Add ZIP and TAR format support, fix StringIO bug, and improve thread safety#6
Open
Add ZIP and TAR format support, fix StringIO bug, and improve thread safety#6
Conversation
jkorany
force-pushed
the
multi-format-support-and-fixes
branch
2 times, most recently
from
1de83c0 to
7bb4781
Compare
- Fix NameError when open_buffer is called without stringio loaded by adding `require "stringio"` to reader.rb - Wire ZIP and TAR format GUIDs through the C++ bridge so that format: SZ_FORMAT_ZIP and format: SZ_FORMAT_TAR actually work end-to-end (previously hardcoded to 7z GUID only) - Vendor the Zip and Tar archive handlers plus their compression and crypto dependencies from the 7-Zip SDK (v25.01), including BitlDecoder.cpp and Synchronization.cpp for Linux compatibility - Link -lpthread on Linux for POSIX synchronization primitives - Remove the C API code path entirely, unifying all formats on the C++ COM API. This eliminates a TOCTOU vulnerability where extractToMemory re-opened archives by path, simplifies every ArchiveReader method by removing dual-path branching, and shrinks cpp_bridge.cpp by ~370 lines - Bump archive bomb compression ratio limit from 1000:1 to 10000:1 to accommodate legitimate LZMA2 ratios now that the C++ API correctly reports compressed_size (the old C API returned 0) - Update Format.supported? to return true for ZIP and TAR - Add comprehensive multi-format RSpec tests (ZIP, TAR, encrypted ZIP, open_buffer with String/StringIO, 7z regression)
jkorany
force-pushed
the
multi-format-support-and-fixes
branch
from
7bb4781 to
7e0498c
Compare
jkorany
commented
Feb 9, 2026
| @@ -0,0 +1,105 @@ | |||
| /* Blake2.h -- BLAKE2sp Hash | |||
Collaborator
Author
There was a problem hiding this comment.
This directory contains lzma_sdk files that were added for Zip support - ignore the source changes in lzma_sdk (unless you want to learn more about 7zip's SDK)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
StringIONameError --open_bufferreferencesStringIOwithout requiring it, causing aNameErrorwhenstringiohasn't been loaded in the calling context (e.g. outside Rails). Addedrequire "stringio"toreader.rb.format: SZ_FORMAT_ZIPandformat: SZ_FORMAT_TARsilently failed. RefactoredInit7zFormatGUIDtoInitFormatGUID(guid, format)to dynamically set the correct GUID byte for each format (7z =0x07, ZIP =0x01, TAR =0xEE).Archive/Zip/,Archive/Tar/, and all their compression/crypto dependencies (Deflate, BZip2, WzAes, ZipCrypto, Zstd, Ppmd, etc.) from the 7-Zip SDK v25.01. IncludesBitlDecoder.cpp(x86_64 reverse-bits table) andSynchronization.cpp(POSIX WFMO vtables). Updatedextconf.rbwith the new include directories, source files, and-lpthreadon Linux.extractToMemoryre-opened archives by path), removes ~370 lines of dual-path branching fromcpp_bridge.cpp, and simplifiesImplfrom 7 fields to 1.compressed_sizefor all formats (the old C API returned 0 for 7z). LZMA2 legitimately achieves 1,000-5,000:1 on repetitive data, while real archive bombs exceed 1,000,000:1.Format.supported?-- Now returnstruefor ZIP and TAR.Test plan
bundle exec rspec)spec/archive/multi_format_spec.rbcovers:open_bufferwith String and StringIO for both ZIP and 7z