Merge pull request #133.

philr · philr · commit 6a4766e16c85 · 2022-07-17T12:12:35.000+01:00
diff --git a/lib/tzinfo/data_sources/zoneinfo_data_source.rb b/lib/tzinfo/data_sources/zoneinfo_data_source.rb
@@ -78,6 +78,26 @@ class ZoneinfoDataSource < DataSource
       DEFAULT_ALTERNATE_ISO3166_TAB_SEARCH_PATH = ['/usr/share/misc/iso3166.tab', '/usr/share/misc/iso3166'].freeze
       private_constant :DEFAULT_ALTERNATE_ISO3166_TAB_SEARCH_PATH
 
+      # Ignoring particular files:
+      # +VERSION is included on Mac OS X.
+      # leapseconds is a list of leap seconds.
+      # localtime is the current local timezone (may be a link).
+      # posix, posixrules and right are directories containing other versions of
+      #   the zoneinfo files.
+      # SECURITY is included in Arch tzdata package.
+      # src is a directory containing the tzdata source included on Solaris.
+      # timeconfig is a symlink included on Slackware.
+      EXCLUDED_FILENAMES = ['+VERSION',
+                            'leapseconds',
+                            'localtime',
+                            'posix',
+                            'posixrules',
+                            'right',
+                            'SECURITY',
+                            'src',
+                            'timeconfig']
+      private_constant :EXCLUDED_FILENAMES
+
       # Paths to be checked to find the system zoneinfo directory.
       #
       # @private
@@ -394,15 +414,7 @@ def find_zoneinfo_dir
       def load_timezone_identifiers
         index = []
 
-        # Ignoring particular files:
-        # +VERSION is included on Mac OS X.
-        # leapseconds is a list of leap seconds.
-        # localtime is the current local timezone (may be a link).
-        # posix, posixrules and right are directories containing other versions of the zoneinfo files.
-        # src is a directory containing the tzdata source included on Solaris.
-        # timeconfig is a symlink included on Slackware.
-
-        enum_timezones([], ['+VERSION', 'leapseconds', 'localtime', 'posix', 'posixrules', 'right', 'src', 'timeconfig']) do |identifier|
+        enum_timezones([], EXCLUDED_FILENAMES) do |identifier|
           index << identifier.join('/').freeze
         end
 
diff --git a/test/data_sources/tc_zoneinfo_data_source.rb b/test/data_sources/tc_zoneinfo_data_source.rb
@@ -1082,6 +1082,25 @@ def test_timezone_identifiers_ignored_src_directory
       end
     end
 
+    def test_timezone_identifiers_ignored_security_file
+      # Arch tzdata package includes a file named SECURITY giving instructions
+      # to report any security-related bug.
+
+      Dir.mktmpdir('tzinfo_test') do |dir|
+        FileUtils.touch(File.join(dir, 'zone.tab'))
+        FileUtils.touch(File.join(dir, 'iso3166.tab'))
+        FileUtils.cp(File.join(@data_source.zoneinfo_dir, 'EST'), File.join(dir, 'EST'))
+
+        File.open(File.join(dir, 'SECURITY'), 'w') do |f|
+          f.binmode
+          f.write("2013a\n")
+        end
+
+        data_source = ZoneinfoDataSource.new(dir)
+        assert_equal(['EST'], data_source.timezone_identifiers)
+      end
+    end
+
     def test_load_country_info
       info = @data_source.send(:load_country_info, 'GB')
       assert_equal('GB', info.code)
