8000 Bump version to 2.0.0 · rubyzip/rubyzip@cb407b1 · GitHub
[go: up one dir, main page]
Skip to content

Commit cb407b1

Browse files
jdleesmillerjdleesmiller
committed
Bump version to 2.0.0
1 parent e1d9af6 commit cb407b1

File tree

4 files changed

+15
-9
lines changed

4 files changed

+15
-9
lines changed

‎Changelog.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,18 @@
22

33
-
44

5+
# 2.0.0 (2019-09-25)
6+
7+
Security
8+
9+
- Default the `validate_entry_sizes` option to `true`, so that callers can trust an entry's reported size when using `extract` [#403](https://github.com/rubyzip/rubyzip/pull/403)
10+
- This option defaulted to `false` in 1.3.0 for backward compatibility, but it now defaults to `true`. If you are using an older version of ruby and can't yet upgrade to 2.x, you can still use 1.3.0 and set the option to `true`.
11+
12+
Tooling / Documentation
13+
14+
- Remove test files from the gem to avoid problems with antivirus detections on the test files [#405](https://github.com/rubyzip/rubyzip/pull/405) / [#384](https://github.com/rubyzip/rubyzip/issues/384)
15+
- Drop support for unsupported ruby versions [#406](https://github.com/rubyzip/rubyzip/pull/406)
16+
517
# 1.3.0 (2019-09-25)
618

719
Security

‎README.md

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -265,13 +265,7 @@ Zip.warn_invalid_date = false
265265

266266
### Size Validation
267267

268-
**This setting defaults to `false` in rubyzip 1.3 for backward compatibility, but it will default to `true` in rubyzip 2.0.**
269-
270-
If you set
271-
```
272-
Zip.validate_entry_sizes = true
273-
```
274-
then `rubyzip`'s `extract` method checks that an entry's reported uncompressed size is not (significantly) smaller than its actual size. This is to help you protect your application against [zip bombs](https://en.wikipedia.org/wiki/Zip_bomb). Before `extract`ing an entry, you should check that its size is in the range you expect. For example, if your application supports processing up to 100 files at once, each up to 10MiB, your zip extraction code might look like:
268+
By default (in rubyzip >= 2.0), rubyzip's `extract` method checks that an entry's reported uncompressed size is not (significantly) smaller than its actual size. This is to help you protect your application against [zip bombs](https://en.wikipedia.org/wiki/Zip_bomb). Before `extract`ing an entry, you should check that its size is in the range you expect. For example, if your application supports processing up to 100 files at once, each up to 10MiB, your zip extraction code might look like:
275269

276270
```ruby
277271
MAX_FILE_SIZE = 10 * 1024**2 # 10MiB

‎lib/zip.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ def reset!
5555
@write_zip64_support = false
5656
@warn_invalid_date = true
5757
@case_insensitive_match = false
58-
@validate_entry_sizes = false
58+
@validate_entry_sizes = true
5959
end
6060

6161
def setup

‎lib/zip/version.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
module Zip
2-
VERSION = '1.3.0'
2+
VERSION = '2.0.0'
33
end

0 commit comments

Comments
 (0)
0