyrie::ID.new("#{protocol}#{new_path}"))
@@ -26,7 +27,7 @@ module Valkyrie::Storage
     # @param id [Valkyrie::ID]
     # @return [Boolean] true if this adapter can handle this type of identifer
     def handles?(id:)
-      id.to_s.start_with?("#{protocol}#{base_path}")
+      id.to_s.start_with?(protocol) && within_base_path?(id.to_s.delete_prefix(protocol))
     end
 
     # @param feature [Symbol] Feature to test for.
@@ -41,7 +42,9 @@ module Valkyrie::Storage
     end
 
     def file_path(id)
-      id.to_s.delete_prefix(protocol)
+      path = id.to_s.delete_prefix(protocol)
+      raise Valkyrie::StorageAdapter::FileNotFound unless within_base_path?(path)
+      path
     end
 
     # Return the file associated with the given identifier
@@ -54,6 +57,12 @@ module Valkyrie::Storage
       raise Valkyrie::StorageAdapter::FileNotFound
     end
 
+    def within_base_path?(path)
+      expanded_base_path = File.expand_path(base_path)
+      expanded_path = File.expand_path(path)
+      expanded_path == expanded_base_path || expanded_path.start_with?("#{expanded_base_path}/")
+    end
+
     ## LazyFile takes File.open parameters but doesn't leave a file handle open on
     # instantiation. This way StorageAdapter#find_by doesn't open a handle
     # silently and never clean up after itself.

data/lib/valkyrie/storage/versioned_disk.rb

@@ -23,6 +23,7 @@ module Valkyrie::Storage
     def upload(file:, original_filename:, resource: nil, paused: false, **extra_arguments)
       version_timestamp = current_timestamp
       new_path = path_generator.generate(resource: resource, file: file, original_filename: "v-#{version_timestamp}-#{original_filename}")
+      raise ArgumentError, "path must be within base_path" unless within_base_path?(new_path)
       # If we've gone faster than milliseconds here, pause a millisecond and
       # re-call. Probably only an issue for test suites.
       return sleep(0.001) && upload(file: file, original_filename: original_filename, resource: resource, paused: true, **extra_arguments) if !paused && File.exist?(new_path)
@@ -58,7 +59,7 @@ module Valkyrie::Storage
     # @param id [Valkyrie::ID]
     # @return [Boolean] true if this adapter can handle this type of identifer
     def handles?(id:)
-      id.to_s.start_with?("#{protocol}#{base_path}")
+      id.to_s.start_with?(protocol) && within_base_path?(id.to_s.delete_prefix(protocol))
     end
 
     # @param feature [Symbol] Feature to test for.
@@ -113,13 +114,22 @@ module Valkyrie::Storage
     end
 
     def file_path(version_id)
-      version_id.to_s.gsub(/^#{Regexp.escape(protocol)}/, '')
+      path = version_id.to_s.gsub(/^#{Regexp.escape(protocol)}/, '')
+      raise Valkyrie::StorageAdapter::FileNotFound unless within_base_path?(path)
+      path
+    end
+
+    def within_base_path?(path)
+      expanded_base_path = File.expand_path(base_path)
+      expanded_path = File.expand_path(path)
+      expanded_path == expanded_base_path || expanded_path.start_with?("#{expanded_base_path}/")
     end
 
     # @return VersionId A VersionId value that's resolved a current reference,
     #   so we can access the `version_id` and current reference.
     def version_id(id)
       id = VersionId.new(id)
+      raise Valkyrie::StorageAdapter::FileNotFound unless within_base_path?(id.file_path)
       return id unless id.versioned?
       id.resolve_current
     end

data/lib/valkyrie/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Valkyrie
-  VERSION = "3.6.1"
+  VERSION = "3.6.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: valkyrie
 version: !ruby/object:Gem::Version
-  version: 3.6.1
+  version: 3.6.2
 platform: ruby
 authors:
 - Trey Pendragon
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-30 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-struct