activestorage-hotcell-server 1.0.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf17ea2179bb687a22b71617e04962d371dec1f92a53eec85e04f1a03df6ae01
-  data.tar.gz: 52ee3dedc13811e9e71882c1a26bfe342a3f28013c9005842f1969e1cce1d3fe
+  metadata.gz: bbf72b384091a64a1a34102dd994dc55ee7631717da7b122d7467b513a6b17e8
+  data.tar.gz: bbadd4032329150ba23c9f0e92705ab0eb9785eabe7e7021a156ebd3bdd5fbdf
 SHA512:
-  metadata.gz: d7375a3807281a2f753fcaf71300f7aabbc6fd3e5312964232e75547565667264bada483eb7f0c67bc7a0b4d2093f39851b401ba144860098174da91b3b60b37
-  data.tar.gz: 1d2fe8b510a6eaffc40a19a21f5fee3bd20077a399a83c436f6616ce8476270541a8fe8347743bf736f77b80f29961e18e206f4bf96a49c8ac63524db70681e1
+  metadata.gz: 7c493037474fa7778d2e1dd9e51ead288a3c4c48ef8f7bac0066f1cd9fbcff0b2fba1da4bd44aab8b775cd0e5fa68a6a4307c2f04c2f13abe98fd2b2ea692014
+  data.tar.gz: b961c23e3ec4645153a5048ec1c50a53f595c96d99c1cf5b845a24b77feb7d3e85465c7b8104835580aa263dda2f5909561b5bd2c8720f419362ee399039e6a0

data/README.md

@@ -1,3 +1,3 @@
 # activestorage-hotcell-server
 
-Part of [HotCell](https://github.com/basecamp/hotcell). See the repository README.
+Part of [Hot Cell](https://github.com/basecamp/hotcell). See the repository README.

data/lib/active_storage/hot_cell/server/analyzers/image/vips.rb

@@ -18,7 +18,7 @@ module ActiveStorage
           # deliberately does not copy: it rescues every Vips::Error and returns an empty hash, which is then
           # merged with `analyzed: true`. An undecodable image is recorded as successfully analyzed, forever,
           # and nothing re-enqueues AnalyzeJob. Here an undecodable input raises Vips::Error, the cell answers
-          # `unreadable`, and the client decides — because only the client knows whether that verdict is safe
+          # `unreadable`, and the client decides — because only the client knows whether that failure is safe
           # to write down.
           class Vips < VipsOperation
             operation "active_storage.analyzers.image.vips"

data/lib/active_storage/hot_cell/server/magick_operation.rb

@@ -60,7 +60,7 @@ module ActiveStorage
 
         # MiniMagick::Error is how mini_magick reports a `magick` that exited non-zero — the common shape of an
         # input it cannot decode. MiniMagick::Invalid is an input `identify` rejects outright.
-        # ImageProcessing::Error is the pipeline's own verdict on the input against the requested
+        # ImageProcessing::Error is the pipeline's own rejection of the input against the requested
         # transform — a multi-layer source into a single-layer destination, for example. All three are
         # the input's fault rather than the operation's; unclassified, each was a transient `failed`
         # that never marked the blob, so the same file spent a full conversion on every request.
@@ -69,7 +69,7 @@ module ActiveStorage
         # **Accepted risk.** A tool's output is not bounded on this path. `Operation#run_tool` caps what it
         # reads at 64KB and drops the rest as it arrives, because an input that makes a tool print gigabytes
         # of diagnostics costs this worker gigabytes of address space, takes RLIMIT_DATA with it, and arrives
-        # as a `memory` verdict — which is permanent, for a document whose only crime was being noisy.
+        # as a `memory` failure — which is permanent, for a document whose only crime was being noisy.
         # mini_magick reads both streams to EOF in a thread apiece and has no setting that bounds either;
         # `graphicsmagick`, `cli_prefix`, `cli_env`, `restricted_env`, `timeout`, `logger`, `tmpdir`,
         # `errors` and `warnings` are the whole list. The premise is that patching the library is worse than

data/lib/active_storage/hot_cell/server/previewers/pdf/mutool.rb

@@ -22,7 +22,8 @@ module ActiveStorage
               # separate change.
               def render(source, destination, page:, resolution:)
                 run! "mutool", "draw", "-F", "png", "-r", resolution.to_s, "-o", destination.path,
-                     source.fd_path, page.to_s, pass: [ source.to_io ]
+                     source.fd_path, page.to_s, pass: [ source.to_io ],
+                     causes: { /cannot authenticate password/ => ProtectedDocument }
               end
 
               def tool

data/lib/active_storage/hot_cell/server/previewers/pdf/poppler.rb

@@ -22,7 +22,7 @@ module ActiveStorage
               def render(source, destination, page:, resolution:)
                 run! "pdftoppm", "-png", "-singlefile", "-cropbox", "-r", resolution.to_s,
                      "-f", page.to_s, "-l", page.to_s, source.fd_path, destination.path,
-                     pass: [ source.to_io ]
+                     pass: [ source.to_io ], causes: { /Incorrect password/ => ProtectedDocument }
 
                 destination.adopt destination.path(extension: "png")
               end

data/lib/active_storage/hot_cell/server/tool_operation.rb

@@ -20,16 +20,25 @@ module ActiveStorage
         # UnreadableInput is always in the rescue list, and this descends from it.
         class UnreadableDocument < ::HotCell::UnreadableInput; end
 
+        # The document demands credentials the cell does not have.
+        class ProtectedDocument < UnreadableDocument
+          def self.cause
+            ::HotCell::Codes::PROTECTED
+          end
+        end
+
         private
           # Runs the tool with unsetenv_others and a written environment, and turns a non-zero exit into
           # `unreadable`. The tool's own stderr is the only useful diagnostic, and it is attacker-influenced,
           # so it is capped and scrubbed on its way onto the wire like any other error message.
-          def run!(*command, pass: [])
+          # `causes` maps stderr patterns to the UnreadableDocument subclass to raise instead.
+          def run!(*command, pass: [], causes: {})
             result = run_tool(*command, pass: pass)
             return result if result.ok?
 
-            raise UnreadableDocument, "#{command.first} exited #{result.status.exitstatus}: " \
-                                      "#{result.err.to_s.strip[0, 200]}"
+            error = causes.detect { |pattern, _| result.err.to_s.match?(pattern) }&.last || UnreadableDocument
+            raise error, "#{command.first} exited #{result.status.exitstatus}: " \
+                         "#{result.err.to_s.strip[0, 200]}"
           end
 
           # An empty output means the tool said it succeeded and produced nothing, which the client would

data/lib/active_storage/hot_cell/server/transformers/image/vips.rb

@@ -10,7 +10,8 @@ module ActiveStorage
         module Image
           # What `ActiveStorage::Transformers::ImageProcessingTransformer` does, moved out of the application,
           # and deliberately nothing more: the transformations and the format reach ImageProcessing exactly as
-          # Rails hands them over.
+          # Rails hands them over, except that the client sends a web image's format as its content type's
+          # canonical extension, so `jfif` arrives as `jpg` (#84).
           #
           # There is no allowlist here, and that mirrors Rails: the vips path validates exactly one thing —
           # `combine_options` is refused — and `ActiveStorage.supported_image_processing_methods` is enforced by

data/lib/active_storage/hot_cell/server/version.rb

@@ -3,7 +3,7 @@
 module ActiveStorage
   module HotCell
     module Server
-      VERSION = "1.0.0"
+      VERSION = "1.2.0"
     end
   end
 end

data/lib/active_storage/hot_cell/server/vips_operation.rb

@@ -22,7 +22,7 @@ module ActiveStorage
 
         # Vips::Error is how libvips reports a file it cannot decode, which is common rather than exceptional: it
         # covers truncated uploads, formats this build was not compiled with, and formats deliberately refused by
-        # block_untrusted. ImageProcessing::Error is the pipeline's own verdict on the input against the
+        # block_untrusted. ImageProcessing::Error is the pipeline's own rejection of the input against the
         # requested transform, classified the same way. All of those are the input's fault and none is
         # the operation's.
         unreadable Vips::Error, ImageProcessing::Error

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activestorage-hotcell-server
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.0.0
+        version: 1.2.0
 - !ruby/object:Gem::Dependency
   name: image_processing
   requirement: !ruby/object:Gem::Requirement
@@ -66,7 +66,7 @@ dependencies:
       - !ruby/object:Gem::Version
         version: 2.2.1
 description: |
-  The HotCell operations behind activestorage-hotcell-client: image transformation with libvips or
+  The Hot Cell operations behind activestorage-hotcell-client: image transformation with libvips or
   ImageMagick, image and media analysis, PDF previews with mutool or poppler, and video previews with
   ffmpeg. Install it in the cell, with the tools the operations you load require.
 email:
@@ -99,8 +99,8 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/basecamp/hotcell
-  source_code_uri: https://github.com/basecamp/hotcell/tree/v1.0.0/activestorage-hotcell-server
-  changelog_uri: https://github.com/basecamp/hotcell/blob/v1.0.0/CHANGELOG.md
+  source_code_uri: https://github.com/basecamp/hotcell/tree/v1.2.0/activestorage-hotcell-server
+  changelog_uri: https://github.com/basecamp/hotcell/blob/v1.2.0/CHANGELOG.md
   documentation_uri: https://basecamp.github.io/hotcell/
   bug_tracker_uri: https://github.com/basecamp/hotcell/issues
   rubygems_mfa_required: 'true'