Comments (6)
There is a vulnerability in rubyzip < 1.3: rubyzip/rubyzip#403
from axlsx.
There’s now a community-supported fork of axlsx: https://github.com/caxlsx/caxlsx
Versions 2.0.2 and 3.0.x have been released, both supporting newer versions of Rubyzip. See https://rubygems.org/gems/caxlsx/versions/3.0.1
from axlsx.
By unlock, I do not mean allowing rubyzip
versions prior to 1.3. I mean allowing people to use axlsx
gem with rubyzip >= 1.3
and so rubyzip >= 2
.
from axlsx.
@Apokly I've had success with the following polyfill on rubyzip == 1.2.1
. YMMV.
edit: simplified it, but misread the question. regardless; useful nonetheless.
Place a file ``zip.rb'' as below
lib/
zip/
zip.rb
zip.rb
# Polyfill to make AXLSX package work with v1.2.x `zip` which no longer defines `Zip::Zip`
require 'zip'
require 'zip/output_stream'
module Zip
class ZipOutputStream < OutputStream
def initialize(filename, stream = false)
if stream
filename = StringIO.new
end
super(filename, stream)
end
end
end
from axlsx.
Note: there have since been more critical vulnerabilities discovered in rubyzip
v1.0.0:
Taking a serious look at https://github.com/caxlsx/caxlsx ...
from axlsx.
As far as I understand, both vulnerabilities are in the context of extracting archives. Axlsx only creates archives.
However, it’s a very bad idea to have a vulnerable version of Rubyzip in your project at all, so please upgrade to at least caxlsx 2.0.2 or 3.0.1.
In caxlsx it's also possible to use an external zip program instead of Rubyzip, see https://www.rubydoc.info/gems/caxlsx/Axlsx/Package#serialize-instance_method
from axlsx.
Related Issues (20)
- Some formulas do not work in Axlsx
- Title not set in LineChart.
- Mutiple thread error file HOT 2
- Conditionnal formating
- outline_level_rows bag
- Stacked bar chart plotted as staircased HOT 3
- formula1 dont work on add_data_validation HOT 1
- Numbers as text HOT 1
- Low-order non-printable ASCII characters in worksheet name should be escaped or removed HOT 5
- Performance reduction with rails 5.2 HOT 2
- undefined method `downcase' when call the serialize method HOT 2
- rubyzip dependency is old
- Deployment not working (mimemagic (0.3.0) - version could not be found HOT 5
- dependent drop-down list
- Axlsx indent not working HOT 1
- DropDownList selected NAME get ID
- can't modify frozen String when run with --enable=frozen-string-literal flag HOT 1
- Stacked bar chart example not working HOT 1
- Error when opening xlsx file from OneDrive but not from other programs HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from axlsx.