Upgrading rubyzip 2 to 3
Breaking2.4.1 → 3.7.0Breaking3Security1New9Changed1Fixed1
Fetching 18 releases from GitHub…15 / 18
BreakingUpgrade verdict
3 breaking changes and a security fix.
In plain terms
- Upgrading from 2.4.x to 3.x may require code changes; the README and wiki explain how.
- This major version changes things in ways that can break existing code, so check the upgrade guide before switching from 2.4.x.
- This release changes the API in ways that can break existing code, so check the upgrade guide before updating.
- rubyzip path traversal vulnerability
Must act 4 items need code or config changes
Ruby requirement changed in 3.0.0.rc1: >= 2.4 → >= 3.0.
What you must change
Breaking3
Notes that the 3.x series contains breaking changes and points to upgrade guidance.
Version 3.x series contains breaking changes; see the README and wiki guide for upgrading from 2.4.x to 3.x.
Version 3.0.0 contains breaking API changes; see the README and the wiki guide for upgrading from 2.4.x.
Security1
rubyzip path traversal vulnerability
High · CVSS 7.5API changes
Generated by DepDelta from published Ruby source. Not mixed with prose notes.
- removed:
const Zip.V3_API_WARNING_MSG - removed:
const Zip.ZipCompressionMethodError - removed:
const Zip.ZipDestinationFileExistsError - removed:
const Zip.ZipEntryExistsError - removed:
const Zip.ZipEntryNameError - removed:
const Zip.ZipError - removed:
const Zip.ZipInternalError - removed:
static method Zip.warn_about_v3_api(_) - added:
const Zip.DEFAULT_RESTORE_OPTIONS - added:
const Zip.SPLIT_FILE_SIGNATURE - added:
const Zip.VERSION_NEEDED_TO_EXTRACT_AES - added:
const Zip.ZLIB_FLUSHING_STRATEGY - added:
property Zip.validate_declared_number_of_entries: accessor
- removed:
class DestinationFileExistsError < Error - removed:
class GPFBit3Error < Error - removed:
class InternalError < Error - removed:
class NullDecrypter < Decrypter - removed:
const CentralDirectory.END_OF_CDS - removed:
const CentralDirectory.MAX_END_OF_CDS_SIZE - removed:
const CentralDirectory.ZIP64_END_OF_CDS - removed:
const CentralDirectory.ZIP64_EOCD_LOCATOR - removed:
const File.CREATE - removed:
const File.DATA_BUFFER_SIZE - removed:
const File.DEFAULT_OPTIONS - removed:
const File.MAX_SEGMENT_SIZE - removed:
const File.MIN_SEGMENT_SIZE - removed:
const File.SPLIT_SIGNATURE - removed:
const File.ZIP64_EOCD_SIGNATURE - removed:
const IOExtras.RANGE_ALL - removed:
method CentralDirectory.each() - removed:
method CentralDirectory.entries() - removed:
method CentralDirectory.get_64_e_o_c_d(_) - removed:
method CentralDirectory.get_e_o_c_d(_) - removed:
method CentralDirectory.read_64_e_o_c_d(_) - removed:
method CentralDirectory.read_central_directory_entries(_) - removed:
method CentralDirectory.read_e_o_c_d(_) - removed:
method CentralDirectory.size() - removed:
method CentralDirectory.start_buf(_) - removed:
method CentralDirectory.zip64_file?(_) - removed:
method Entry.extract_v3(_ = …, destination_directory: …) - removed:
method Entry.read_c_dir_extra_field(_) - removed:
method ExtraField.create_unknown_item() - removed:
method File.extract_v3(_, _ = …, destination_directory: …) - removed:
method File.glob(*) - removed:
method NullDecrypter.decrypt(_) - removed:
method NullDecrypter.reset!(_) - removed:
property Entry.compression_method: accessor - removed:
property Entry.dirty: accessor - removed:
property Entry.ftype: reader - removed:
property Entry.header_signature: accessor - removed:
property Entry.zipfile: accessor - removed:
property EntrySet.entry_order: accessor - removed:
property File.comment: accessor - removed:
property OutputStream.comment: accessor - removed:
static method CentralDirectory.read_from_stream(_) - removed:
static method Entry.read_zip_64_long(_) - removed:
static method Entry.read_zip_long(_) - removed:
static method Entry.read_zip_short(_) - removed:
static method File.add_buffer() - removed:
static method File.get_partial_zip_file_name(_, _) - removed:
static method File.get_segment_count_for_split(_, _) - removed:
static method File.get_segment_size_for_split(_) - removed:
static method File.put_split_signature(_, _) - removed:
static method File.save_splited_part(_, _, _, _, _, _) - removed:
static method File.split(_, _ = …, _ = …, _ = …, segment_size: …, delete_zip_file: …, partial_zip_file_name: …) - removed:
static method InputStream.open_buffer(_, _ = …) - changed:
class File < CentralDirectory → class File - changed:
constructor DecryptedIo(_, _) → constructor DecryptedIo(_, _, _) - changed:
constructor Entry(_ = …, _ = …, *) → constructor Entry(_ = …, _ = …, comment: …, size: …, compressed_size: …, crc: …, compression_method: …, compression_level: …, time: …, extra: …) - changed:
constructor ExtraField(_ = …) → constructor ExtraField(_ = …, local: …) - changed:
constructor File(_, _ = …, _ = …, create: …, buffer: …, **) → constructor File(_, create: …, buffer: …, restore_ownership: …, restore_permissions: …, restore_times: …, compression_level: …, suppress_extra_fields: …) - changed:
constructor InputStream(_, _ = …, _ = …, offset: …, decrypter: …) → constructor InputStream(_, offset: …, decrypter: …, **) - changed:
constructor OutputStream(_, _ = …, _ = …, stream: …, encrypter: …) → constructor OutputStream(_, stream: …, encrypter: …, suppress_extra_fields: …, **) - changed:
constructor PassThruCompressor(_) → constructor PassThruCompressor(_, _ = …) - changed:
method CentralDirectory.write_to_stream(_) → method CentralDirectory.write_to_stream(_, suppress_extra_fields: …) - changed:
method DecryptedIo.read(_ = …, _ = …) → method DecryptedIo.read(_ = …) - changed:
method Entry.extract(_ = …) → method Entry.extract(_ = …, destination_directory: …, create_parent_directories: …) - changed:
method Entry.get_input_stream() → method Entry.get_input_stream(decrypter: …) - changed:
method Entry.mtime() → method Entry.mtime(component: …) - changed:
method Entry.time() → method Entry.time(component: …) - changed:
method Entry.write_c_dir_entry(_) → method Entry.write_c_dir_entry(_, suppress_extra_fields: …) - changed:
method Entry.write_local_entry(_, _ = …) → method Entry.write_local_entry(_, suppress_extra_fields: …, rewrite: …) - changed:
method ExtraField.extra_field_type_unknown(_, _, _) → method ExtraField.extra_field_type_unknown(_, _, _, _) - changed:
method ExtraField.merge(_) → method ExtraField.merge(_, local: …) - changed:
method File.extract(_, _) → method File.extract(_, _ = …, destination_directory: …) - changed:
method File.get_output_stream(_, _ = …, _ = …, _ = …, _ = …, _ = …, _ = …, _ = …, _ = …, permission_int: …, comment: …, extra: …, compressed_size: …, crc: …, compression_method: …, size: …, time: …) → method File.get_output_stream(_, permissions: …, comment: …, extra: …, compressed_size: …, crc: …, compression_method: …, compression_level: …, size: …, time: …) - changed:
method Inflater.read(_ = …, _ = …) → method Inflater.read(_ = …) - changed:
method NullDecompressor.eof?() → method NullDecompressor.eof() - changed:
method PassThruDecompressor.read(_ = …, _ = …) → method PassThruDecompressor.read(_ = …) - changed:
property CentralDirectory.comment: reader → property CentralDirectory.comment: accessor - changed:
property Entry.extra: accessor → property Entry.extra: reader - changed:
property Entry.size: accessor → property Entry.size: writer - changed:
property EntrySet.entry_set: accessor → protected property EntrySet.entry_set: reader - changed:
protected method InputStream.get_decompressor() → protected method InputStream.get_decompressor(_) - changed:
protected method InputStream.produce_input() → protected method InputStream.produce_input(_ = …) - changed:
set Entry.time(_) → set Entry.time(_, component: …) - changed:
static method File.open(_, _ = …, create: …, **) → static method File.open(_, create: …, restore_ownership: …, restore_permissions: …, restore_times: …, compression_level: …, suppress_extra_fields: …) - changed:
static method File.open_buffer(_, **) → static method File.open_buffer(_ = …, create: …, restore_ownership: …, restore_permissions: …, restore_times: …, compression_level: …, suppress_extra_fields: …) - changed:
static method InputStream.open(_, _ = …, _ = …, offset: …, decrypter: …) → static method InputStream.open(_, offset: …, decrypter: …, **) - changed:
static method NullDecompressor.eof() → static method NullDecompressor.eof?() - changed:
static method OutputStream.open(_, _ = …, encrypter: …) → static method OutputStream.open(_, encrypter: …, suppress_extra_fields: …, **) - changed:
static method OutputStream.write_buffer(_ = …, _ = …, encrypter: …) → static method OutputStream.write_buffer(_ = …, encrypter: …, suppress_extra_fields: …, **) - added:
class AESDecrypter < Decrypter - added:
class AESEncrypter < Encrypter - added:
class DestinationExistsError < Error - added:
class EntryNumberMismatchError < Error - added:
class SplitArchiveError < Error - added:
class StreamingError < Error - added:
const AESEncryption.AUTHENTICATION_CODE_LENGTH - added:
const AESEncryption.BITS - added:
const AESEncryption.BLOCK_SIZE - added:
const AESEncryption.KEY_LENGTHS - added:
const AESEncryption.SALT_LENGTHS - added:
const AESEncryption.STRENGTHS - added:
const AESEncryption.STRENGTH_128_BIT - added:
const AESEncryption.STRENGTH_192_BIT - added:
const AESEncryption.STRENGTH_256_BIT - added:
const AESEncryption.VERIFIER_LENGTH - added:
const AESEncryption.VERSIONS - added:
const AESEncryption.VERSION_AE_1 - added:
const AESEncryption.VERSION_AE_2 - added:
const CentralDirectory.END_OF_CD_SIG - added:
const CentralDirectory.MAX_END_OF_CD_SIZE - added:
const CentralDirectory.MAX_FILE_COMMENT_SIZE - added:
const CentralDirectory.ZIP64_END_OF_CD_SIG - added:
const CentralDirectory.ZIP64_EOCD_LOCATOR_SIG - added:
const CentralDirectory.ZIP64_EOCD_LOC_SIZE - added:
const CentralDirectory.ZIP64_STATIC_EOCD_SIZE - added:
const DOSTime.DOS_EPOCH_YEAR - added:
const DOSTime.DOS_MAX_DATE - added:
const DOSTime.DOS_MAX_TIME - added:
const DOSTime.DOS_MAX_YEAR - added:
const DOSTime.DOS_MIN_DATE - added:
const DOSTime.DOS_MIN_TIME - added:
const Entry.COMPRESSION_LEVEL_FAST_GPFLAG - added:
const Entry.COMPRESSION_LEVEL_MAX_GPFLAG - added:
const Entry.COMPRESSION_LEVEL_SUPERFAST_GPFLAG - added:
const FileSplit.DATA_BUFFER_SIZE - added:
const FileSplit.MAX_SEGMENT_SIZE - added:
const FileSplit.MIN_SEGMENT_SIZE - added:
constructor AESEncryption(_, _) - added:
constructor CompressionMethodError(_) - added:
constructor DecompressionError(_) - added:
constructor DestinationExistsError(_) - added:
constructor Dirtyable(dirty_on_create: …) - added:
constructor EntryExistsError(_, _) - added:
constructor EntryNameError(_ = …) - added:
constructor EntryNumberMismatchError(_, _) - added:
constructor EntrySizeError(_) - added:
constructor StreamingError(_) - added:
method AESDecrypter.check_integrity!(_) - added:
method AESDecrypter.decrypt(_) - added:
method AESDecrypter.reset!(_) - added:
method AESEncrypter.crc(_) - added:
method AESEncrypter.data_descriptor(*) - added:
method AESEncrypter.encrypt(_) - added:
method AESEncrypter.header(_) - added:
method AESEncrypter.prepare_entry(_) - added:
method AESEncrypter.reset!() - added:
method AESEncrypter.trailer() - added:
method AESEncryption.gp_flags() - added:
method AESEncryption.header_bytesize() - added:
method CentralDirectory.count_entries(_) - added:
method CompressionMethodError.message() - added:
method DOSTime.absolute_time?() - added:
method DecompressionError.message() - added:
method DestinationExistsError.message() - added:
method Dirtyable.dirty?() - added:
method Encrypter.crc(_) - added:
method Encrypter.prepare_entry(_) - added:
method Encrypter.trailer() - added:
method Entry.absolute_time?() - added:
method Entry.aes?() - added:
method Entry.atime() - added:
method Entry.compression_method() - added:
method Entry.ctime() - added:
method Entry.ftype() - added:
method Entry.prep_aes_extra(_, _) - added:
method Entry.read_extra_field(_, local: …) - added:
method Entry.size() - added:
method Entry.zip64?() - added:
method EntryExistsError.message() - added:
method EntryNameError.message() - added:
method EntryNumberMismatchError.message() - added:
method EntrySizeError.message() - added:
method ExtraField.suppress_fields!(_) - added:
method File.add_recursive(_, prefix: …, max_depth: …) - added:
method File.extract_all(_ = …) - added:
method FileSplit.get_partial_zip_file_name(_, _) - added:
method FileSplit.get_segment_count_for_split(_, _) - added:
method FileSplit.get_segment_size_for_split(_) - added:
method FileSplit.put_split_signature(_, _) - added:
method FileSplit.save_splited_part(_, _, _, _, _, _) - added:
method FileSplit.split(_, segment_size: …, delete_original: …, partial_zip_file_name: …) - added:
method InputStream.size() - added:
method SplitArchiveError.message() - added:
method StreamingError.message() - added:
method TraditionalDecrypter.check_integrity!(_) - added:
module AESEncryption - added:
module Dirtyable - added:
module FileSplit - added:
property CompressionMethodError.compression_method: reader - added:
property DOSTime.absolute_time: writer - added:
property DecompressionError.zlib_error: reader - added:
property Entry.compression_level: reader - added:
property EntrySizeError.entry: reader - added:
property StreamingError.entry: reader - added:
protected method InputStream.assemble_io() - added:
set Entry.atime(_) - added:
set Entry.compression_method(_) - added:
set Entry.ctime(_) - added:
set Entry.mtime=(_, component: …) - added:
static method File.add_recursive(_, _, prefix: …, max_depth: …) - added:
static method File.count_entries(_) - added:
static method File.extract_all(_, _ = …)
- added:
method JRubyCMP.<(_) - added:
method JRubyCMP.<=(_) - added:
method JRubyCMP.==(_) - added:
method JRubyCMP.>(_) - added:
method JRubyCMP.>=(_) - added:
module JRubyCMP
- added:
method ClassMethods.mark_dirty(*) - added:
module ClassMethods
- removed:
class Zip64Placeholder < ExtraField::Generic - removed:
const Zip64Placeholder.HEADER_ID - removed:
constructor Zip64Placeholder(_ = …) - removed:
method Generic.==(_) - removed:
method Zip64Placeholder.pack_for_local() - added:
class AES < ExtraField::Generic - added:
class Unknown < ExtraField::Generic - added:
const AES.HEADER_ID - added:
constructor AES(_ = …) - added:
constructor Unknown() - added:
method AES.==(_) - added:
method AES.merge(_) - added:
method AES.pack_for_c_dir() - added:
method AES.pack_for_local() - added:
method AES.suppress?() - added:
method Generic.suppress?() - added:
method Unknown.==(_) - added:
method Unknown.merge(_, local: …) - added:
method Unknown.to_c_dir_bin() - added:
method Unknown.to_local_bin() - added:
method Zip64.suppress?() - added:
property AES.compression_method: accessor - added:
property AES.encryption_strength: accessor - added:
property AES.vendor_id: accessor - added:
property AES.vendor_version: accessor
- removed:
class ZipFsDir - removed:
class ZipFsDirIterator - removed:
class ZipFsFile - removed:
constructor ZipFsDir(_) - removed:
constructor ZipFsDirIterator(_) - removed:
constructor ZipFsFile(_) - removed:
method ZipFsDir.chdir(_) - removed:
method ZipFsDir.chroot(*) - removed:
method ZipFsDir.delete(_) - removed:
method ZipFsDir.entries(_) - removed:
method ZipFsDir.foreach(_) - removed:
method ZipFsDir.getwd() - removed:
method ZipFsDir.glob(*) - removed:
method ZipFsDir.mkdir(_, _ = …) - removed:
method ZipFsDir.new(_) - removed:
method ZipFsDir.open(_) - removed:
method ZipFsDir.pwd() - removed:
method ZipFsDir.rmdir(_) - removed:
method ZipFsDir.unlink(_) - removed:
method ZipFsDirIterator.close() - removed:
method ZipFsDirIterator.each() - removed:
method ZipFsDirIterator.read() - removed:
method ZipFsDirIterator.rewind() - removed:
method ZipFsDirIterator.seek(_) - removed:
method ZipFsDirIterator.tell() - removed:
method ZipFsFile.atime(_) - removed:
method ZipFsFile.basename(_) - removed:
method ZipFsFile.blockdev?(_) - removed:
method ZipFsFile.chardev?(_) - removed:
method ZipFsFile.chmod(_, *) - removed:
method ZipFsFile.chown(_, _, *) - removed:
method ZipFsFile.ctime(_) - removed:
method ZipFsFile.delete(*) - removed:
method ZipFsFile.directory?(_) - removed:
method ZipFsFile.dirname(_) - removed:
method ZipFsFile.executable?(_) - removed:
method ZipFsFile.executable_real?(_) - removed:
method ZipFsFile.exist?(_) - removed:
method ZipFsFile.exists?(_) - removed:
method ZipFsFile.expand_path(_) - removed:
method ZipFsFile.file?(_) - removed:
method ZipFsFile.foreach(_, _ = …) - removed:
method ZipFsFile.ftype(_) - removed:
method ZipFsFile.grpowned?(_) - removed:
method ZipFsFile.join(*) - removed:
method ZipFsFile.link(_, _) - removed:
method ZipFsFile.lstat(_) - removed:
method ZipFsFile.mtime(_) - removed:
method ZipFsFile.new(_, _ = …) - removed:
method ZipFsFile.open(_, _ = …, _ = …) - removed:
method ZipFsFile.owned?(_) - removed:
method ZipFsFile.pipe() - removed:
method ZipFsFile.pipe?(_) - removed:
method ZipFsFile.popen(*) - removed:
method ZipFsFile.read(_) - removed:
method ZipFsFile.readable?(_) - removed:
method ZipFsFile.readable_real?(_) - removed:
method ZipFsFile.readlines(_) - removed:
method ZipFsFile.readlink(_) - removed:
method ZipFsFile.rename(_, _) - removed:
method ZipFsFile.setgid?(_) - removed:
method ZipFsFile.setuid?(_) - removed:
method ZipFsFile.size(_) - removed:
method ZipFsFile.size?(_) - removed:
method ZipFsFile.socket?(_) - removed:
method ZipFsFile.split(_) - removed:
method ZipFsFile.stat(_) - removed:
method ZipFsFile.sticky?(_) - removed:
method ZipFsFile.symlink(_, _) - removed:
method ZipFsFile.symlink?(_) - removed:
method ZipFsFile.truncate(_, _) - removed:
method ZipFsFile.umask(*) - removed:
method ZipFsFile.unlink(*) - removed:
method ZipFsFile.utime(_, *) - removed:
method ZipFsFile.writable?(_) - removed:
method ZipFsFile.writable_real?(_) - removed:
method ZipFsFile.zero?(_) - removed:
property ZipFsDir.file: writer - removed:
property ZipFsFile.dir: writer - added:
class Dir - added:
class DirectoryIterator - added:
class File - added:
constructor Dir(_) - added:
constructor DirectoryIterator(_) - added:
constructor File(_) - added:
method Dir.chdir(_) - added:
method Dir.chroot(*) - added:
method Dir.delete(_) - added:
method Dir.entries(_) - added:
method Dir.foreach(_) - added:
method Dir.getwd() - added:
method Dir.glob(...) - added:
method Dir.mkdir(_, _ = …) - added:
method Dir.new(_) - added:
method Dir.open(_) - added:
method Dir.pwd() - added:
method Dir.rmdir(_) - added:
method Dir.unlink(_) - added:
method DirectoryIterator.close() - added:
method DirectoryIterator.each() - added:
method DirectoryIterator.read() - added:
method DirectoryIterator.rewind() - added:
method DirectoryIterator.seek(_) - added:
method DirectoryIterator.tell() - added:
method File.atime(_) - added:
method File.basename(_) - added:
method File.blockdev?(_) - added:
method File.chardev?(_) - added:
method File.chmod(_, *) - added:
method File.chown(_, _, *) - added:
method File.ctime(_) - added:
method File.delete(*) - added:
method File.directory?(_) - added:
method File.dirname(_) - added:
method File.executable?(_) - added:
method File.executable_real?(_) - added:
method File.exist?(_) - added:
method File.exists?(_) - added:
method File.expand_path(_) - added:
method File.file?(_) - added:
method File.find_entry(_) - added:
method File.foreach(_, _ = …) - added:
method File.ftype(_) - added:
method File.grpowned?(_) - added:
method File.join(*) - added:
method File.link(_, _) - added:
method File.lstat(_) - added:
method File.mtime(_) - added:
method File.new(_, _ = …) - added:
method File.open(_, _ = …, _ = …) - added:
method File.owned?(_) - added:
method File.pipe() - added:
method File.pipe?(_) - added:
method File.popen(*) - added:
method File.read(_) - added:
method File.readable?(_) - added:
method File.readable_real?(_) - added:
method File.readlines(_) - added:
method File.readlink(_) - added:
method File.rename(_, _) - added:
method File.setgid?(_) - added:
method File.setuid?(_) - added:
method File.size(_) - added:
method File.size?(_) - added:
method File.socket?(_) - added:
method File.split(_) - added:
method File.stat(_) - added:
method File.sticky?(_) - added:
method File.symlink(_, _) - added:
method File.symlink?(_) - added:
method File.truncate(_, _) - added:
method File.umask(*) - added:
method File.unlink(*) - added:
method File.utime(_, *) - added:
method File.writable?(_) - added:
method File.writable_real?(_) - added:
method File.zero?(_) - added:
property Dir.file: writer - added:
property File.dir: writer
- added:
class Stat - added:
constructor Stat(_, _) - added:
method Stat.blksize() - added:
method Stat.blocks() - added:
method Stat.dev() - added:
method Stat.ftype() - added:
method Stat.gid() - added:
method Stat.ino() - added:
method Stat.kind_of?(_) - added:
method Stat.mode() - added:
method Stat.nlink() - added:
method Stat.rdev() - added:
method Stat.rdev_major() - added:
method Stat.rdev_minor() - added:
method Stat.uid() - added:
static method Stat.delegate_to_fs_file(*)
- removed:
class ZipFsStat - removed:
constructor ZipFsStat(_, _) - removed:
method ZipFsStat.blksize() - removed:
method ZipFsStat.blocks() - removed:
method ZipFsStat.dev() - removed:
method ZipFsStat.ftype() - removed:
method ZipFsStat.gid() - removed:
method ZipFsStat.ino() - removed:
method ZipFsStat.kind_of?(_) - removed:
method ZipFsStat.mode() - removed:
method ZipFsStat.nlink() - removed:
method ZipFsStat.rdev() - removed:
method ZipFsStat.rdev_major() - removed:
method ZipFsStat.rdev_minor() - removed:
method ZipFsStat.uid() - removed:
static method ZipFsStat.delegate_to_fs_file(*)
- changed:
constructor AbstractInputStream() → constructor AbstractInputStream(**) - changed:
method AbstractInputStream.each(_ = …) → method AbstractInputStream.each(_ = …, _ = …, chomp: …) - changed:
method AbstractInputStream.each_line(_ = …) → method AbstractInputStream.each_line(_ = …, _ = …, chomp: …) - changed:
method AbstractInputStream.gets(_ = …, _ = …) → method AbstractInputStream.gets(_ = …, _ = …, chomp: …) - changed:
method AbstractInputStream.readline(_ = …) → method AbstractInputStream.readline(_ = …, _ = …, chomp: …) - changed:
method AbstractInputStream.readlines(_ = …) → method AbstractInputStream.readlines(_ = …, _ = …, chomp: …) - added:
constructor FakeIO(**) - added:
method FakeIO.set_encoding(_, _ = …) - added:
property FakeIO.external_encoding: reader - added:
property FakeIO.internal_encoding: reader