active_record_importer 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a9432ca865104e5e0298a6cc01cbdedd8d5e5512ab8418f54301731aad44994e
-  data.tar.gz: 84c9f8bd766fb6d81194b7c0ab44b65447f0fd18562bfc9b91630e4af6f861c4
+  metadata.gz: 930b3b6e3e51fbcf8558ea19900d24eb3ba4343d1d826dc5a9ec44fbc1e92f83
+  data.tar.gz: 15c62e17028d2aabdfe9a9769ab494f702d9f1f149b0861d3589db6de2da4b35
 SHA512:
-  metadata.gz: '09eb496352a2b2b29f3a79f033689167b6bf9f743e0b14da5364211e60e4176db44d821ea94d23250028eac4ada508171fbcfcfc45cc1a3f93b39c000e4c3608'
-  data.tar.gz: c0450b85a0cb842663939cf69f65dd1ac857f351bd761b4f9d1ef84eac39647edb177a644ccb03564a53622525bdb2d872b370b28e681836ecfbeb11dce58359
+  metadata.gz: 813d0f9dd1d2eb35226376b33c88cfff7c5e5a0df8c854df9b53624a75bef5f29a1b2d2c018276ab97ad11231b3e948c4f20c7252f550ddb2823061eae073f32
+  data.tar.gz: d203ca011e084dbe16c3c401eac87976ec5b103b2e53aff5cd16445bc32a04ab5f0acc13f3e9329cde64ac34829a74edfbb773503fb1a3e447bfc8cae946fd94

data/CHANGELOG.md

@@ -27,6 +27,8 @@
 - RSpec 3 for development.
 
 ### Fixed
+- Require Paperclip >= 5.2.0 to address CVE-2017-0889 (SSRF). URI attachment
+  adapters are no longer enabled by default; local file uploads remain supported.
 - Importer options were stored in a class variable shared by every importable model;
   each model now keeps its own options.
 - `default_attributes` given as `Proc` or `Symbol` were never evaluated, and

data/README.md

@@ -14,6 +14,15 @@ The spec suite runs against PostgreSQL and MySQL (ActiveRecord 7.2); see [Develo
 
 * Ruby >= 2.7
 * ActiveRecord >= 6.0
+* Paperclip >= 5.2.0 and < 7.0
+
+Paperclip's URI attachment adapters are disabled by default to prevent SSRF
+(CVE-2017-0889). Use local file uploads; do not re-enable URI adapters for
+untrusted input.
+
+When upgrading from Paperclip 4.x with S3 storage, use `aws-sdk-s3`, configure
+`s3_region`, and change explicit permissions such as `:public_read` to
+`'public-read'`.
 * PostgreSQL (>= 9.5) or MySQL for bulk upserts; other databases fall back to row-by-row saving
 
 I'll release an update to enable this on background job.

data/active_record_importer.gemspec

@@ -30,5 +30,5 @@ Gem::Specification.new do |spec|
   spec.add_runtime_dependency 'enumerize', '>= 2.0', '~> 2.0.1'
   spec.add_runtime_dependency 'virtus', '>= 1.0', '~> 1.0'
   spec.add_runtime_dependency 'smarter_csv', '>= 1.0', '~> 1.0'
-  spec.add_runtime_dependency 'paperclip', '>= 4.0', '~> 4.0'
+  spec.add_runtime_dependency 'paperclip', '>= 5.2.0', '< 7.0'
 end

data/lib/active_record_importer/version.rb

@@ -1,3 +1,3 @@
 module ActiveRecordImporter
-  VERSION = '1.0.0'
+  VERSION = '1.0.1'
 end

data/spec/active_record_importer_spec.rb

@@ -4,4 +4,30 @@ RSpec.describe ActiveRecordImporter do
   it 'has a version number' do
     expect(ActiveRecordImporter::VERSION).not_to be nil
   end
+
+  it 'requires a Paperclip version patched for CVE-2017-0889' do
+    spec = Gem::Specification.load(File.expand_path('../active_record_importer.gemspec', __dir__))
+    requirement = spec.runtime_dependencies.find { |dependency| dependency.name == 'paperclip' }.requirement
+
+    %w(3.1.4 4.2.4 5.1.0).each do |version|
+      expect(requirement.satisfied_by?(Gem::Version.new(version))).to be false
+    end
+    %w(5.2.0 6.1.0).each do |version|
+      expect(requirement.satisfied_by?(Gem::Version.new(version))).to be true
+    end
+  end
+
+  it 'does not register URI attachment adapters by default' do
+    adapters = Paperclip.io_adapters.registered_handlers.map(&:first)
+
+    expect(adapters).not_to include(Paperclip::UriAdapter, Paperclip::HttpUrlProxyAdapter)
+  end
+
+  it 'still accepts local CSV files as attachments' do
+    path = csv_file([{ first_name: 'Jane' }])
+
+    File.open(path) do |file|
+      expect(Paperclip.io_adapters.handler_for(file)).to eq(Paperclip::FileAdapter)
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: active_record_importer
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Michael Nera
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-23 00:00:00.000000000 Z
+date: 2026-10-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -146,20 +146,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
-    - - "~>"
+        version: 5.2.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '7.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '4.0'
-    - - "~>"
+        version: 5.2.0
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '4.0'
+        version: '7.0'
 description: Smart gem for importing CSV files to ActiveRecord models
 email:
 - kapitan_03@yahoo.com