active_storage_validations 3.0.5 → 4.0.0

data/lib/active_storage_validations/matchers/content_type_validator_matcher.rb

@@ -7,8 +7,11 @@ require_relative "shared/asv_active_storageable"
 require_relative "shared/asv_allow_blankable"
 require_relative "shared/asv_attachable"
 require_relative "shared/asv_contextable"
+require_relative "shared/asv_except_onable"
 require_relative "shared/asv_messageable"
 require_relative "shared/asv_rspecable"
+require_relative "shared/asv_spoofing_protectable"
+require_relative "shared/asv_timeoutable"
 require_relative "shared/asv_validatable"
 
 module ActiveStorageValidations
@@ -22,15 +25,21 @@ module ActiveStorageValidations
       include ASVAllowBlankable
       include ASVAttachable
       include ASVContextable
+      include ASVExceptOnable
       include ASVMessageable
       include ASVRspecable
+      include ASVSpoofingProtectable
+      include ASVTimeoutable
       include ASVValidatable
 
       def initialize(attribute_name)
         initialize_allow_blankable
         initialize_contextable
+        initialize_except_onable
         initialize_messageable
         initialize_rspecable
+        initialize_spoofing_protectable
+        initialize_timeoutable
         @attribute_name = attribute_name
         @allowed_content_types = @rejected_content_types = []
       end
@@ -62,7 +71,10 @@ module ActiveStorageValidations
 
         is_a_valid_active_storage_attribute? &&
           is_context_valid? &&
+          is_except_on_valid? &&
           is_allowing_blank? &&
+          is_timeout_valid? &&
+          is_spoofing_protection_valid? &&
           is_custom_message_valid? &&
           all_allowed_content_types_allowed? &&
           all_rejected_content_types_rejected?

data/lib/active_storage_validations/matchers/dimension_validator_matcher.rb

@@ -4,8 +4,10 @@ require_relative "shared/asv_active_storageable"
 require_relative "shared/asv_allow_blankable"
 require_relative "shared/asv_attachable"
 require_relative "shared/asv_contextable"
+require_relative "shared/asv_except_onable"
 require_relative "shared/asv_messageable"
 require_relative "shared/asv_rspecable"
+require_relative "shared/asv_timeoutable"
 require_relative "shared/asv_validatable"
 
 module ActiveStorageValidations
@@ -19,15 +21,19 @@ module ActiveStorageValidations
       include ASVAllowBlankable
       include ASVAttachable
       include ASVContextable
+      include ASVExceptOnable
       include ASVMessageable
       include ASVRspecable
+      include ASVTimeoutable
       include ASVValidatable
 
       def initialize(attribute_name)
         initialize_allow_blankable
         initialize_contextable
+        initialize_except_onable
         initialize_messageable
         initialize_rspecable
+        initialize_timeoutable
         @attribute_name = attribute_name
         @width_min = @width_max = @height_min = @height_max = nil
       end
@@ -87,7 +93,9 @@ module ActiveStorageValidations
 
         is_a_valid_active_storage_attribute? &&
           is_context_valid? &&
+          is_except_on_valid? &&
           is_allowing_blank? &&
+          is_timeout_valid? &&
           is_custom_message_valid? &&
           width_not_smaller_than_min? &&
           width_larger_than_min? &&

data/lib/active_storage_validations/matchers/duration_validator_matcher.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "base_comparison_validator_matcher"
+require_relative "shared/asv_timeoutable"
 
 module ActiveStorageValidations
   module Matchers
@@ -9,6 +10,13 @@ module ActiveStorageValidations
     end
 
     class DurationValidatorMatcher < BaseComparisonValidatorMatcher
+      include ASVTimeoutable
+
+      def initialize(attribute_name)
+        super
+        initialize_timeoutable
+      end
+
       def description
         "validate file duration of :#{@attribute_name}"
       end

data/lib/active_storage_validations/matchers/limit_validator_matcher.rb

@@ -4,6 +4,7 @@ require_relative "shared/asv_active_storageable"
 require_relative "shared/asv_allow_blankable"
 require_relative "shared/asv_attachable"
 require_relative "shared/asv_contextable"
+require_relative "shared/asv_except_onable"
 require_relative "shared/asv_messageable"
 require_relative "shared/asv_rspecable"
 require_relative "shared/asv_validatable"
@@ -19,6 +20,7 @@ module ActiveStorageValidations
       include ASVAllowBlankable
       include ASVAttachable
       include ASVContextable
+      include ASVExceptOnable
       include ASVMessageable
       include ASVRspecable
       include ASVValidatable
@@ -26,6 +28,7 @@ module ActiveStorageValidations
       def initialize(attribute_name)
         initialize_allow_blankable
         initialize_contextable
+        initialize_except_onable
         initialize_messageable
         initialize_rspecable
         @attribute_name = attribute_name
@@ -57,6 +60,7 @@ module ActiveStorageValidations
 
         is_a_valid_active_storage_attribute? &&
           is_context_valid? &&
+          is_except_on_valid? &&
           is_custom_message_valid? &&
           file_count_not_smaller_than_min? &&
           file_count_equal_min? &&

data/lib/active_storage_validations/matchers/pages_validator_matcher.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "base_comparison_validator_matcher"
+require_relative "shared/asv_timeoutable"
 
 module ActiveStorageValidations
   module Matchers
@@ -9,6 +10,13 @@ module ActiveStorageValidations
     end
 
     class PagesValidatorMatcher < BaseComparisonValidatorMatcher
+      include ASVTimeoutable
+
+      def initialize(attribute_name)
+        super
+        initialize_timeoutable
+      end
+
       def description
         "validate file number of pages of :#{@attribute_name}"
       end

data/lib/active_storage_validations/matchers/processable_file_validator_matcher.rb

@@ -4,8 +4,10 @@ require_relative "shared/asv_active_storageable"
 require_relative "shared/asv_allow_blankable"
 require_relative "shared/asv_attachable"
 require_relative "shared/asv_contextable"
+require_relative "shared/asv_except_onable"
 require_relative "shared/asv_messageable"
 require_relative "shared/asv_rspecable"
+require_relative "shared/asv_timeoutable"
 require_relative "shared/asv_validatable"
 
 module ActiveStorageValidations
@@ -19,15 +21,19 @@ module ActiveStorageValidations
       include ASVAllowBlankable
       include ASVAttachable
       include ASVContextable
+      include ASVExceptOnable
       include ASVMessageable
       include ASVRspecable
+      include ASVTimeoutable
       include ASVValidatable
 
       def initialize(attribute_name)
         initialize_allow_blankable
         initialize_contextable
+        initialize_except_onable
         initialize_messageable
         initialize_rspecable
+        initialize_timeoutable
         @attribute_name = attribute_name
       end
 
@@ -44,6 +50,8 @@ module ActiveStorageValidations
 
         is_a_valid_active_storage_attribute? &&
           is_context_valid? &&
+          is_except_on_valid? &&
+          is_timeout_valid? &&
           is_custom_message_valid? &&
           is_valid_when_image_processable? &&
           is_invalid_when_file_not_processable?

data/lib/active_storage_validations/matchers/shared/asv_except_onable.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module ActiveStorageValidations
+  module Matchers
+    module ASVExceptOnable
+      extend ActiveSupport::Concern
+
+      def initialize_except_onable
+        @except_on = nil
+      end
+
+      def except_on(context)
+        @except_on = context
+        self
+      end
+
+      private
+
+      def is_except_on_valid?
+        return true if !@except_on && attribute_validators.none? { |validator| validator.options[:except_on] }
+
+        ensure_except_on_present!
+        ensure_except_on_valid!
+
+        if @except_on.is_a?(Array)
+          (validator_except_on_contexts & @except_on.map(&:to_s)) == validator_except_on_contexts || raise_except_on_not_listed_error
+        elsif @except_on.is_a?(Symbol)
+          validator_except_on_contexts.include?(@except_on.to_s) || raise_except_on_not_listed_error
+        end
+      end
+
+      def ensure_except_on_present!
+        raise ArgumentError, "This validator matcher needs the #except_on option to work since its validator has one" if !@except_on && attribute_validators.all? { |validator| validator.options[:except_on] }
+      end
+
+      def ensure_except_on_valid!
+        raise ArgumentError, "This validator matcher option only allows a symbol or an array" if !(@except_on.is_a?(Symbol) || @except_on.is_a?(Array))
+      end
+
+      def validator_except_on_contexts
+        attribute_validators.map do |validator|
+          case validator.options[:except_on]
+          when Array then validator.options[:except_on].map { |context| context.to_s }
+          when NilClass then nil
+          else validator.options[:except_on].to_s
+          end
+        end.flatten.compact
+      end
+
+      def raise_except_on_not_listed_error
+        raise ArgumentError, "One of the provided contexts to the #except_on method is not found in any of the listed contexts for this attribute"
+      end
+    end
+  end
+end

data/lib/active_storage_validations/matchers/shared/asv_spoofing_protectable.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module ActiveStorageValidations
+  module Matchers
+    module ASVSpoofingProtectable
+      extend ActiveSupport::Concern
+
+      UNSET = Object.new.freeze
+
+      def initialize_spoofing_protectable
+        @spoofing_protection = UNSET
+      end
+
+      def spoofing_protection(value = true)
+        @spoofing_protection = value
+        self
+      end
+
+      private
+
+      def is_spoofing_protection_valid?
+        return true if @spoofing_protection.equal?(UNSET)
+
+        expected = normalize_spoofing_protection(@spoofing_protection)
+        attribute_validators.any? do |validator|
+          next false unless validator.options.key?(:spoofing_protection)
+
+          normalize_spoofing_protection(validator.options[:spoofing_protection]) == expected
+        end
+      end
+
+      def normalize_spoofing_protection(value)
+        case value
+        when true, :file then :file
+        when :magika then :magika
+        when false then false
+        else value
+        end
+      end
+    end
+  end
+end

data/lib/active_storage_validations/matchers/shared/asv_timeoutable.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+
+module ActiveStorageValidations
+  module Matchers
+    module ASVTimeoutable
+      extend ActiveSupport::Concern
+
+      UNSET = Object.new.freeze
+
+      def initialize_timeoutable
+        @timeout = UNSET
+      end
+
+      def timeout(value)
+        @timeout = value
+        self
+      end
+
+      private
+
+      def is_timeout_valid?
+        return true if @timeout.equal?(UNSET)
+
+        attribute_validators.any? do |validator|
+          validator.options.key?(:timeout) && validator.options[:timeout] == @timeout
+        end
+      end
+    end
+  end
+end

data/lib/active_storage_validations/matchers.rb

@@ -29,7 +29,15 @@ module ActiveStorageValidations
 
     def self.mock_metadata(attachment, metadata = {})
       asv_metadata_available_keys = { width: nil, height: nil, duration: nil, content_type: nil }
-      mock = Struct.new(:metadata).new(asv_metadata_available_keys.merge(metadata)) # ensure all keys are present, and it does not raise while trying to access them
+      merged = asv_metadata_available_keys.merge(metadata)
+      # Stubbing Analyzer.new also covers content-type sniffers (File / Magika),
+      # which call #content_type — not #metadata. Default to the dummy file type
+      # so stacked validators with spoofing_protection still pass under the mock.
+      detected_content_type = merged[:content_type].presence || "image/png"
+      mock = Struct.new(:metadata, :content_type).new(
+        merged,
+        { content_type: detected_content_type, content_type_backend: "file" }
+      )
 
       stub_method(ActiveStorageValidations::Analyzer, :new, mock) do
         yield

data/lib/active_storage_validations/processable_file_validator.rb

@@ -19,6 +19,28 @@ module ActiveStorageValidations
     ].freeze
     METADATA_KEYS = %i[].freeze
 
+    # Content types whose libvips loaders are marked untrusted / unfuzzed
+    # (VIPS_OPERATION_UNTRUSTED). After Rails calls `Vips.block_untrusted(true)`,
+    # analysis of these types returns no width/height (empty metadata here),
+    # which is not the same as a corrupt / unprocessable file.
+    #
+    # Matches the formats called out in the Active Storage security release
+    # changelogs (7.2.3.2 / 8.0.5.1 / 8.1.3.1):
+    # https://github.com/rails/rails/blob/v8.1.3.1/activestorage/CHANGELOG.md
+    # https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
+    VIPS_UNTRUSTED_CONTENT_TYPES = %w[
+      image/bmp
+      image/vnd.microsoft.icon
+      image/vnd.adobe.photoshop
+      image/svg+xml
+      image/jxl
+      image/jp2
+      image/x-portable-anymap
+      image/x-portable-bitmap
+      image/x-portable-graymap
+      image/x-portable-pixmap
+    ].freeze
+
     def validate_each(record, attribute, _value)
       return if no_attachments?(record, attribute)
 
@@ -28,10 +50,47 @@ module ActiveStorageValidations
     private
 
     def is_valid?(record, attribute, attachable, metadata)
-      return if !metadata.empty?
+      return if metadata.present?
+      return if vips_unanalyzable_by_policy?(attachable)
 
       errors_options = initialize_error_options(options, attachable)
       add_error(record, attribute, ERROR_TYPES.first, **errors_options)
     end
+
+    def vips_unanalyzable_by_policy?(attachable)
+      image_processor == :vips &&
+        self.class.vips_untrusted_operations_blocked? &&
+        VIPS_UNTRUSTED_CONTENT_TYPES.include?(attachable_content_type(attachable))
+    end
+
+    class << self
+      # Detect whether libvips is currently blocking untrusted operations.
+      # There is no public getter for `Vips.block_untrusted`, so we probe whether
+      # an untrusted loader (svgload) is available via `vips_foreign_find_load`.
+      def vips_untrusted_operations_blocked?
+        return @vips_untrusted_operations_blocked if defined?(@vips_untrusted_operations_blocked)
+
+        @vips_untrusted_operations_blocked = detect_vips_untrusted_operations_blocked?
+      end
+
+      def reset_vips_untrusted_operations_blocked_cache!
+        remove_instance_variable(:@vips_untrusted_operations_blocked) if defined?(@vips_untrusted_operations_blocked)
+      end
+
+      private
+
+      def detect_vips_untrusted_operations_blocked?
+        require "vips"
+        require "tempfile"
+
+        Tempfile.create([ "asv_vips_untrusted_probe", ".svg" ]) do |file|
+          file.write('<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>')
+          file.flush
+          ::Vips.vips_foreign_find_load(file.path).nil?
+        end
+      rescue LoadError, StandardError
+        false
+      end
+    end
   end
 end

data/lib/active_storage_validations/railtie.rb

@@ -11,6 +11,12 @@ module ActiveStorageValidations
       end
     end
 
+    initializer "active_storage_validations.form_builder" do
+      ActiveSupport.on_load(:action_view) do
+        ActionView::Helpers::FormBuilder.prepend(ActiveStorageValidations::FormBuilder)
+      end
+    end
+
     initializer "active_storage_validations.extend_active_storage_blob" do
       ActiveSupport.on_load(:active_storage_blob) do
         include ActiveStorageValidations::ASVBlobMetadatable

data/lib/active_storage_validations/shared/asv_analyzable.rb

@@ -17,15 +17,62 @@ module ActiveStorageValidations
     # attachable with the corresponding analyzer and set the metadata in the
     # blob.
     def metadata_for(blob, attachable, metadata_keys)
+      if content_type_metadata_keys?(metadata_keys)
+        return content_type_metadata_for(blob, attachable)
+      end
+
       return blob.active_storage_validations_metadata if blob_has_asv_metadata?(blob, metadata_keys)
 
+      new_metadata = generate_metadata_for(attachable, metadata_keys) || {}
+      blob.merge_into_active_storage_validations_metadata(new_metadata)
+      blob.save!
+
+      blob.active_storage_validations_metadata
+    end
+
+    def content_type_metadata_keys?(metadata_keys)
+      metadata_keys == ActiveStorageValidations::ContentTypeValidator::METADATA_KEYS
+    end
+
+    # Same cache semantics as +metadata_for+, plus backend matching.
+    # Legacy blobs that only have +asv_content_type+ (no backend key) are treated
+    # as +:file+ — so existing file-backend analyses keep hitting the cache and
+    # are not re-analyzed / rewritten.
+    def content_type_metadata_for(blob, attachable)
+      backend = spoofing_protection_backend
+      cached = blob.active_storage_validations_metadata
+      return cached if content_type_cache_hit?(cached, backend)
+
+      metadata_keys = ActiveStorageValidations::ContentTypeValidator::METADATA_KEYS
       new_metadata = generate_metadata_for(attachable, metadata_keys)
+      return failed_content_type_metadata(backend) if content_type_analysis_failed?(new_metadata)
+
       blob.merge_into_active_storage_validations_metadata(new_metadata)
       blob.save!
 
       blob.active_storage_validations_metadata
     end
 
+    def content_type_analysis_failed?(new_metadata)
+      new_metadata.blank? || new_metadata[:content_type].blank?
+    end
+
+    # Do not return / persist another backend's cached type after a failed sniff
+    # (timeout, unsupported file, invalid Magika JSON, …). Fail closed for this
+    # request; leave blob metadata unchanged so a later attempt can retry.
+    def failed_content_type_metadata(backend)
+      { content_type: nil, content_type_backend: backend.to_s }
+    end
+
+    def content_type_cache_hit?(cached, backend)
+      return false unless cached.present? && cached[:content_type].present?
+
+      # Missing / blank backend => legacy file analysis (pre-Magika support).
+      # Those blobs keep hitting the cache for +:file+ and are not rewritten.
+      stored_backend = (cached[:content_type_backend].presence || "file").to_s
+      stored_backend == backend.to_s
+    end
+
     def blob_has_asv_metadata?(blob, metadata_keys)
       return false unless blob.active_storage_validations_metadata.present?
 
@@ -33,7 +80,7 @@ module ActiveStorageValidations
     end
 
     def generate_metadata_for(attachable, metadata_keys)
-      if metadata_keys == ActiveStorageValidations::ContentTypeValidator::METADATA_KEYS
+      if content_type_metadata_keys?(metadata_keys)
         content_type_analyzer_for(attachable).content_type
       else
         metadata_analyzer_for(attachable).metadata
@@ -52,15 +99,15 @@ module ActiveStorageValidations
     end
 
     def pdf_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::PdfAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::PdfAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def image_analyzer_for(attachable)
       case image_processor
       when :mini_magick
-        ActiveStorageValidations::Analyzer::ImageAnalyzer::ImageMagick.new(attachable)
+        ActiveStorageValidations::Analyzer::ImageAnalyzer::ImageMagick.new(attachable, **analyzer_timeout_options)
       when :vips
-        ActiveStorageValidations::Analyzer::ImageAnalyzer::Vips.new(attachable)
+        ActiveStorageValidations::Analyzer::ImageAnalyzer::Vips.new(attachable, **analyzer_timeout_options)
       end
     end
 
@@ -71,19 +118,30 @@ module ActiveStorageValidations
     end
 
     def video_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::VideoAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::VideoAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def audio_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::AudioAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::AudioAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def fallback_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::NullAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::NullAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def content_type_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::ContentTypeAnalyzer.new(attachable)
+      case spoofing_protection_backend
+      when :magika
+        ActiveStorageValidations::Analyzer::ContentTypeAnalyzer::Magika.new(attachable, **analyzer_timeout_options)
+      else
+        ActiveStorageValidations::Analyzer::ContentTypeAnalyzer::File.new(attachable, **analyzer_timeout_options)
+      end
+    end
+
+    # Passes raw validator +timeout:+ through to analyzers. Kept out of
+    # AVAILABLE_CHECKS so ASVOptionable does not flatten it as a comparison bound.
+    def analyzer_timeout_options
+      options.key?(:timeout) ? { timeout: options[:timeout] } : {}
     end
   end
 end

data/lib/active_storage_validations/shared/asv_attachable.rb

@@ -44,7 +44,7 @@ module ActiveStorageValidations
       return to_enum(:attachables_and_blobs, record, attribute) if changes.blank? || !block_given?
 
       if changes.is_a?(ActiveStorage::Attached::Changes::CreateMany)
-        changes.attachables.zip(changes.blobs).uniq { |_, blob| blob&.id }.each do |attachable, blob|
+        changes.attachables.zip(changes.blobs).uniq { |attachable, blob| attachable_blob_key(attachable, blob) }.each do |attachable, blob|
           yield attachable, blob
         end
       else
@@ -52,6 +52,12 @@ module ActiveStorageValidations
       end
     end
 
+    def attachable_blob_key(attachable, blob)
+      return [ :blob_id, blob.id ] if blob&.id
+
+      [ :attachable, attachable.object_id ]
+    end
+
     def changes_for(record, attribute)
       if record.public_send(attribute).is_a?(ActiveStorage::Attached::One)
         record.attachment_changes[attribute.to_s].presence || record.public_send(attribute)
@@ -120,14 +126,14 @@ module ActiveStorageValidations
     def attachable_io(attachable, max_byte_size: nil)
       io = case attachable
       when ActiveStorage::Blob
-        (max_byte_size && supports_blob_download_chunk?) ? attachable.download_chunk(0...max_byte_size) : attachable.download
+        max_byte_size ? attachable.download_chunk(0...max_byte_size) : attachable.download
       when ActionDispatch::Http::UploadedFile
         max_byte_size ? attachable.read(max_byte_size) : attachable.read
       when Rack::Test::UploadedFile
         max_byte_size ? attachable.read(max_byte_size) : attachable.read
       when String
         blob = ActiveStorage::Blob.find_signed!(attachable)
-        (max_byte_size && supports_blob_download_chunk?) ? blob.download_chunk(0...max_byte_size) : blob.download
+        max_byte_size ? blob.download_chunk(0...max_byte_size) : blob.download
       when Hash
         max_byte_size ? attachable[:io].read(max_byte_size) : attachable[:io].read
       when File
@@ -208,13 +214,6 @@ module ActiveStorageValidations
     end
     alias :supports_pathname_attachment? :supports_file_attachment?
 
-    # Check if the current Rails version supports ActiveStorage::Blob#download_chunk
-    #
-    # https://github.com/rails/rails/blob/7-0-stable/activestorage/CHANGELOG.md#rails-700alpha1-september-15-2021
-    def supports_blob_download_chunk?
-      Rails.gem_version >= Gem::Version.new("7.0.0.alpha1")
-    end
-
     # Retrieve the content_type from the file name only
     def marcel_content_type_from_filename(attachable)
       Marcel::MimeType.for(name: attachable_filename(attachable).to_s)