barseghyanartur / safezip / 38978953462

92%

main: 90%

Build Type

push

github

Committed by web-flow

Commit Message

Release 0.2.1: harden entry-count, staging file and env-limit handling (#123)

* Harden entry-count, staging file and env-limit handling

- Guard: count central directory entries before zipfile.ZipFile parses
  the archive (precheck_entry_count), so max_files bounds memory use.
  Walks headers by directory byte size like zipfile, ignores the declared
  EOCD count, handles prepended data and both ZIP64 offset conventions.
- Streamer: create the staging file with O_CREAT | O_EXCL so a planted
  symlink, dangling symlink or file is never followed or overwritten;
  extracted file permissions are unchanged.
- Core: ignore nan/inf/non-positive ratio env values (nan disabled the
  ratio checks) and log every unusable env value.
- Tests patch only safezip._streamer._staging_path; the pre-parse check is
  shown by peak tracemalloc usage instead of patching zipfile.
- Docs: correct the in-memory overlap-detection note, document the CLI and
  SAFEZIP_RECURSIVE, describe recursive=True in AGENTS.md, list 0.2.x as
  supported in SECURITY.rst.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Release 0.2.1

- Bump version to 0.2.1 and add the CHANGELOG entry.
- sphinx-source-tree: fix the ignore entry for docs/full_llms.rst (it was
  spelled full-llms.rst, so the file included itself) and exclude local
  tooling paths (.agents, .claude, .markdownlint.json, .tokensave).
- Add `make source-tree`; build-docs now depends on it.
- Regenerate docs/llms.rst and docs/full_llms.rst.
- Update .secrets.baseline line numbers shifted by the Makefile change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

340 of 340 new or added lines in 8 files covered. (100.0%)

3 existing lines in 2 files now uncovered.

2461 of 2688 relevant lines covered (91.56%)

4.57 hits per line