active_storage_validations 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4e1690b53c320459f3dcd874f52680d67b8e1f1b6dc68eccff486c5a664695a
-  data.tar.gz: 5d1a163646400c3ee50feff6c2c847408fa8c54f42457d9493ddfa0c4f900ab0
+  metadata.gz: '09b483aef23513aaf10b56c6df6046078bf14e93fcfdebe2e82f2db862b85514'
+  data.tar.gz: d040c36c24fc1fb2b4d1a2e6bb92bde86521cedfda4b4e96436a10b364499f63
 SHA512:
-  metadata.gz: 520513aab9962df2b30156c44685d3db9e86bb5bf73702dd11c54fd1834548bd5931d7d0841b26d9bc4bea3f4f765d72593565ca5c0c2c84efe414760f3e16b3
-  data.tar.gz: 4fecb3d1b7b33a2c78a12747fe1b6a0509e419dd1a54e1e5c089044f627d68c7eead6aaa486d2baa7bb7ebff2f4654a60262718abf9524c69ea8281713cc626b
+  metadata.gz: eb6df31c0374b1bfa804281f0effbaa0443ff6a812abd4a46e1ac4293a881e691fd5c61cd4c2622b027085acb3d10c14255f04cac3bab01f13f133d2f26c60af
+  data.tar.gz: b5553a4a7a2f08542c8e6f9dd928b0cc78a09eb846f73346dcdec1b3826bb4a5f04ac200c21e6e2f0f58f6dcc173f226a04e7a2c85d7c15a24b5b827bfb04dcb

data/README.md

@@ -90,6 +90,27 @@ Example code for adding a new content type to Marcel:
 Marcel::MimeType.extend "application/ino", extensions: %w(ino), parents: "text/plain" # Registering arduino INO files
 ```
 
+**Content type spoofing protection**
+File content type spoofing happens when an ill-intentioned user uploads a file which hides its true content type by faking its extension and its declared content type value. For example, a user may try to upload a `.exe` file (application/x-msdownload content type) dissimulated as a `.jpg` file (image/jpeg content type).
+
+By default, the gem does not prevent content type spoofing (prevent it by default is a breaking change that will be implemented in v2). The spoofing protection relies on both the linux `file` command and `Marcel` gem.
+
+Take note that the `file` analyzer will not find the exactly same content type as the ActiveStorage blob (its content type detection relies on a different logic using content+filename+extension). To handle this issue, we consider a close parent content type to be a match. For example, for an ActiveStorage blob which content type is `video/x-ms-wmv`, the `file` analyzer will probably detect a `video/x-ms-asf` content type, this will be considered as a valid match because these 2 content types are closely related. The correlation mapping is based on `Marcel::TYPE_PARENTS`.
+
+The difficulty to accurately predict a mime type may generate false positives, if so there are two solutions available:
+- If the ActiveStorage blob content type is closely related to the detected content type using the `file` analyzer, you can enhance `Marcel::TYPE_PARENTS` mapping using `Marcel::MimeType.extend "application/x-rar-compressed", parents: %(application/x-rar)` in the `config/initializers/mime_types.rb` file. (Please drop an issue so we can add it to the gem for everyone!)
+- If the ActiveStorage blob content type is not closely related, you still can disable the content type spoofing protection in the validator, if so, please drop us an issue so we can fix it for everyone!
+
+```ruby
+class User < ApplicationRecord
+  has_one_attached :avatar
+
+  validates :avatar, attached: true, content_type: :png # spoofing_protection not enabled, at your own risks!
+  validates :avatar, attached: true, content_type: { with: :png, spoofing_protection: true } # spoofing_protection enabled
+end
+```
+
+
 - Dimension validation with `width`, `height` and `in`.
 
 ```ruby
@@ -297,8 +318,7 @@ Very simple example of validation with file attached, content type check and cus
 [![Sample](https://raw.githubusercontent.com/igorkasyanchuk/active_storage_validations/master/docs/preview.png)](https://raw.githubusercontent.com/igorkasyanchuk/active_storage_validations/master/docs/preview.png)
 
 ## Test matchers
-
-Provides RSpec-compatible and Minitest-compatible matchers for testing the validators. Only `aspect_ratio`, `attached`, `content_type`, `processable_image`, `dimension`, `size` and `total_size` validators currently have their matcher developed.
+Provides RSpec-compatible and Minitest-compatible matchers for testing the validators.
 
 ### RSpec
 
@@ -331,6 +351,11 @@ describe User do
   # processable_image
   it { is_expected.to validate_processable_image_of(:avatar) }
 
+  # limit
+  # #min, #max
+  it { is_expected.to validate_limit_of(:avatar).min(1) }
+  it { is_expected.to validate_limit_of(:avatar).max(5) }
+
   # content_type:
   # #allowing, #rejecting
   it { is_expected.to validate_content_type_of(:avatar).allowing('image/png', 'image/gif') }
@@ -411,7 +436,7 @@ Then you can use the matchers with the syntax specified in the RSpec section, ju
 
 To run tests in root folder of gem:
 
-* `BUNDLE_GEMFILE=gemfiles/rails_6_1_3_1.gemfile bundle exec rake test` to run for Rails 6.1
+* `BUNDLE_GEMFILE=gemfiles/rails_6_1_4.gemfile bundle exec rake test` to run for Rails 6.1.4
 * `BUNDLE_GEMFILE=gemfiles/rails_7_0.gemfile bundle exec rake test` to run for Rails 7.0
 * `BUNDLE_GEMFILE=gemfiles/rails_7_1.gemfile bundle exec rake test` to run for Rails 7.0
 * `BUNDLE_GEMFILE=gemfiles/rails_next.gemfile bundle exec rake test` to run for Rails main branch
@@ -419,11 +444,11 @@ To run tests in root folder of gem:
 Snippet to run in console:
 
 ```bash
-BUNDLE_GEMFILE=gemfiles/rails_6_1_3_1.gemfile bundle
+BUNDLE_GEMFILE=gemfiles/rails_6_1_4.gemfile bundle
 BUNDLE_GEMFILE=gemfiles/rails_7_0.gemfile bundle
 BUNDLE_GEMFILE=gemfiles/rails_7_1.gemfile bundle
 BUNDLE_GEMFILE=gemfiles/rails_next.gemfile bundle
-BUNDLE_GEMFILE=gemfiles/rails_6_1_3_1.gemfile bundle exec rake test
+BUNDLE_GEMFILE=gemfiles/rails_6_1_4.gemfile bundle exec rake test
 BUNDLE_GEMFILE=gemfiles/rails_7_0.gemfile bundle exec rake test
 BUNDLE_GEMFILE=gemfiles/rails_7_1.gemfile bundle exec rake test
 BUNDLE_GEMFILE=gemfiles/rails_next.gemfile bundle exec rake test
@@ -434,18 +459,6 @@ Tips:
 - To focus a specific file, use the TEST option provided by minitest, e.g. to only run size_validator_test.rb file you will execute the following command: `bundle exec rake test TEST=test/validators/size_validator_test.rb`
 
 
-## Known issues
-
-- There is an issue in Rails which it possible to get if you have added a validation and generating for example an image preview of attachments. It can be fixed with this:
-
-```erb
-  <% if @user.avatar.attached? && @user.avatar.attachment.blob.present? && @user.avatar.attachment.blob.persisted? %>
-    <%= image_tag @user.avatar %>
-  <% end %>
-```
-
-This is a Rails issue, and is fixed in Rails 6.
-
 ## Contributing
 
 You are welcome to contribute.

data/config/locales/da.yml

@@ -1,8 +1,8 @@
-# Danish
 da:
   errors:
     messages:
       content_type_invalid: "har en ugyldig indholdstype"
+      spoofed_content_type: "har en indholdstype, der ikke er, hvad den erklæres gennem sit indhold, filnavn og udvidelse"
       file_size_not_less_than: "filstørrelsen skal være mindre end %{max_size} (den nuværende størrelse er %{file_size})"
       file_size_not_less_than_or_equal_to: "filstørrelsen skal være mindre end eller lig med %{max_size} (den nuværende størrelse er %{file_size})"
       file_size_not_greater_than: "filstørrelsen skal være større end %{min_size} (den nuværende størrelse er %{file_size})"

data/config/locales/de.yml

@@ -2,6 +2,7 @@ de:
   errors:
     messages:
       content_type_invalid: "hat einen ungültigen Dateityp"
+      spoofed_content_type: "hat einen Inhaltstyp, der nicht dem entspricht, was durch Inhalt, Dateinamen und Erweiterung deklariert wird"
       file_size_not_less_than: "Dateigröße muss kleiner als %{max_size} sein (aktuelle Dateigröße ist %{file_size})"
       file_size_not_less_than_or_equal_to: "Dateigröße muss kleiner oder gleich %{max_size} sein (aktuelle Dateigröße ist %{file_size})"
       file_size_not_greater_than: "Dateigröße muss größer als %{min_size} sein (aktuelle Dateigröße ist %{file_size})"

data/config/locales/en.yml

@@ -2,6 +2,7 @@ en:
   errors:
     messages:
       content_type_invalid: "has an invalid content type"
+      spoofed_content_type: "has a content type that is not what it is declared through its content, filename and extension"
       file_size_not_less_than: "file size must be less than %{max_size} (current size is %{file_size})"
       file_size_not_less_than_or_equal_to: "file size must be less than or equal to %{max_size} (current size is %{file_size})"
       file_size_not_greater_than: "file size must be greater than %{min_size} (current size is %{file_size})"

data/config/locales/es.yml

@@ -2,6 +2,7 @@ es:
   errors:
     messages:
       content_type_invalid: "tiene un tipo de contenido inválido"
+      spoofed_content_type: "tiene un tipo de contenido que no es el que se declara a través de su contenido, nombre de archivo y extensión"
       file_size_not_less_than: "el tamaño del archivo debe ser inferior a %{max_size} (el tamaño actual es %{file_size})"
       file_size_not_less_than_or_equal_to: "el tamaño del archivo debe ser menor o igual a %{max_size} (el tamaño actual es %{file_size})"
       file_size_not_greater_than: "el tamaño del archivo debe ser mayor que %{min_size} (el tamaño actual es %{file_size})"

data/config/locales/fr.yml

@@ -2,6 +2,7 @@ fr:
   errors:
     messages:
       content_type_invalid: "a un type de contenu non valide"
+      spoofed_content_type: "a un type de contenu qui n'est pas celui déclaré via son contenu, son nom de fichier et son extension"
       file_size_not_less_than: "la taille du fichier doit être inférieure à %{max_size} (la taille actuelle est %{file_size})"
       file_size_not_less_than_or_equal_to: "la taille du fichier doit être inférieure ou égale à %{max_size} (la taille actuelle est %{file_size})"
       file_size_not_greater_than: "la taille du fichier doit être supérieure à %{min_size} (la taille actuelle est %{file_size})"

data/config/locales/it.yml

@@ -2,6 +2,7 @@ it:
   errors:
     messages:
       content_type_invalid: "ha un tipo di contenuto non valido"
+      spoofed_content_type: "ha un tipo di contenuto che non è quello dichiarato tramite contenuto, nome file ed estensione"
       file_size_not_less_than: "la dimensione del file deve essere inferiore a %{max_size} (la dimensione attuale è %{file_size})"
       file_size_not_less_than_or_equal_to: "la dimensione del file deve essere minore o uguale a %{max_size} (la dimensione attuale è %{file_size})"
       file_size_not_greater_than: "la dimensione del file deve essere maggiore di %{min_size} (la dimensione attuale è %{file_size})"

data/config/locales/ja.yml

@@ -2,6 +2,7 @@ ja:
   errors:
     messages:
       content_type_invalid: "のContent Typeが不正です"
+      spoofed_content_type: "コンテンツ、ファイル名、拡張子で宣言されているコンテンツ タイプと異なるコンテンツ タイプが含まれています"
       file_size_not_less_than: "ファイル サイズは %{max_size} 未満にする必要があります (現在のサイズは %{file_size})"
       file_size_not_less_than_or_equal_to: "ファイル サイズは %{max_size} 以下である必要があります (現在のサイズは %{file_size})"
       file_size_not_greater_than: "ファイル サイズは %{min_size} より大きい必要があります (現在のサイズは %{file_size} です)"

data/config/locales/nl.yml

@@ -2,6 +2,7 @@ nl:
   errors:
     messages:
       content_type_invalid: "heeft een ongeldig inhoudstype"
+      spoofed_content_type: "heeft een inhoudstype dat niet is wat het wordt aangegeven via de inhoud, bestandsnaam en extensie"
       file_size_not_less_than: "bestandsgrootte moet kleiner zijn dan %{max_size} (huidige grootte is %{file_size})"
       file_size_not_less_than_or_equal_to: "bestandsgrootte moet kleiner zijn dan of gelijk zijn aan %{max_size} (huidige grootte is %{file_size})"
       file_size_not_greater_than: "bestandsgrootte moet groter zijn dan %{min_size} (huidige grootte is %{file_size})"

data/config/locales/pl.yml

@@ -2,6 +2,7 @@ pl:
   errors:
     messages:
       content_type_invalid: "jest nieprawidłowego typu"
+      spoofed_content_type: "ma typ zawartości inny niż zadeklarowany w treści, nazwie pliku i rozszerzeniu"
       file_size_not_less_than: "rozmiar pliku musi być mniejszy niż %{max_size} (obecny rozmiar to %{file_size})"
       file_size_not_less_than_or_equal_to: "rozmiar pliku musi być mniejszy lub równy %{max_size} (obecny rozmiar to %{file_size})"
       file_size_not_greater_than: "rozmiar pliku musi być większy niż %{min_size} (obecny rozmiar to %{file_size})"

data/config/locales/pt-BR.yml

@@ -2,6 +2,7 @@ pt-BR:
   errors:
     messages:
       content_type_invalid: "tem um tipo de arquivo inválido"
+      spoofed_content_type: "tem um tipo de conteúdo que não é o declarado através de seu conteúdo, nome de arquivo e extensão"
       file_size_not_less_than: "o tamanho do arquivo deve ser menor que %{max_size} (o tamanho atual é %{file_size})"
       file_size_not_less_than_or_equal_to: "o tamanho do arquivo deve ser menor ou igual a %{max_size} (o tamanho atual é %{file_size})"
       file_size_not_greater_than: "o tamanho do arquivo deve ser maior que %{min_size} (o tamanho atual é %{file_size})"

data/config/locales/ru.yml

@@ -2,6 +2,7 @@ ru:
   errors:
     messages:
       content_type_invalid: "имеет недопустимый тип содержимого"
+      spoofed_content_type: "имеет тип контента, который не соответствует тому, который объявлен в его содержимом, имени файла и расширении"
       file_size_not_less_than: "размер файла должен быть меньше %{max_size} (текущий размер %{file_size})"
       file_size_not_less_than_or_equal_to: "размер файла должен быть меньше или равен %{max_size} (текущий размер %{file_size})"
       file_size_not_greater_than: "размер файла должен быть больше %{min_size} (текущий размер %{file_size})"

data/config/locales/sv.yml

@@ -2,6 +2,7 @@ sv:
   errors:
     messages:
       content_type_invalid: "Har en ogiltig filtyp"
+      spoofed_content_type: "har en innehållstyp som inte är vad den deklareras genom sitt innehåll, filnamn och tillägg"
       file_size_not_less_than: "filstorleken måste vara mindre än %{max_size} (nuvarande storlek är %{file_size})"
       file_size_not_less_than_or_equal_to: "filstorleken måste vara mindre än eller lika med %{max_size} (nuvarande storlek är %{file_size})"
       file_size_not_greater_than: "filstorleken måste vara större än %{min_size} (nuvarande storlek är %{file_size})"

data/config/locales/tr.yml

@@ -2,6 +2,7 @@ tr:
   errors:
     messages:
       content_type_invalid: "geçersiz dosya tipine sahip"
+      spoofed_content_type: "içeriği, dosya adı ve uzantısı aracılığıyla bildirildiği gibi olmayan bir içerik türüne sahip"
       file_size_not_less_than: "dosya boyutu %{max_size} boyutundan küçük olmalıdır (geçerli boyut %{file_size}'dir)"
       file_size_not_less_than_or_equal_to: "dosya boyutu %{max_size} değerinden küçük veya ona eşit olmalıdır (geçerli boyut %{file_size}'dir)"
       file_size_not_greater_than: "dosya boyutu %{min_size} boyutundan büyük olmalıdır (geçerli boyut %{file_size}'dir)"

data/config/locales/uk.yml

@@ -2,6 +2,7 @@ uk:
   errors:
     messages:
       content_type_invalid: "має неприпустимий тип вмісту"
+      spoofed_content_type: "має тип вмісту, який не відповідає тому, що він оголошений через його вміст, назву файлу та розширення"
       file_size_not_less_than: "розмір файлу має бути менше %{max_size} (поточний розмір %{file_size})"
       file_size_not_less_than_or_equal_to: "розмір файлу має бути меншим або дорівнювати %{max_size} (поточний розмір %{file_size})"
       file_size_not_greater_than: "розмір файлу має бути більшим ніж %{min_size} (поточний розмір %{file_size})"

data/config/locales/vi.yml

@@ -2,6 +2,7 @@ vi:
   errors:
     messages:
       content_type_invalid: "tệp không hợp lệ"
+      spoofed_content_type: "có loại nội dung không phải là loại nội dung được khai báo thông qua nội dung, tên tệp và phần mở rộng của nó"
       file_size_not_less_than: "kích thước tệp phải nhỏ hơn %{max_size} (kích thước hiện tại là %{file_size})"
       file_size_not_less_than_or_equal_to: "kích thước tệp phải nhỏ hơn hoặc bằng %{max_size} (kích thước hiện tại là %{file_size})"
       file_size_not_greater_than: "kích thước tệp phải lớn hơn %{min_size} (kích thước hiện tại là %{file_size})"

data/config/locales/zh-CN.yml

@@ -2,6 +2,7 @@ zh-CN:
   errors:
     messages:
       content_type_invalid: "文件类型错误"
+      spoofed_content_type: "内容类型与通过内容、文件名和扩展名声明的内容类型不同"
       file_size_not_less_than: "文件大小必须小于 %{max_size}（当前大小为 %{file_size})"
       file_size_not_less_than_or_equal_to: "文件大小必须小于或等于 %{max_size}（当前大小为 %{file_size})"
       file_size_not_greater_than: "文件大小必须大于 %{min_size}（当前大小为 %{file_size})"

data/lib/active_storage_validations/aspect_ratio_validator.rb

@@ -1,13 +1,16 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
+require_relative 'concerns/metadatable.rb'
 require_relative 'concerns/symbolizable.rb'
-require_relative 'metadata.rb'
 
 module ActiveStorageValidations
   class AspectRatioValidator < ActiveModel::EachValidator # :nodoc
-    include OptionProcUnfolding
+    include ActiveStorageable
     include Errorable
+    include Metadatable
+    include OptionProcUnfolding
     include Symbolizable
 
     AVAILABLE_CHECKS = %i[with].freeze
@@ -28,44 +31,17 @@ module ActiveStorageValidations
       ensure_aspect_ratio_validity
     end
 
-    if Rails.gem_version >= Gem::Version.new('6.0.0')
-      def validate_each(record, attribute, _value)
-        return true unless record.send(attribute).attached?
-
-        changes = record.attachment_changes[attribute.to_s]
-        return true if changes.blank?
+    def validate_each(record, attribute, _value)
+      return if no_attachments?(record, attribute)
 
-        files = Array.wrap(changes.is_a?(ActiveStorage::Attached::Changes::CreateMany) ? changes.attachables : changes.attachable)
-
-        files.each do |file|
-          metadata = Metadata.new(file).metadata
-          next if is_valid?(record, attribute, file, metadata)
-          break
-        end
-      end
-    else
-      # Rails 5
-      def validate_each(record, attribute, _value)
-        return true unless record.send(attribute).attached?
-
-        files = Array.wrap(record.send(attribute))
-
-        files.each do |file|
-          # Analyze file first if not analyzed to get all required metadata.
-          file.analyze; file.reload unless file.analyzed?
-          metadata = file.metadata
-
-          next if is_valid?(record, attribute, file, metadata)
-          break
-        end
-      end
+      validate_changed_files_from_metadata(record, attribute)
     end
 
     private
 
-    def is_valid?(record, attribute, file, metadata)
+    def is_valid?(record, attribute, attachable, metadata)
       flat_options = unfold_procs(record, self.options, AVAILABLE_CHECKS)
-      errors_options = initialize_error_options(options, file)
+      errors_options = initialize_error_options(options, attachable)
 
       if metadata[:width].to_i <= 0 || metadata[:height].to_i <= 0
         errors_options[:aspect_ratio] = flat_options[:with]

data/lib/active_storage_validations/attached_validator.rb

@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
 require_relative 'concerns/symbolizable.rb'
 
 module ActiveStorageValidations
   class AttachedValidator < ActiveModel::EachValidator # :nodoc:
+    include ActiveStorageable
     include Errorable
     include Symbolizable
 
@@ -13,14 +15,14 @@ module ActiveStorageValidations
     def check_validity!
       %i[allow_nil allow_blank].each do |not_authorized_option|
         if options.include?(not_authorized_option)
-          raise ArgumentError, "You cannot pass the :#{not_authorized_option} option to the #{self.class.name.split('::').last.underscore}"
+          raise ArgumentError, "You cannot pass the :#{not_authorized_option} option to the #{self.class.to_sym} validator"
         end
       end
     end
 
     def validate_each(record, attribute, _value)
-      return if record.send(attribute).attached? &&
-                !Array.wrap(record.send(attribute)).all?(&:marked_for_destruction?)
+      return if attachments_present?(record, attribute) &&
+                will_have_attachments_after_save?(record, attribute)
 
       errors_options = initialize_error_options(options)
       add_error(record, attribute, ERROR_TYPES.first, **errors_options)

data/lib/active_storage_validations/base_size_validator.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
+require_relative 'concerns/active_storageable.rb'
 require_relative 'concerns/errorable.rb'
 require_relative 'concerns/symbolizable.rb'
 
 module ActiveStorageValidations
   class BaseSizeValidator < ActiveModel::EachValidator # :nodoc:
-    include OptionProcUnfolding
+    include ActiveStorageable
     include Errorable
+    include OptionProcUnfolding
     include Symbolizable
 
     delegate :number_to_human_size, to: ActiveSupport::NumberHelper

data/lib/active_storage_validations/concerns/active_storageable.rb

@@ -0,0 +1,28 @@
+module ActiveStorageValidations
+  # ActiveStorageValidations::ActiveStorageable
+  #
+  # Validator helper methods to make our code more explicit.
+  module ActiveStorageable
+    extend ActiveSupport::Concern
+
+    private
+
+    # Retrieve either an ActiveStorage::Attached::One or an
+    # ActiveStorage::Attached::Many instance depending on attribute definition
+    def attached_files(record, attribute)
+      Array.wrap(record.send(attribute))
+    end
+
+    def attachments_present?(record, attribute)
+      record.send(attribute).attached?
+    end
+
+    def no_attachments?(record, attribute)
+      !attachments_present?(record, attribute)
+    end
+
+    def will_have_attachments_after_save?(record, attribute)
+      !Array.wrap(record.send(attribute)).all?(&:marked_for_destruction?)
+    end
+  end
+end

data/lib/active_storage_validations/concerns/errorable.rb

@@ -16,12 +16,11 @@ module ActiveStorageValidations
     end
 
     def add_error(record, attribute, error_type, **errors_options)
-      type = errors_options[:custom_message].presence || error_type
-      return if record.errors.added?(attribute, type)
+      return if record.errors.added?(attribute, error_type)
 
       # You can read https://api.rubyonrails.org/classes/ActiveModel/Errors.html#method-i-add
       # to better understand how Rails model errors work
-      record.errors.add(attribute, type, **errors_options)
+      record.errors.add(attribute, error_type, **errors_options)
     end
 
     private

data/lib/active_storage_validations/concerns/loggable.rb

@@ -0,0 +1,9 @@
+module ActiveStorageValidations
+  module Loggable
+    extend ActiveSupport::Concern
+
+    def logger
+      Rails.logger
+    end
+  end
+end

data/lib/active_storage_validations/concerns/metadatable.rb

@@ -0,0 +1,31 @@
+require_relative '../metadata'
+
+module ActiveStorageValidations
+  # ActiveStorageValidations::Metadatable
+  #
+  # Validator methods for analyzing the attachment metadata.
+  module Metadatable
+    extend ActiveSupport::Concern
+
+    private
+
+    # Loop through the newly submitted attachables to validate them
+    def validate_changed_files_from_metadata(record, attribute)
+      attachables_from_changes(record, attribute).each do |attachable|
+        is_valid?(record, attribute, attachable, Metadata.new(attachable).metadata)
+      end
+    end
+
+    # Retrieve an array of newly submitted attachables which are file
+    # representations such as ActiveStorage::Blob, ActionDispatch::Http::UploadedFile,
+    # Rack::Test::UploadedFile, Hash, String, File or Pathname
+    def attachables_from_changes(record, attribute)
+      changes = record.attachment_changes[attribute.to_s]
+      return [] if changes.blank?
+
+      Array.wrap(
+        changes.is_a?(ActiveStorage::Attached::Changes::CreateMany) ? changes.attachables : changes.attachable
+      )
+    end
+  end
+end

data/lib/active_storage_validations/content_type_spoof_detector.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require_relative 'concerns/loggable'
+require 'open3'
+
+module ActiveStorageValidations
+  class ContentTypeSpoofDetector
+    class FileCommandLineToolNotInstalledError < StandardError; end
+
+    include Loggable
+
+    def initialize(record, attribute, file)
+      @record = record
+      @attribute = attribute
+      @file = file
+    end
+
+    def spoofed?
+      if supplied_content_type_vs_open3_analizer_mismatch?
+        logger.info "Content Type Spoofing detected for file '#{filename}'. The supplied content type is '#{supplied_content_type}' but the content type discovered using open3 is '#{content_type_from_analyzer}'."
+        true
+      else
+        false
+      end
+    end
+
+    private
+
+    def filename
+      @filename ||= @file.blob.present? && @file.blob.filename.to_s
+    end
+
+    def supplied_content_type
+      # We remove potential mime type parameters
+      @supplied_content_type ||= @file.blob.present? && @file.blob.content_type.downcase.split(/[;,\s]/, 2).first
+    end
+
+    def io
+      @io ||= case @record.public_send(@attribute)
+              when ActiveStorage::Attached::One then get_io_from_one
+              when ActiveStorage::Attached::Many then get_io_from_many
+              end
+    end
+
+    def get_io_from_one
+      attachable = @record.attachment_changes[@attribute.to_s].attachable
+
+      case attachable
+      when ActionDispatch::Http::UploadedFile
+        attachable.read
+      when String
+        blob = ActiveStorage::Blob.find_signed!(attachable)
+        blob.download
+      when ActiveStorage::Blob
+        attachable.download
+      when Hash
+        attachable[:io].read
+      end
+    end
+
+    def get_io_from_many
+      attachables = @record.attachment_changes[@attribute.to_s].attachables
+
+      if attachables.all? { |attachable| attachable.is_a?(ActionDispatch::Http::UploadedFile) }
+        attachables.find do |uploaded_file|
+          checksum = ActiveStorage::Blob.new.send(:compute_checksum_in_chunks, uploaded_file)
+          checksum == @file.checksum
+        end.read
+      elsif attachables.all? { |attachable| attachable.is_a?(String) }
+        # It's only possible to pass one String as attachable (not an array of String)
+        blob = ActiveStorage::Blob.find_signed!(attachables.first)
+        blob.download
+      elsif attachables.all? { |attachable| attachable.is_a?(ActiveStorage::Blob) }
+        attachables.find { |blob| blob == @file.blob }.download
+      elsif attachables.all? { |attachable| attachable.is_a?(Hash) }
+        # It's only possible to pass one Hash as attachable (not an array of Hash)
+        attachables.first[:io].read
+      end
+    end
+
+    def content_type_from_analyzer
+      # Using Open3 is a better alternative than Marcel (Marcel::MimeType.for(io))
+      # for analyzing content type solely based on the file io
+      @content_type_from_analyzer ||= open3_mime_type_for_io
+    end
+
+    def open3_mime_type_for_io
+      return nil if io.blank?
+
+      Tempfile.create do |tempfile|
+        tempfile.binmode
+        tempfile.write(io)
+        tempfile.rewind
+
+        command = "file -b --mime-type #{tempfile.path}"
+        output, status = Open3.capture2(command)
+
+        if status.success?
+          mime_type = output.strip
+          return mime_type
+        else
+          raise "Error determining MIME type: #{output}"
+        end
+
+      rescue Errno::ENOENT
+        raise FileCommandLineToolNotInstalledError, 'file command-line tool is not installed'
+      end
+    end
+
+    def supplied_content_type_vs_open3_analizer_mismatch?
+      supplied_content_type.present? &&
+        !supplied_content_type_intersects_content_type_from_analyzer?
+    end
+
+    def supplied_content_type_intersects_content_type_from_analyzer?
+      # Ruby intersects? method is only available from 3.1
+      enlarged_content_type(supplied_content_type).any? do |item|
+        enlarged_content_type(content_type_from_analyzer).include?(item)
+      end
+    end
+
+    def enlarged_content_type(content_type)
+      [content_type, *parent_content_types(content_type)].compact.uniq
+    end
+
+    def parent_content_types(content_type)
+      Marcel::TYPE_PARENTS[content_type] || []
+    end
+  end
+end