active_storage_validations 3.0.5 → 4.1.0

data/lib/active_storage_validations/matchers/with_audio_validator_matcher.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require_relative "shared/asv_active_storageable"
+require_relative "shared/asv_allow_blankable"
+require_relative "shared/asv_attachable"
+require_relative "shared/asv_contextable"
+require_relative "shared/asv_except_onable"
+require_relative "shared/asv_messageable"
+require_relative "shared/asv_rspecable"
+require_relative "shared/asv_timeoutable"
+require_relative "shared/asv_validatable"
+
+module ActiveStorageValidations
+  module Matchers
+    def validate_with_audio_of(attribute_name)
+      WithAudioValidatorMatcher.new(attribute_name)
+    end
+
+    class WithAudioValidatorMatcher
+      include ASVActiveStorageable
+      include ASVAllowBlankable
+      include ASVAttachable
+      include ASVContextable
+      include ASVExceptOnable
+      include ASVMessageable
+      include ASVRspecable
+      include ASVTimeoutable
+      include ASVValidatable
+
+      def initialize(attribute_name)
+        initialize_allow_blankable
+        initialize_contextable
+        initialize_except_onable
+        initialize_messageable
+        initialize_rspecable
+        initialize_timeoutable
+        @attribute_name = attribute_name
+        @expected_audio = true
+      end
+
+      def description
+        "validate that :#{@attribute_name} #{audio_expectation}"
+      end
+
+      def failure_message
+        "is expected to validate that :#{@attribute_name} #{audio_expectation}"
+      end
+
+      def without_audio
+        @expected_audio = false
+        self
+      end
+
+      def matches?(subject)
+        @subject = subject.is_a?(Class) ? subject.new : subject
+
+        is_a_valid_active_storage_attribute? &&
+          is_context_valid? &&
+          is_except_on_valid? &&
+          is_allowing_blank? &&
+          is_timeout_valid? &&
+          is_custom_message_valid? &&
+          is_valid_with_expected_audio? &&
+          is_invalid_with_unexpected_audio?
+      end
+
+      private
+
+      def audio_expectation
+        @expected_audio ? "has an audio track" : "has no audio track"
+      end
+
+      def is_valid_with_expected_audio?
+        validation_passes_with_audio?(@expected_audio)
+      end
+
+      def is_invalid_with_unexpected_audio?
+        !validation_passes_with_audio?(!@expected_audio)
+      end
+
+      def is_custom_message_valid?
+        return true unless @custom_message
+
+        with_audio_metadata(false) do
+          attach_file(video_file)
+          validate
+          detach_file
+          has_an_error_message_which_is_custom_message?
+        end
+      end
+
+      def validation_passes_with_audio?(audio)
+        with_audio_metadata(audio) do
+          attach_file(video_file)
+          validate
+          detach_file
+          is_valid?
+        end
+      end
+
+      def with_audio_metadata(audio, &block)
+        Matchers.mock_metadata(io, { audio: audio }, &block)
+      end
+
+      def video_file
+        {
+          io: io,
+          filename: "test.mp4",
+          content_type: "video/mp4"
+        }
+      end
+    end
+  end
+end

data/lib/active_storage_validations/matchers.rb

@@ -7,6 +7,7 @@ require "active_storage_validations/matchers/limit_validator_matcher"
 require "active_storage_validations/matchers/content_type_validator_matcher"
 require "active_storage_validations/matchers/dimension_validator_matcher"
 require "active_storage_validations/matchers/duration_validator_matcher"
+require "active_storage_validations/matchers/with_audio_validator_matcher"
 require "active_storage_validations/matchers/size_validator_matcher"
 require "active_storage_validations/matchers/total_size_validator_matcher"
 require "active_storage_validations/matchers/pages_validator_matcher"
@@ -29,7 +30,15 @@ module ActiveStorageValidations
 
     def self.mock_metadata(attachment, metadata = {})
       asv_metadata_available_keys = { width: nil, height: nil, duration: nil, content_type: nil }
-      mock = Struct.new(:metadata).new(asv_metadata_available_keys.merge(metadata)) # ensure all keys are present, and it does not raise while trying to access them
+      merged = asv_metadata_available_keys.merge(metadata)
+      # Stubbing Analyzer.new also covers content-type sniffers (File / Magika),
+      # which call #content_type — not #metadata. Default to the dummy file type
+      # so stacked validators with spoofing_protection still pass under the mock.
+      detected_content_type = merged[:content_type].presence || "image/png"
+      mock = Struct.new(:metadata, :content_type).new(
+        merged,
+        { content_type: detected_content_type, content_type_backend: "file" }
+      )
 
       stub_method(ActiveStorageValidations::Analyzer, :new, mock) do
         yield

data/lib/active_storage_validations/processable_file_validator.rb

@@ -19,6 +19,28 @@ module ActiveStorageValidations
     ].freeze
     METADATA_KEYS = %i[].freeze
 
+    # Content types whose libvips loaders are marked untrusted / unfuzzed
+    # (VIPS_OPERATION_UNTRUSTED). After Rails calls `Vips.block_untrusted(true)`,
+    # analysis of these types returns no width/height (empty metadata here),
+    # which is not the same as a corrupt / unprocessable file.
+    #
+    # Matches the formats called out in the Active Storage security release
+    # changelogs (7.2.3.2 / 8.0.5.1 / 8.1.3.1):
+    # https://github.com/rails/rails/blob/v8.1.3.1/activestorage/CHANGELOG.md
+    # https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
+    VIPS_UNTRUSTED_CONTENT_TYPES = %w[
+      image/bmp
+      image/vnd.microsoft.icon
+      image/vnd.adobe.photoshop
+      image/svg+xml
+      image/jxl
+      image/jp2
+      image/x-portable-anymap
+      image/x-portable-bitmap
+      image/x-portable-graymap
+      image/x-portable-pixmap
+    ].freeze
+
     def validate_each(record, attribute, _value)
       return if no_attachments?(record, attribute)
 
@@ -28,10 +50,47 @@ module ActiveStorageValidations
     private
 
     def is_valid?(record, attribute, attachable, metadata)
-      return if !metadata.empty?
+      return if metadata.present?
+      return if vips_unanalyzable_by_policy?(attachable)
 
       errors_options = initialize_error_options(options, attachable)
       add_error(record, attribute, ERROR_TYPES.first, **errors_options)
     end
+
+    def vips_unanalyzable_by_policy?(attachable)
+      image_processor == :vips &&
+        self.class.vips_untrusted_operations_blocked? &&
+        VIPS_UNTRUSTED_CONTENT_TYPES.include?(attachable_content_type(attachable))
+    end
+
+    class << self
+      # Detect whether libvips is currently blocking untrusted operations.
+      # There is no public getter for `Vips.block_untrusted`, so we probe whether
+      # an untrusted loader (svgload) is available via `vips_foreign_find_load`.
+      def vips_untrusted_operations_blocked?
+        return @vips_untrusted_operations_blocked if defined?(@vips_untrusted_operations_blocked)
+
+        @vips_untrusted_operations_blocked = detect_vips_untrusted_operations_blocked?
+      end
+
+      def reset_vips_untrusted_operations_blocked_cache!
+        remove_instance_variable(:@vips_untrusted_operations_blocked) if defined?(@vips_untrusted_operations_blocked)
+      end
+
+      private
+
+      def detect_vips_untrusted_operations_blocked?
+        require "vips"
+        require "tempfile"
+
+        Tempfile.create([ "asv_vips_untrusted_probe", ".svg" ]) do |file|
+          file.write('<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>')
+          file.flush
+          ::Vips.vips_foreign_find_load(file.path).nil?
+        end
+      rescue LoadError, StandardError
+        false
+      end
+    end
   end
 end

data/lib/active_storage_validations/railtie.rb

@@ -11,6 +11,12 @@ module ActiveStorageValidations
       end
     end
 
+    initializer "active_storage_validations.form_builder" do
+      ActiveSupport.on_load(:action_view) do
+        ActionView::Helpers::FormBuilder.prepend(ActiveStorageValidations::FormBuilder)
+      end
+    end
+
     initializer "active_storage_validations.extend_active_storage_blob" do
       ActiveSupport.on_load(:active_storage_blob) do
         include ActiveStorageValidations::ASVBlobMetadatable

data/lib/active_storage_validations/shared/asv_analyzable.rb

@@ -17,15 +17,62 @@ module ActiveStorageValidations
     # attachable with the corresponding analyzer and set the metadata in the
     # blob.
     def metadata_for(blob, attachable, metadata_keys)
+      if content_type_metadata_keys?(metadata_keys)
+        return content_type_metadata_for(blob, attachable)
+      end
+
       return blob.active_storage_validations_metadata if blob_has_asv_metadata?(blob, metadata_keys)
 
+      new_metadata = generate_metadata_for(attachable, metadata_keys) || {}
+      blob.merge_into_active_storage_validations_metadata(new_metadata)
+      blob.save!
+
+      blob.active_storage_validations_metadata
+    end
+
+    def content_type_metadata_keys?(metadata_keys)
+      metadata_keys == ActiveStorageValidations::ContentTypeValidator::METADATA_KEYS
+    end
+
+    # Same cache semantics as +metadata_for+, plus backend matching.
+    # Legacy blobs that only have +asv_content_type+ (no backend key) are treated
+    # as +:file+ — so existing file-backend analyses keep hitting the cache and
+    # are not re-analyzed / rewritten.
+    def content_type_metadata_for(blob, attachable)
+      backend = spoofing_protection_backend
+      cached = blob.active_storage_validations_metadata
+      return cached if content_type_cache_hit?(cached, backend)
+
+      metadata_keys = ActiveStorageValidations::ContentTypeValidator::METADATA_KEYS
       new_metadata = generate_metadata_for(attachable, metadata_keys)
+      return failed_content_type_metadata(backend) if content_type_analysis_failed?(new_metadata)
+
       blob.merge_into_active_storage_validations_metadata(new_metadata)
       blob.save!
 
       blob.active_storage_validations_metadata
     end
 
+    def content_type_analysis_failed?(new_metadata)
+      new_metadata.blank? || new_metadata[:content_type].blank?
+    end
+
+    # Do not return / persist another backend's cached type after a failed sniff
+    # (timeout, unsupported file, invalid Magika JSON, …). Fail closed for this
+    # request; leave blob metadata unchanged so a later attempt can retry.
+    def failed_content_type_metadata(backend)
+      { content_type: nil, content_type_backend: backend.to_s }
+    end
+
+    def content_type_cache_hit?(cached, backend)
+      return false unless cached.present? && cached[:content_type].present?
+
+      # Missing / blank backend => legacy file analysis (pre-Magika support).
+      # Those blobs keep hitting the cache for +:file+ and are not rewritten.
+      stored_backend = (cached[:content_type_backend].presence || "file").to_s
+      stored_backend == backend.to_s
+    end
+
     def blob_has_asv_metadata?(blob, metadata_keys)
       return false unless blob.active_storage_validations_metadata.present?
 
@@ -33,7 +80,7 @@ module ActiveStorageValidations
     end
 
     def generate_metadata_for(attachable, metadata_keys)
-      if metadata_keys == ActiveStorageValidations::ContentTypeValidator::METADATA_KEYS
+      if content_type_metadata_keys?(metadata_keys)
         content_type_analyzer_for(attachable).content_type
       else
         metadata_analyzer_for(attachable).metadata
@@ -52,15 +99,15 @@ module ActiveStorageValidations
     end
 
     def pdf_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::PdfAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::PdfAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def image_analyzer_for(attachable)
       case image_processor
       when :mini_magick
-        ActiveStorageValidations::Analyzer::ImageAnalyzer::ImageMagick.new(attachable)
+        ActiveStorageValidations::Analyzer::ImageAnalyzer::ImageMagick.new(attachable, **analyzer_timeout_options)
       when :vips
-        ActiveStorageValidations::Analyzer::ImageAnalyzer::Vips.new(attachable)
+        ActiveStorageValidations::Analyzer::ImageAnalyzer::Vips.new(attachable, **analyzer_timeout_options)
       end
     end
 
@@ -71,19 +118,30 @@ module ActiveStorageValidations
     end
 
     def video_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::VideoAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::VideoAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def audio_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::AudioAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::AudioAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def fallback_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::NullAnalyzer.new(attachable)
+      ActiveStorageValidations::Analyzer::NullAnalyzer.new(attachable, **analyzer_timeout_options)
     end
 
     def content_type_analyzer_for(attachable)
-      ActiveStorageValidations::Analyzer::ContentTypeAnalyzer.new(attachable)
+      case spoofing_protection_backend
+      when :magika
+        ActiveStorageValidations::Analyzer::ContentTypeAnalyzer::Magika.new(attachable, **analyzer_timeout_options)
+      else
+        ActiveStorageValidations::Analyzer::ContentTypeAnalyzer::File.new(attachable, **analyzer_timeout_options)
+      end
+    end
+
+    # Passes raw validator +timeout:+ through to analyzers. Kept out of
+    # AVAILABLE_CHECKS so ASVOptionable does not flatten it as a comparison bound.
+    def analyzer_timeout_options
+      options.key?(:timeout) ? { timeout: options[:timeout] } : {}
     end
   end
 end

data/lib/active_storage_validations/shared/asv_attachable.rb

@@ -44,7 +44,7 @@ module ActiveStorageValidations
       return to_enum(:attachables_and_blobs, record, attribute) if changes.blank? || !block_given?
 
       if changes.is_a?(ActiveStorage::Attached::Changes::CreateMany)
-        changes.attachables.zip(changes.blobs).uniq { |_, blob| blob&.id }.each do |attachable, blob|
+        changes.attachables.zip(changes.blobs).uniq { |attachable, blob| attachable_blob_key(attachable, blob) }.each do |attachable, blob|
           yield attachable, blob
         end
       else
@@ -52,6 +52,12 @@ module ActiveStorageValidations
       end
     end
 
+    def attachable_blob_key(attachable, blob)
+      return [ :blob_id, blob.id ] if blob&.id
+
+      [ :attachable, attachable.object_id ]
+    end
+
     def changes_for(record, attribute)
       if record.public_send(attribute).is_a?(ActiveStorage::Attached::One)
         record.attachment_changes[attribute.to_s].presence || record.public_send(attribute)
@@ -120,14 +126,14 @@ module ActiveStorageValidations
     def attachable_io(attachable, max_byte_size: nil)
       io = case attachable
       when ActiveStorage::Blob
-        (max_byte_size && supports_blob_download_chunk?) ? attachable.download_chunk(0...max_byte_size) : attachable.download
+        max_byte_size ? attachable.download_chunk(0...max_byte_size) : attachable.download
       when ActionDispatch::Http::UploadedFile
         max_byte_size ? attachable.read(max_byte_size) : attachable.read
       when Rack::Test::UploadedFile
         max_byte_size ? attachable.read(max_byte_size) : attachable.read
       when String
         blob = ActiveStorage::Blob.find_signed!(attachable)
-        (max_byte_size && supports_blob_download_chunk?) ? blob.download_chunk(0...max_byte_size) : blob.download
+        max_byte_size ? blob.download_chunk(0...max_byte_size) : blob.download
       when Hash
         max_byte_size ? attachable[:io].read(max_byte_size) : attachable[:io].read
       when File
@@ -208,13 +214,6 @@ module ActiveStorageValidations
     end
     alias :supports_pathname_attachment? :supports_file_attachment?
 
-    # Check if the current Rails version supports ActiveStorage::Blob#download_chunk
-    #
-    # https://github.com/rails/rails/blob/7-0-stable/activestorage/CHANGELOG.md#rails-700alpha1-september-15-2021
-    def supports_blob_download_chunk?
-      Rails.gem_version >= Gem::Version.new("7.0.0.alpha1")
-    end
-
     # Retrieve the content_type from the file name only
     def marcel_content_type_from_filename(attachable)
       Marcel::MimeType.for(name: attachable_filename(attachable).to_s)

data/lib/active_storage_validations/shared/asv_commandable.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module ActiveStorageValidations
+  # ActiveStorageValidations::ASVCommandable
+  #
+  # Runs external analyzer commands with an optional deadline and process-group
+  # kill. Used by analyzers that shell out (ffprobe, pdfinfo, file, identify).
+  module ASVCommandable
+    extend ActiveSupport::Concern
+
+    CommandResult = Struct.new(:stdout, :stderr, :status, :timed_out, keyword_init: true) do
+      def success?
+        !timed_out && status.respond_to?(:success?) && status.success?
+      end
+    end
+
+    TERM_GRACE_SECONDS = 1
+
+    private
+
+    def run_command(*argv, payload: nil)
+      timeout = timeout_in_seconds
+      stdout_reader, stdout_writer = IO.pipe
+      stderr_reader, stderr_writer = IO.pipe
+
+      pid = Process.spawn(*argv.map(&:to_s), out: stdout_writer, err: stderr_writer, pgroup: true)
+      stdout_writer.close
+      stderr_writer.close
+
+      # Drain pipes concurrently so a chatty child cannot fill the buffer and
+      # deadlock while we wait / kill it.
+      stdout_thread = Thread.new { stdout_reader.read }
+      stderr_thread = Thread.new { stderr_reader.read }
+
+      status, timed_out = wait_for_command(pid, timeout)
+      mark_timed_out!(payload, argv.first) if timed_out
+
+      CommandResult.new(
+        stdout: stdout_thread.value,
+        stderr: stderr_thread.value,
+        status: status,
+        timed_out: timed_out
+      )
+    ensure
+      close_pipe(stdout_reader)
+      close_pipe(stderr_reader)
+      close_pipe(stdout_writer)
+      close_pipe(stderr_writer)
+    end
+
+    # Waits via a reaper thread + Thread#join(timeout) so fast commands return
+    # as soon as they exit (no polling sleep). On timeout, TERM then always KILL
+    # the process group — KILL is unconditional because the direct child can exit
+    # on TERM while a grandchild forked after the group signal is still alive.
+    # The same waiter reaps so we never leave zombies.
+    def wait_for_command(pid, timeout)
+      return [ Process.wait2(pid)[1], false ] if timeout.nil?
+
+      waiter = Thread.new do
+        Process.wait2(pid)
+      rescue Errno::ECHILD
+        nil
+      end
+
+      if waiter.join(timeout)
+        return [ wait_status_from(waiter), false ]
+      end
+
+      signal_process_group(pid, :TERM)
+      waiter.join(TERM_GRACE_SECONDS)
+      signal_process_group(pid, :KILL)
+      waiter.join
+
+      [ wait_status_from(waiter), true ]
+    end
+
+    def wait_status_from(waiter)
+      waiter.value&.last
+    end
+
+    def signal_process_group(pid, signal)
+      Process.kill(signal, -pid)
+    rescue Errno::ESRCH
+      # Already exited; waiter will reap.
+    end
+
+    def close_pipe(io)
+      io&.close unless io.nil? || io.closed?
+    end
+
+    def monotonic_time
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/active_storage_validations/shared/asv_optionable.rb

@@ -22,7 +22,11 @@ module ActiveStorageValidations
       when Array
         options.map { |option| flatten_options(record, option, available_checks) }
       else
-        options.is_a?(Proc) ? options.call(record) : options
+        if options.is_a?(Proc)
+          options.arity == 0 ? options.call : options.call(record)
+        else
+          options
+        end
       end
     end
   end

data/lib/active_storage_validations/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActiveStorageValidations
-  VERSION = "3.0.5"
+  VERSION = "4.1.0"
 end

data/lib/active_storage_validations/with_audio_validator.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require_relative "shared/asv_active_storageable"
+require_relative "shared/asv_analyzable"
+require_relative "shared/asv_attachable"
+require_relative "shared/asv_errorable"
+require_relative "shared/asv_symbolizable"
+
+module ActiveStorageValidations
+  class WithAudioValidator < ActiveModel::EachValidator # :nodoc
+    include ASVActiveStorageable
+    include ASVAnalyzable
+    include ASVAttachable
+    include ASVErrorable
+    include ASVSymbolizable
+
+    ERROR_TYPES = %i[audio_missing audio_present].freeze
+    METADATA_KEYS = %i[audio].freeze
+
+    def validate_each(record, attribute, _value)
+      return if no_attachments?(record, attribute)
+
+      validate_changed_files_from_metadata(record, attribute, METADATA_KEYS)
+    end
+
+    private
+
+    def is_valid?(record, attribute, attachable, metadata)
+      expected_audio = options.fetch(:with, true)
+      return if metadata&.fetch(:audio, false) == expected_audio
+
+      errors_options = initialize_error_options(options, attachable)
+      error_type = expected_audio ? :audio_missing : :audio_present
+      add_error(record, attribute, error_type, **errors_options)
+    end
+  end
+end

data/lib/active_storage_validations.rb

@@ -2,8 +2,29 @@
 
 require "active_model"
 require "active_support/concern"
+require "active_support/core_ext/module/attribute_accessors"
+require "active_support/core_ext/numeric/time"
+
+module ActiveStorageValidations
+  # When true (default), FormBuilder#file_field automatically sets the HTML
+  # +accept+ attribute from +content_type+ validators. Can also be overridden
+  # per field with +infer_accept:+.
+  mattr_accessor :infer_file_field_accept, instance_accessor: false, default: true
+
+  # Maximum time allowed for external analyzer commands (ffprobe, pdfinfo, file,
+  # magika, MiniMagick, libvips). Set to +nil+ to disable. Per-validator +timeout:+
+  # overrides this value for the analysis that validator triggers.
+  mattr_accessor :command_timeout, instance_accessor: false, default: 10.seconds
+
+  def self.configure
+    yield self
+  end
+end
 
 require "active_storage_validations/analyzer"
+require "active_storage_validations/analyzer/content_type_analyzer"
+require "active_storage_validations/analyzer/content_type_analyzer/file"
+require "active_storage_validations/analyzer/content_type_analyzer/magika"
 require "active_storage_validations/analyzer/image_analyzer"
 require "active_storage_validations/analyzer/image_analyzer/image_magick"
 require "active_storage_validations/analyzer/image_analyzer/vips"
@@ -20,11 +41,13 @@ require "active_storage_validations/content_type_validator"
 require "active_storage_validations/limit_validator"
 require "active_storage_validations/dimension_validator"
 require "active_storage_validations/duration_validator"
+require "active_storage_validations/with_audio_validator"
 require "active_storage_validations/aspect_ratio_validator"
 require "active_storage_validations/processable_file_validator"
 require "active_storage_validations/size_validator"
 require "active_storage_validations/total_size_validator"
 require "active_storage_validations/pages_validator"
 
+require "active_storage_validations/form_builder"
 require "active_storage_validations/engine"
 require "active_storage_validations/railtie"