active_storage_validations 3.0.5 → 3.0.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3d55df23fe62535fca12b811b9f1ff5b7ae1c1636899e9674a88b2077ce688dc
-  data.tar.gz: a0cafde4518c1ffbd84fcd69a88f1e56239b7845c81b6294cdf96ba394f88883
+  metadata.gz: fb09e2b76b2325f8dab17bd4774b91bb1f041766e3705e563f338951d04e191a
+  data.tar.gz: 56ed87a99def7941a8d17e4433980c947c8771c3dd42141d0f1f13702c8556c2
 SHA512:
-  metadata.gz: 70333f40a64146d92428921d0e6adb4ce1c5a3cdb547c3378def688d735f1ecdad0665143c1e3bc5f364b5f5a924dd36403dce618e6937a05594eb09799f8a2c
-  data.tar.gz: 966a85f0f4a99283ba24e42a657d9dc8b9cc384161c9a034e4568d90ede2b4710d57f79aea1cee4a2b995350d7fd9a0b431afba0aab8993956284019c1ca7506
+  metadata.gz: 84fb802a4958ef5b3e00e088383768540849a883b3f2bd757b19ed24c0516d1fd8a498aaaac93ef0e02d6105dca0c6058e5a85ac3a4d1a1b0d79cd1e682dfb45
+  data.tar.gz: de96e6b525ca4ff0e9e3342b9bd1719c199e956b807467c62d6f063e649f80348e9b323525b1c99f203b025e08a995bc8534b1fd01c434579eca5526ee2ced61

data/lib/active_storage_validations/processable_file_validator.rb

@@ -19,6 +19,28 @@ module ActiveStorageValidations
     ].freeze
     METADATA_KEYS = %i[].freeze
 
+    # Content types whose libvips loaders are marked untrusted / unfuzzed
+    # (VIPS_OPERATION_UNTRUSTED). After Rails calls `Vips.block_untrusted(true)`,
+    # analysis of these types returns no width/height (empty metadata here),
+    # which is not the same as a corrupt / unprocessable file.
+    #
+    # Matches the formats called out in the Active Storage security release
+    # changelogs (7.2.3.2 / 8.0.5.1 / 8.1.3.1):
+    # https://github.com/rails/rails/blob/v8.1.3.1/activestorage/CHANGELOG.md
+    # https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
+    VIPS_UNTRUSTED_CONTENT_TYPES = %w[
+      image/bmp
+      image/vnd.microsoft.icon
+      image/vnd.adobe.photoshop
+      image/svg+xml
+      image/jxl
+      image/jp2
+      image/x-portable-anymap
+      image/x-portable-bitmap
+      image/x-portable-graymap
+      image/x-portable-pixmap
+    ].freeze
+
     def validate_each(record, attribute, _value)
       return if no_attachments?(record, attribute)
 
@@ -28,10 +50,47 @@ module ActiveStorageValidations
     private
 
     def is_valid?(record, attribute, attachable, metadata)
-      return if !metadata.empty?
+      return if metadata.present?
+      return if vips_unanalyzable_by_policy?(attachable)
 
       errors_options = initialize_error_options(options, attachable)
       add_error(record, attribute, ERROR_TYPES.first, **errors_options)
     end
+
+    def vips_unanalyzable_by_policy?(attachable)
+      image_processor == :vips &&
+        self.class.vips_untrusted_operations_blocked? &&
+        VIPS_UNTRUSTED_CONTENT_TYPES.include?(attachable_content_type(attachable))
+    end
+
+    class << self
+      # Detect whether libvips is currently blocking untrusted operations.
+      # There is no public getter for `Vips.block_untrusted`, so we probe whether
+      # an untrusted loader (svgload) is available via `vips_foreign_find_load`.
+      def vips_untrusted_operations_blocked?
+        return @vips_untrusted_operations_blocked if defined?(@vips_untrusted_operations_blocked)
+
+        @vips_untrusted_operations_blocked = detect_vips_untrusted_operations_blocked?
+      end
+
+      def reset_vips_untrusted_operations_blocked_cache!
+        remove_instance_variable(:@vips_untrusted_operations_blocked) if defined?(@vips_untrusted_operations_blocked)
+      end
+
+      private
+
+      def detect_vips_untrusted_operations_blocked?
+        require "vips"
+        require "tempfile"
+
+        Tempfile.create([ "asv_vips_untrusted_probe", ".svg" ]) do |file|
+          file.write('<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>')
+          file.flush
+          ::Vips.vips_foreign_find_load(file.path).nil?
+        end
+      rescue LoadError, StandardError
+        false
+      end
+    end
   end
 end

data/lib/active_storage_validations/shared/asv_attachable.rb

@@ -44,7 +44,7 @@ module ActiveStorageValidations
       return to_enum(:attachables_and_blobs, record, attribute) if changes.blank? || !block_given?
 
       if changes.is_a?(ActiveStorage::Attached::Changes::CreateMany)
-        changes.attachables.zip(changes.blobs).uniq { |_, blob| blob&.id }.each do |attachable, blob|
+        changes.attachables.zip(changes.blobs).uniq { |attachable, blob| attachable_blob_key(attachable, blob) }.each do |attachable, blob|
           yield attachable, blob
         end
       else
@@ -52,6 +52,12 @@ module ActiveStorageValidations
       end
     end
 
+    def attachable_blob_key(attachable, blob)
+      return [ :blob_id, blob.id ] if blob&.id
+
+      [ :attachable, attachable.object_id ]
+    end
+
     def changes_for(record, attribute)
       if record.public_send(attribute).is_a?(ActiveStorage::Attached::One)
         record.attachment_changes[attribute.to_s].presence || record.public_send(attribute)

data/lib/active_storage_validations/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ActiveStorageValidations
-  VERSION = "3.0.5"
+  VERSION = "3.0.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: active_storage_validations
 version: !ruby/object:Gem::Version
-  version: 3.0.5
+  version: 3.0.6
 platform: ruby
 authors:
 - Igor Kasyanchuk
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-17 00:00:00.000000000 Z
+date: 2026-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activejob
@@ -108,6 +108,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 4.9.5
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: minitest-focus
   requirement: !ruby/object:Gem::Requirement