active_storage_validations 1.1.4 → 1.3.0

data/lib/active_storage_validations/aspect_ratio_validator.rb

@@ -1,13 +1,16 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
+require_relative 'concerns/metadatable.rb'
 require_relative 'concerns/symbolizable.rb'
-require_relative 'metadata.rb'
 
 module ActiveStorageValidations
   class AspectRatioValidator < ActiveModel::EachValidator # :nodoc
-    include OptionProcUnfolding
+    include ActiveStorageable
     include Errorable
+    include Metadatable
+    include OptionProcUnfolding
     include Symbolizable
 
     AVAILABLE_CHECKS = %i[with].freeze
@@ -28,44 +31,17 @@ module ActiveStorageValidations
       ensure_aspect_ratio_validity
     end
 
-    if Rails.gem_version >= Gem::Version.new('6.0.0')
-      def validate_each(record, attribute, _value)
-        return true unless record.send(attribute).attached?
-
-        changes = record.attachment_changes[attribute.to_s]
-        return true if changes.blank?
+    def validate_each(record, attribute, _value)
+      return if no_attachments?(record, attribute)
 
-        files = Array.wrap(changes.is_a?(ActiveStorage::Attached::Changes::CreateMany) ? changes.attachables : changes.attachable)
-
-        files.each do |file|
-          metadata = Metadata.new(file).metadata
-          next if is_valid?(record, attribute, file, metadata)
-          break
-        end
-      end
-    else
-      # Rails 5
-      def validate_each(record, attribute, _value)
-        return true unless record.send(attribute).attached?
-
-        files = Array.wrap(record.send(attribute))
-
-        files.each do |file|
-          # Analyze file first if not analyzed to get all required metadata.
-          file.analyze; file.reload unless file.analyzed?
-          metadata = file.metadata
-
-          next if is_valid?(record, attribute, file, metadata)
-          break
-        end
-      end
+      validate_changed_files_from_metadata(record, attribute)
     end
 
     private
 
-    def is_valid?(record, attribute, file, metadata)
+    def is_valid?(record, attribute, attachable, metadata)
       flat_options = unfold_procs(record, self.options, AVAILABLE_CHECKS)
-      errors_options = initialize_error_options(options, file)
+      errors_options = initialize_error_options(options, attachable)
 
       if metadata[:width].to_i <= 0 || metadata[:height].to_i <= 0
         errors_options[:aspect_ratio] = flat_options[:with]

data/lib/active_storage_validations/attached_validator.rb

@@ -1,26 +1,28 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
 require_relative 'concerns/symbolizable.rb'
 
 module ActiveStorageValidations
   class AttachedValidator < ActiveModel::EachValidator # :nodoc:
+    include ActiveStorageable
     include Errorable
     include Symbolizable
 
     ERROR_TYPES = %i[blank].freeze
 
     def check_validity!
-      %i(allow_nil allow_blank).each do |not_authorized_option|
+      %i[allow_nil allow_blank].each do |not_authorized_option|
         if options.include?(not_authorized_option)
-          raise ArgumentError, "You cannot pass the :#{not_authorized_option} option to this validator"
+          raise ArgumentError, "You cannot pass the :#{not_authorized_option} option to the #{self.class.to_sym} validator"
         end
       end
     end
 
     def validate_each(record, attribute, _value)
-      return if record.send(attribute).attached? &&
-                !Array.wrap(record.send(attribute)).all? { |file| file.marked_for_destruction? }
+      return if attachments_present?(record, attribute) &&
+                will_have_attachments_after_save?(record, attribute)
 
       errors_options = initialize_error_options(options)
       add_error(record, attribute, ERROR_TYPES.first, **errors_options)

data/lib/active_storage_validations/base_size_validator.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+require_relative 'concerns/active_storageable.rb'
+require_relative 'concerns/errorable.rb'
+require_relative 'concerns/symbolizable.rb'
+
+module ActiveStorageValidations
+  class BaseSizeValidator < ActiveModel::EachValidator # :nodoc:
+    include ActiveStorageable
+    include Errorable
+    include OptionProcUnfolding
+    include Symbolizable
+
+    delegate :number_to_human_size, to: ActiveSupport::NumberHelper
+
+    AVAILABLE_CHECKS = %i[
+      less_than
+      less_than_or_equal_to
+      greater_than
+      greater_than_or_equal_to
+      between
+    ].freeze
+
+    def initialize(*args)
+      if self.class == BaseSizeValidator
+        raise NotImplementedError, 'BaseSizeValidator is an abstract class and cannot be instantiated directly.'
+      end
+      super
+    end
+
+    def check_validity!
+      unless AVAILABLE_CHECKS.one? { |argument| options.key?(argument) }
+        raise ArgumentError, 'You must pass either :less_than(_or_equal_to), :greater_than(_or_equal_to), or :between to the validator'
+      end
+    end
+
+    private
+
+    def is_valid?(size, flat_options)
+      return false if size < 0
+
+      if flat_options[:between].present?
+        flat_options[:between].include?(size)
+      elsif flat_options[:less_than].present?
+        size < flat_options[:less_than]
+      elsif flat_options[:less_than_or_equal_to].present?
+        size <= flat_options[:less_than_or_equal_to]
+      elsif flat_options[:greater_than].present?
+        size > flat_options[:greater_than]
+      elsif flat_options[:greater_than_or_equal_to].present?
+        size >= flat_options[:greater_than_or_equal_to]
+      end
+    end
+
+    def populate_error_options(errors_options, flat_options)
+      errors_options[:min_size] = number_to_human_size(min_size(flat_options))
+      errors_options[:max_size] = number_to_human_size(max_size(flat_options))
+    end
+
+    def min_size(flat_options)
+      flat_options[:between]&.min || flat_options[:greater_than] || flat_options[:greater_than_or_equal_to]
+    end
+
+    def max_size(flat_options)
+      flat_options[:between]&.max || flat_options[:less_than] || flat_options[:less_than_or_equal_to]
+    end
+  end
+end

data/lib/active_storage_validations/concerns/active_storageable.rb

@@ -0,0 +1,28 @@
+module ActiveStorageValidations
+  # ActiveStorageValidations::ActiveStorageable
+  #
+  # Validator helper methods to make our code more explicit.
+  module ActiveStorageable
+    extend ActiveSupport::Concern
+
+    private
+
+    # Retrieve either an ActiveStorage::Attached::One or an
+    # ActiveStorage::Attached::Many instance depending on attribute definition
+    def attached_files(record, attribute)
+      Array.wrap(record.send(attribute))
+    end
+
+    def attachments_present?(record, attribute)
+      record.send(attribute).attached?
+    end
+
+    def no_attachments?(record, attribute)
+      !attachments_present?(record, attribute)
+    end
+
+    def will_have_attachments_after_save?(record, attribute)
+      !Array.wrap(record.send(attribute)).all?(&:marked_for_destruction?)
+    end
+  end
+end

data/lib/active_storage_validations/concerns/errorable.rb

@@ -9,19 +9,18 @@ module ActiveStorageValidations
       active_storage_validations_options = {
         validator_type: self.class.to_sym,
         custom_message: (options[:message] if options[:message].present?),
-        filename: get_filename(file)
+        filename: (get_filename(file) unless self.class.to_sym == :total_size)
       }.compact
 
       curated_options.merge(active_storage_validations_options)
     end
 
     def add_error(record, attribute, error_type, **errors_options)
-      type = errors_options[:custom_message].presence || error_type
-      return if record.errors.added?(attribute, type)
+      return if record.errors.added?(attribute, error_type)
 
       # You can read https://api.rubyonrails.org/classes/ActiveModel/Errors.html#method-i-add
       # to better understand how Rails model errors work
-      record.errors.add(attribute, type, **errors_options)
+      record.errors.add(attribute, error_type, **errors_options)
     end
 
     private
@@ -30,7 +29,7 @@ module ActiveStorageValidations
       return nil unless file
 
       case file
-      when ActiveStorage::Attached then file.blob.filename.to_s
+      when ActiveStorage::Attached, ActiveStorage::Attachment then file.blob&.filename&.to_s
       when Hash then file[:filename]
       end
     end

data/lib/active_storage_validations/concerns/loggable.rb

@@ -0,0 +1,9 @@
+module ActiveStorageValidations
+  module Loggable
+    extend ActiveSupport::Concern
+
+    def logger
+      Rails.logger
+    end
+  end
+end

data/lib/active_storage_validations/concerns/metadatable.rb

@@ -0,0 +1,31 @@
+require_relative '../metadata'
+
+module ActiveStorageValidations
+  # ActiveStorageValidations::Metadatable
+  #
+  # Validator methods for analyzing the attachment metadata.
+  module Metadatable
+    extend ActiveSupport::Concern
+
+    private
+
+    # Loop through the newly submitted attachables to validate them
+    def validate_changed_files_from_metadata(record, attribute)
+      attachables_from_changes(record, attribute).each do |attachable|
+        is_valid?(record, attribute, attachable, Metadata.new(attachable).metadata)
+      end
+    end
+
+    # Retrieve an array of newly submitted attachables which are file
+    # representations such as ActiveStorage::Blob, ActionDispatch::Http::UploadedFile,
+    # Rack::Test::UploadedFile, Hash, String, File or Pathname
+    def attachables_from_changes(record, attribute)
+      changes = record.attachment_changes[attribute.to_s]
+      return [] if changes.blank?
+
+      Array.wrap(
+        changes.is_a?(ActiveStorage::Attached::Changes::CreateMany) ? changes.attachables : changes.attachable
+      )
+    end
+  end
+end

data/lib/active_storage_validations/content_type_spoof_detector.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require_relative 'concerns/loggable'
+require 'open3'
+
+module ActiveStorageValidations
+  class ContentTypeSpoofDetector
+    class FileCommandLineToolNotInstalledError < StandardError; end
+
+    include Loggable
+
+    def initialize(record, attribute, file)
+      @record = record
+      @attribute = attribute
+      @file = file
+    end
+
+    def spoofed?
+      if supplied_content_type_vs_open3_analizer_mismatch?
+        logger.info "Content Type Spoofing detected for file '#{filename}'. The supplied content type is '#{supplied_content_type}' but the content type discovered using open3 is '#{content_type_from_analyzer}'."
+        true
+      else
+        false
+      end
+    end
+
+    private
+
+    def filename
+      @filename ||= @file.blob.present? && @file.blob.filename.to_s
+    end
+
+    def supplied_content_type
+      # We remove potential mime type parameters
+      @supplied_content_type ||= @file.blob.present? && @file.blob.content_type.downcase.split(/[;,\s]/, 2).first
+    end
+
+    def io
+      @io ||= case @record.public_send(@attribute)
+              when ActiveStorage::Attached::One then get_io_from_one
+              when ActiveStorage::Attached::Many then get_io_from_many
+              end
+    end
+
+    def get_io_from_one
+      attachable = @record.attachment_changes[@attribute.to_s].attachable
+
+      case attachable
+      when ActionDispatch::Http::UploadedFile
+        attachable.read
+      when String
+        blob = ActiveStorage::Blob.find_signed!(attachable)
+        blob.download
+      when ActiveStorage::Blob
+        attachable.download
+      when Hash
+        attachable[:io].read
+      end
+    end
+
+    def get_io_from_many
+      attachables = @record.attachment_changes[@attribute.to_s].attachables
+
+      if attachables.all? { |attachable| attachable.is_a?(ActionDispatch::Http::UploadedFile) }
+        attachables.find do |uploaded_file|
+          checksum = ActiveStorage::Blob.new.send(:compute_checksum_in_chunks, uploaded_file)
+          checksum == @file.checksum
+        end.read
+      elsif attachables.all? { |attachable| attachable.is_a?(String) }
+        # It's only possible to pass one String as attachable (not an array of String)
+        blob = ActiveStorage::Blob.find_signed!(attachables.first)
+        blob.download
+      elsif attachables.all? { |attachable| attachable.is_a?(ActiveStorage::Blob) }
+        attachables.find { |blob| blob == @file.blob }.download
+      elsif attachables.all? { |attachable| attachable.is_a?(Hash) }
+        # It's only possible to pass one Hash as attachable (not an array of Hash)
+        attachables.first[:io].read
+      end
+    end
+
+    def content_type_from_analyzer
+      # Using Open3 is a better alternative than Marcel (Marcel::MimeType.for(io))
+      # for analyzing content type solely based on the file io
+      @content_type_from_analyzer ||= open3_mime_type_for_io
+    end
+
+    def open3_mime_type_for_io
+      return nil if io.blank?
+
+      Tempfile.create do |tempfile|
+        tempfile.binmode
+        tempfile.write(io)
+        tempfile.rewind
+
+        command = "file -b --mime-type #{tempfile.path}"
+        output, status = Open3.capture2(command)
+
+        if status.success?
+          mime_type = output.strip
+          return mime_type
+        else
+          raise "Error determining MIME type: #{output}"
+        end
+
+      rescue Errno::ENOENT
+        raise FileCommandLineToolNotInstalledError, 'file command-line tool is not installed'
+      end
+    end
+
+    def supplied_content_type_vs_open3_analizer_mismatch?
+      supplied_content_type.present? &&
+        !supplied_content_type_intersects_content_type_from_analyzer?
+    end
+
+    def supplied_content_type_intersects_content_type_from_analyzer?
+      # Ruby intersects? method is only available from 3.1
+      enlarged_content_type(supplied_content_type).any? do |item|
+        enlarged_content_type(content_type_from_analyzer).include?(item)
+      end
+    end
+
+    def enlarged_content_type(content_type)
+      [content_type, *parent_content_types(content_type)].compact.uniq
+    end
+
+    def parent_content_types(content_type)
+      Marcel::TYPE_PARENTS[content_type] || []
+    end
+  end
+end

data/lib/active_storage_validations/content_type_validator.rb

@@ -1,16 +1,22 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
 require_relative 'concerns/symbolizable.rb'
+require_relative 'content_type_spoof_detector.rb'
 
 module ActiveStorageValidations
   class ContentTypeValidator < ActiveModel::EachValidator # :nodoc:
+    include ActiveStorageable
     include OptionProcUnfolding
     include Errorable
     include Symbolizable
 
     AVAILABLE_CHECKS = %i[with in].freeze
-    ERROR_TYPES = %i[content_type_invalid].freeze
+    ERROR_TYPES = %i[
+      content_type_invalid
+      spoofed_content_type
+    ].freeze
 
     def check_validity!
       ensure_exactly_one_validator_option
@@ -18,31 +24,24 @@ module ActiveStorageValidations
     end
 
     def validate_each(record, attribute, _value)
-      return true unless record.send(attribute).attached?
+      return if no_attachments?(record, attribute)
 
       types = authorized_types(record)
-      return true if types.empty?
+      return if types.empty?
 
-      files = Array.wrap(record.send(attribute))
-
-      files.each do |file|
-        next if is_valid?(file, types)
-
-        errors_options = initialize_error_options(options, file)
-        errors_options[:authorized_types] = types_to_human_format(types)
-        errors_options[:content_type] = content_type(file)
-        add_error(record, attribute, ERROR_TYPES.first, **errors_options)
-        break
+      attached_files(record, attribute).each do |file|
+        is_valid?(record, attribute, file, types)
       end
     end
 
+    private
+
     def authorized_types(record)
       flat_options = unfold_procs(record, self.options, AVAILABLE_CHECKS)
       (Array.wrap(flat_options[:with]) + Array.wrap(flat_options[:in])).compact.map do |type|
-        if type.is_a?(Regexp)
-          type
-        else
-          Marcel::MimeType.for(declared_type: type.to_s, extension: type.to_s)
+        case type
+        when String, Symbol then Marcel::MimeType.for(declared_type: type.to_s, extension: type.to_s)
+        when Regexp then type
         end
       end
     end
@@ -54,13 +53,44 @@ module ActiveStorageValidations
     end
 
     def content_type(file)
-      file.blob.present? && file.blob.content_type
+      # We remove potential mime type parameters
+      file.blob.present? && file.blob.content_type.downcase.split(/[;,\s]/, 2).first
+    end
+
+    def is_valid?(record, attribute, file, types)
+      file_type_in_authorized_types?(record, attribute, file, types) &&
+        not_spoofing_content_type?(record, attribute, file)
     end
 
-    def is_valid?(file, types)
+    def file_type_in_authorized_types?(record, attribute, file, types)
       file_type = content_type(file)
-      types.any? do |type|
-        type == file_type || (type.is_a?(Regexp) && type.match?(file_type.to_s))
+      file_type_is_authorized = types.any? do |type|
+        case type
+        when String then type == file_type
+        when Regexp then type.match?(file_type.to_s)
+        end
+      end
+
+      if file_type_is_authorized
+        true
+      else
+        errors_options = initialize_error_options(options, file)
+        errors_options[:authorized_types] = types_to_human_format(types)
+        errors_options[:content_type] = content_type(file)
+        add_error(record, attribute, ERROR_TYPES.first, **errors_options)
+        false
+      end
+    end
+
+    def not_spoofing_content_type?(record, attribute, file)
+      return true unless enable_spoofing_protection?
+
+      if ContentTypeSpoofDetector.new(record, attribute, file).spoofed?
+        errors_options = initialize_error_options(options, file)
+        add_error(record, attribute, ERROR_TYPES.second, **errors_options)
+        false
+      else
+        true
       end
     end
 
@@ -81,7 +111,7 @@ module ActiveStorageValidations
     def invalid_content_type_message(content_type)
       <<~ERROR_MESSAGE
         You must pass valid content types to the validator
-        '#{content_type}' is not find in Marcel::EXTENSIONS mimes
+        '#{content_type}' is not found in Marcel::EXTENSIONS mimes
       ERROR_MESSAGE
     end
 
@@ -93,5 +123,9 @@ module ActiveStorageValidations
         false # We always validate regexes
       end
     end
+
+    def enable_spoofing_protection?
+      options[:spoofing_protection] == true
+    end
   end
 end

data/lib/active_storage_validations/dimension_validator.rb

@@ -1,13 +1,16 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
+require_relative 'concerns/metadatable.rb'
 require_relative 'concerns/symbolizable.rb'
-require_relative 'metadata.rb'
 
 module ActiveStorageValidations
   class DimensionValidator < ActiveModel::EachValidator # :nodoc
-    include OptionProcUnfolding
+    include ActiveStorageable
     include Errorable
+    include OptionProcUnfolding
+    include Metadatable
     include Symbolizable
 
     AVAILABLE_CHECKS = %i[width height min max].freeze
@@ -25,65 +28,19 @@ module ActiveStorageValidations
       dimension_height_equal_to
     ].freeze
 
-    def process_options(record)
-      flat_options = unfold_procs(record, self.options, AVAILABLE_CHECKS)
-
-      [:width, :height].each do |length|
-        if flat_options[length] and flat_options[length].is_a?(Hash)
-          if (range = flat_options[length][:in])
-            raise ArgumentError, ":in must be a Range" unless range.is_a?(Range)
-            flat_options[length][:min], flat_options[length][:max] = range.min, range.max
-          end
-        end
-      end
-      [:min, :max].each do |dim|
-        if (range = flat_options[dim])
-          raise ArgumentError, ":#{dim} must be a Range (width..height)" unless range.is_a?(Range)
-          flat_options[:width] = { dim => range.first }
-          flat_options[:height] = { dim => range.last }
-        end
-      end
-
-      flat_options
-    end
-
     def check_validity!
       unless AVAILABLE_CHECKS.any? { |argument| options.key?(argument) }
         raise ArgumentError, 'You must pass either :width, :height, :min or :max to the validator'
       end
     end
 
+    def validate_each(record, attribute, _value)
+      return if no_attachments?(record, attribute)
 
-    if Rails.gem_version >= Gem::Version.new('6.0.0')
-      def validate_each(record, attribute, _value)
-        return true unless record.send(attribute).attached?
-
-        changes = record.attachment_changes[attribute.to_s]
-        return true if changes.blank?
-
-        files = Array.wrap(changes.is_a?(ActiveStorage::Attached::Changes::CreateMany) ? changes.attachables : changes.attachable)
-        files.each do |file|
-          metadata = Metadata.new(file).metadata
-          next if is_valid?(record, attribute, file, metadata)
-          break
-        end
-      end
-    else
-      # Rails 5
-      def validate_each(record, attribute, _value)
-        return true unless record.send(attribute).attached?
-
-        files = Array.wrap(record.send(attribute))
-        files.each do |file|
-          # Analyze file first if not analyzed to get all required metadata.
-          file.analyze; file.reload unless file.analyzed?
-          metadata = file.metadata rescue {}
-          next if is_valid?(record, attribute, file, metadata)
-          break
-        end
-      end
+      validate_changed_files_from_metadata(record, attribute)
     end
 
+    private
 
     def is_valid?(record, attribute, file, metadata)
       flat_options = process_options(record)
@@ -163,5 +120,27 @@ module ActiveStorageValidations
 
       true # valid file
     end
+
+    def process_options(record)
+      flat_options = unfold_procs(record, self.options, AVAILABLE_CHECKS)
+
+      [:width, :height].each do |length|
+        if flat_options[length] and flat_options[length].is_a?(Hash)
+          if (range = flat_options[length][:in])
+            raise ArgumentError, ":in must be a Range" unless range.is_a?(Range)
+            flat_options[length][:min], flat_options[length][:max] = range.min, range.max
+          end
+        end
+      end
+      [:min, :max].each do |dim|
+        if (range = flat_options[dim])
+          raise ArgumentError, ":#{dim} must be a Range (width..height)" unless range.is_a?(Range)
+          flat_options[:width] = { dim => range.first }
+          flat_options[:height] = { dim => range.last }
+        end
+      end
+
+      flat_options
+    end
   end
 end

data/lib/active_storage_validations/limit_validator.rb

@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
 require_relative 'concerns/symbolizable.rb'
 
 module ActiveStorageValidations
   class LimitValidator < ActiveModel::EachValidator # :nodoc:
+    include ActiveStorageable
     include OptionProcUnfolding
     include Errorable
     include Symbolizable
@@ -19,11 +21,11 @@ module ActiveStorageValidations
       ensure_arguments_validity
     end
 
-    def validate_each(record, attribute, _)
-      files = Array.wrap(record.send(attribute)).reject { |file| file.blank? }.compact.uniq
+    def validate_each(record, attribute, _value)
+      files = attached_files(record, attribute).reject(&:blank?)
       flat_options = unfold_procs(record, self.options, AVAILABLE_CHECKS)
 
-      return true if files_count_valid?(files.count, flat_options)
+      return if files_count_valid?(files.count, flat_options)
 
       errors_options = initialize_error_options(options)
       errors_options[:min] = flat_options[:min]

data/lib/active_storage_validations/marcel_extensor.rb

@@ -0,0 +1,5 @@
+Marcel::MimeType.extend "application/x-rar-compressed", parents: %(application/x-rar)
+Marcel::MimeType.extend "audio/x-hx-aac-adts", parents: %(audio/x-aac)
+Marcel::MimeType.extend "audio/x-m4a", parents: %(audio/mp4)
+Marcel::MimeType.extend "text/xml", parents: %(application/xml) # alias
+Marcel::MimeType.extend "video/theora", parents: %(video/ogg)