activestorage-office-previewer 0.1.2 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0e244b0f3233795591d219542fac46b19bc1efc87e64ca5560a75e6ca56f9e3
-  data.tar.gz: 6963f641fd72c599266e629cddee3d8b4ccf5dfdbd288973f75c74378e6ba245
+  metadata.gz: a74c92bd90571f8f11d06448107750e3f18ecb0d57a4630dea9e9ab51dce0806
+  data.tar.gz: 5f77832a3f5b34c87082756d9d655eaca45c7db6fc85d47028771c0348bed613
 SHA512:
-  metadata.gz: 57f20a13cfb1e64615796709f27fa67a0cfc9464677e173051956fd5fad1a375ab32b503765dfaa5af2a4870cb6ca0c0c4b47ddf6f356b29aa2abba5d0f57c8b
-  data.tar.gz: 35541067f2cca532716f2e49bf979159d478a484038783486123466644d34dd7e2101ea634124b62992cd27521c966499e6f87e7fe5e22c660f8c6005fdb06e6
+  metadata.gz: a1c498d69a377ebb7e70f2e3df6ab75f70a58e48849e413840ca9bc6f891e9b3e3854d108e8caa3d983bbfe37300ead05c76ef818e67e862486d85a758e3e4b9
+  data.tar.gz: 4a760f799cff0aee29183c4261f734178ee2a042d9ef1ee1386c48373872f86ac5f49d6d2fb52b9b834d615c636ed6cd64209a73e1094925ec009f5220075f71

data/README.md

@@ -17,6 +17,17 @@ gem "activestorage-office-previewer"
 
 Generate previews of Microsoft Office files using Active Storage’s [preview feature](https://guides.rubyonrails.org/active_storage_overview.html#previewing-files).
 
+## Security
+
+This gem converts documents that your users upload. Document conversion is a high-risk operation. LibreOffice is a large application with a wide feature set.
+
+Version 0.2.0 adds two defense-in-depth layers:
+
+* **An environment allowlist.** The gem starts `soffice` with a minimal environment. Application secrets in the host environment do not reach the `soffice` process.
+* **A throwaway user profile.** Each conversion uses a new LibreOffice profile. The profile refuses active content and externally linked resources.
+
+**Isolate the converter.** These two layers reduce risk. They do not replace process isolation. Run LibreOffice with no access to the host filesystem, no access to host process data, and no access to your secrets. Use a container, a dedicated user account, or a namespace.
+
 ## License
 
 This gem is released under the terms of the MIT license.

data/lib/active_storage/previewer/office_previewer.rb

@@ -1,4 +1,6 @@
 require "active_storage/previewer"
+require "tmpdir"
+require "uri"
 
 class ActiveStorage::Previewer::OfficePreviewer < ActiveStorage::Previewer
   ACCEPTABLE_CONTENT_TYPES = [
@@ -12,22 +14,60 @@ class ActiveStorage::Previewer::OfficePreviewer < ActiveStorage::Previewer
     "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" # .xlsx
   ]
 
+  # LibreOffice is launched with an explicit, minimal environment rather than the
+  # full environment of the host process. Only these variables are forwarded; every
+  # other variable — application secrets such as RAILS_MASTER_KEY, DATABASE_URL, or
+  # cloud credentials in particular — is withheld from the child process. Only the
+  # set of names is fixed here: the values are taken from the parent environment, so
+  # each deployment keeps its own locale, paths, and temporary directory.
+  PRESERVED_ENV_KEYS = %w[
+    PATH HOME LANG LANGUAGE LC_ALL LC_CTYPE LC_MESSAGES LC_NUMERIC TMPDIR TMP TEMP USER LOGNAME
+  ]
+
+  # Seeded into a throwaway LibreOffice user profile for every conversion.
+  #
+  # DisableActiveContent turns off "active content" — LibreOffice's term for OLE and
+  # DDE objects and other embedded executable content.
+  #
+  # BlockUntrustedRefererLinks refuses externally linked resources. Without it a
+  # document may reference a file by link and LibreOffice resolves that reference
+  # during conversion. The regression test in test/office_previewer_test.rb covers
+  # this path. Do not remove either key without re-running that test.
+  #
+  # Both keys are set deliberately. The measured drop in rendered ink (0.0965 to
+  # 0.0047 on LibreOffice 24.2.7.2) was obtained with DisableActiveContent alone, so
+  # that is the key the measurement exercises. BlockUntrustedRefererLinks is set as
+  # well because it is the documented lever for linked resources, and relying on a
+  # single observed behaviour across LibreOffice versions is not worth the risk.
+  REGISTRY_MODIFICATIONS = <<~XCU
+    <?xml version="1.0" encoding="UTF-8"?>
+    <oor:items xmlns:oor="http://openoffice.org/2001/registry" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+     <item oor:path="/org.openoffice.Office.Common/Security/Scripting">
+      <prop oor:name="DisableActiveContent" oor:op="fuse"><value>true</value></prop>
+      <prop oor:name="BlockUntrustedRefererLinks" oor:op="fuse"><value>true</value></prop>
+     </item>
+    </oor:items>
+  XCU
+
   class << self
     def accept?(blob)
       blob.content_type.in?(ACCEPTABLE_CONTENT_TYPES) && soffice_exists?
     end
 
     def soffice_exists?
-      if @soffice_exists.nil?
-        @soffice_exists = system(soffice_path, "--version", out: File::NULL, err: File::NULL)
-      else
-        @soffice_exists
-      end
+      return @soffice_exists if defined?(@soffice_exists)
+
+      @soffice_exists = system(scrubbed_env, soffice_path, "--version", out: File::NULL, err: File::NULL, unsetenv_others: true)
     end
 
     def soffice_path
       ActiveStorage.paths[:soffice] || "soffice"
     end
+
+    # The minimal environment handed to LibreOffice, drawn from the parent process.
+    def scrubbed_env
+      ENV.slice(*PRESERVED_ENV_KEYS)
+    end
   end
 
   def preview(**options)
@@ -40,9 +80,35 @@ class ActiveStorage::Previewer::OfficePreviewer < ActiveStorage::Previewer
 
   private
     def draw_poster_image_from(file, &block)
-      system soffice_path, "--headless", "--invisible", "--convert-to", "png",
-        "--outdir", tmpdir, file.path, out: File::NULL, err: File::NULL
-      consume "#{tmpdir}/#{File.basename(file.path, ".*")}.png", &block
+      Dir.mktmpdir("ActiveStorage-office-profile-") do |profile|
+        seed_libreoffice_profile profile
+
+        system self.class.scrubbed_env, soffice_path,
+          "-env:UserInstallation=#{profile_url(profile)}",
+          "--headless", "--invisible", "--convert-to", "png",
+          "--outdir", tmpdir, file.path,
+          out: File::NULL, err: File::NULL, unsetenv_others: true
+
+        consume "#{tmpdir}/#{File.basename(file.path, ".*")}.png", &block
+      end
+    end
+
+    # Populate a disposable LibreOffice user profile whose registry disables active
+    # content. A fresh profile per conversion keeps the setting in force and avoids
+    # sharing mutable state between concurrent conversions.
+    def seed_libreoffice_profile(profile)
+      user = File.join(profile, "user")
+      Dir.mkdir(user)
+      File.write File.join(user, "registrymodifications.xcu"), REGISTRY_MODIFICATIONS
+    end
+
+    # -env:UserInstallation takes a URL, not a path. Dir.tmpdir honours TMPDIR, which
+    # can hold a space or a "#" — on macOS it is under /var/folders by default — and
+    # appending such a path raw yields a URL LibreOffice resolves somewhere else. It
+    # would then run against an unseeded profile and quietly drop the settings above,
+    # so percent-encode everything outside the unreserved set.
+    def profile_url(profile)
+      "file://#{URI::DEFAULT_PARSER.escape(profile, /[^A-Za-z0-9\-_.~\/]/)}"
     end
 
     def consume(path, &block)

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: activestorage-office-previewer
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.2.0
 platform: ruby
 authors:
 - George Claghorn
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-01-21 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activestorage
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.0.0
+        version: 7.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.0.0
+        version: 7.2.0
 - !ruby/object:Gem::Dependency
   name: appraisal
   requirement: !ruby/object:Gem::Requirement
@@ -44,58 +43,44 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.0
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 13.0.0
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.13.0
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 5.13.0
+        version: '6.0'
 - !ruby/object:Gem::Dependency
-  name: mini_magick
+  name: ruby-vips
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 4.9.5
+        version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 4.9.5
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.4.1
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.4.1
-- !ruby/object:Gem::Dependency
-  name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
@@ -114,123 +99,27 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.0.0
+        version: 7.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 6.0.0
-description: 
+        version: 7.2.0
 email: george@basecamp.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/ci.yml"
-- ".gitignore"
-- Appraisals
-- Gemfile
-- Gemfile.lock
 - LICENSE.md
 - README.md
-- Rakefile
-- activestorage-office-previewer.gemspec
-- gemfiles/rails_6.0.gemfile
-- gemfiles/rails_master.gemfile
 - lib/active_storage/previewer/office_previewer.rb
 - lib/activestorage-office-previewer.rb
-- test/database/setup.rb
-- test/dummy/.browserslistrc
-- test/dummy/.gitignore
-- test/dummy/.ruby-version
-- test/dummy/README.md
-- test/dummy/Rakefile
-- test/dummy/app/assets/config/manifest.js
-- test/dummy/app/assets/images/.keep
-- test/dummy/app/assets/stylesheets/application.css
-- test/dummy/app/channels/application_cable/channel.rb
-- test/dummy/app/channels/application_cable/connection.rb
-- test/dummy/app/controllers/application_controller.rb
-- test/dummy/app/controllers/concerns/.keep
-- test/dummy/app/helpers/application_helper.rb
-- test/dummy/app/javascript/channels/consumer.js
-- test/dummy/app/javascript/channels/index.js
-- test/dummy/app/javascript/packs/application.js
-- test/dummy/app/jobs/application_job.rb
-- test/dummy/app/mailers/application_mailer.rb
-- test/dummy/app/models/application_record.rb
-- test/dummy/app/models/concerns/.keep
-- test/dummy/app/views/layouts/application.html.erb
-- test/dummy/app/views/layouts/mailer.html.erb
-- test/dummy/app/views/layouts/mailer.text.erb
-- test/dummy/babel.config.js
-- test/dummy/config.ru
-- test/dummy/config/application.rb
-- test/dummy/config/cable.yml
-- test/dummy/config/credentials.yml.enc
-- test/dummy/config/database.yml
-- test/dummy/config/environment.rb
-- test/dummy/config/environments/development.rb
-- test/dummy/config/environments/production.rb
-- test/dummy/config/environments/test.rb
-- test/dummy/config/initializers/application_controller_renderer.rb
-- test/dummy/config/initializers/assets.rb
-- test/dummy/config/initializers/backtrace_silencers.rb
-- test/dummy/config/initializers/content_security_policy.rb
-- test/dummy/config/initializers/cookies_serializer.rb
-- test/dummy/config/initializers/filter_parameter_logging.rb
-- test/dummy/config/initializers/inflections.rb
-- test/dummy/config/initializers/mime_types.rb
-- test/dummy/config/initializers/wrap_parameters.rb
-- test/dummy/config/locales/en.yml
-- test/dummy/config/puma.rb
-- test/dummy/config/routes.rb
-- test/dummy/config/spring.rb
-- test/dummy/config/storage.yml
-- test/dummy/config/webpack/development.js
-- test/dummy/config/webpack/environment.js
-- test/dummy/config/webpack/production.js
-- test/dummy/config/webpack/test.js
-- test/dummy/config/webpacker.yml
-- test/dummy/db/migrate/20191204133417_create_active_storage_tables.active_storage.rb
-- test/dummy/db/seeds.rb
-- test/dummy/lib/assets/.keep
-- test/dummy/lib/tasks/.keep
-- test/dummy/log/.keep
-- test/dummy/postcss.config.js
-- test/dummy/public/404.html
-- test/dummy/public/422.html
-- test/dummy/public/500.html
-- test/dummy/public/apple-touch-icon-precomposed.png
-- test/dummy/public/apple-touch-icon.png
-- test/dummy/public/favicon.ico
-- test/dummy/public/robots.txt
-- test/dummy/storage/.keep
-- test/dummy/test/application_system_test_case.rb
-- test/dummy/test/channels/application_cable/connection_test.rb
-- test/dummy/test/controllers/.keep
-- test/dummy/test/fixtures/.keep
-- test/dummy/test/fixtures/files/.keep
-- test/dummy/test/helpers/.keep
-- test/dummy/test/integration/.keep
-- test/dummy/test/mailers/.keep
-- test/dummy/test/models/.keep
-- test/dummy/test/system/.keep
-- test/dummy/test/test_helper.rb
-- test/dummy/tmp/.keep
-- test/dummy/vendor/.keep
-- test/fixtures/files/hello.docx
-- test/fixtures/files/hello.pptx
-- test/fixtures/files/hello.xlsx
-- test/office_previewer_test.rb
-- test/test_helper.rb
 homepage: https://github.com/basecamp/activestorage-office-previewer
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -238,100 +127,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.2.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Active Storage previewer for Microsoft Office files based on LibreOffice
-test_files:
-- test/database/setup.rb
-- test/dummy/.browserslistrc
-- test/dummy/.gitignore
-- test/dummy/.ruby-version
-- test/dummy/README.md
-- test/dummy/Rakefile
-- test/dummy/app/assets/config/manifest.js
-- test/dummy/app/assets/images/.keep
-- test/dummy/app/assets/stylesheets/application.css
-- test/dummy/app/channels/application_cable/channel.rb
-- test/dummy/app/channels/application_cable/connection.rb
-- test/dummy/app/controllers/application_controller.rb
-- test/dummy/app/controllers/concerns/.keep
-- test/dummy/app/helpers/application_helper.rb
-- test/dummy/app/javascript/channels/consumer.js
-- test/dummy/app/javascript/channels/index.js
-- test/dummy/app/javascript/packs/application.js
-- test/dummy/app/jobs/application_job.rb
-- test/dummy/app/mailers/application_mailer.rb
-- test/dummy/app/models/application_record.rb
-- test/dummy/app/models/concerns/.keep
-- test/dummy/app/views/layouts/application.html.erb
-- test/dummy/app/views/layouts/mailer.html.erb
-- test/dummy/app/views/layouts/mailer.text.erb
-- test/dummy/babel.config.js
-- test/dummy/config.ru
-- test/dummy/config/application.rb
-- test/dummy/config/cable.yml
-- test/dummy/config/credentials.yml.enc
-- test/dummy/config/database.yml
-- test/dummy/config/environment.rb
-- test/dummy/config/environments/development.rb
-- test/dummy/config/environments/production.rb
-- test/dummy/config/environments/test.rb
-- test/dummy/config/initializers/application_controller_renderer.rb
-- test/dummy/config/initializers/assets.rb
-- test/dummy/config/initializers/backtrace_silencers.rb
-- test/dummy/config/initializers/content_security_policy.rb
-- test/dummy/config/initializers/cookies_serializer.rb
-- test/dummy/config/initializers/filter_parameter_logging.rb
-- test/dummy/config/initializers/inflections.rb
-- test/dummy/config/initializers/mime_types.rb
-- test/dummy/config/initializers/wrap_parameters.rb
-- test/dummy/config/locales/en.yml
-- test/dummy/config/puma.rb
-- test/dummy/config/routes.rb
-- test/dummy/config/spring.rb
-- test/dummy/config/storage.yml
-- test/dummy/config/webpack/development.js
-- test/dummy/config/webpack/environment.js
-- test/dummy/config/webpack/production.js
-- test/dummy/config/webpack/test.js
-- test/dummy/config/webpacker.yml
-- test/dummy/db/migrate/20191204133417_create_active_storage_tables.active_storage.rb
-- test/dummy/db/seeds.rb
-- test/dummy/lib/assets/.keep
-- test/dummy/lib/tasks/.keep
-- test/dummy/log/.keep
-- test/dummy/postcss.config.js
-- test/dummy/public/404.html
-- test/dummy/public/422.html
-- test/dummy/public/500.html
-- test/dummy/public/apple-touch-icon-precomposed.png
-- test/dummy/public/apple-touch-icon.png
-- test/dummy/public/favicon.ico
-- test/dummy/public/robots.txt
-- test/dummy/storage/.keep
-- test/dummy/test/application_system_test_case.rb
-- test/dummy/test/channels/application_cable/connection_test.rb
-- test/dummy/test/controllers/.keep
-- test/dummy/test/fixtures/.keep
-- test/dummy/test/fixtures/files/.keep
-- test/dummy/test/helpers/.keep
-- test/dummy/test/integration/.keep
-- test/dummy/test/mailers/.keep
-- test/dummy/test/models/.keep
-- test/dummy/test/system/.keep
-- test/dummy/test/test_helper.rb
-- test/dummy/tmp/.keep
-- test/dummy/vendor/.keep
-- test/fixtures/files/hello.docx
-- test/fixtures/files/hello.pptx
-- test/fixtures/files/hello.xlsx
-- test/office_previewer_test.rb
-- test/test_helper.rb
+test_files: []

data/.github/workflows/ci.yml

@@ -1,33 +0,0 @@
-name: CI
-on: [push, pull_request]
-jobs:
-  tests:
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        gemfile:
-          - gemfiles/rails_6.0.gemfile
-          - gemfiles/rails_master.gemfile
-
-    env:
-      BUNDLE_GEMFILE: ${{ matrix.gemfile }}
-
-    steps:
-      - uses: actions/checkout@v1
-
-      - name: Set up Ruby 2.6
-        uses: actions/setup-ruby@v1
-        with:
-          ruby-version: 2.6.x
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install libreoffice libsqlite3-dev
-
-          gem install bundler
-          bundle install --jobs 4 --retry 3
-
-      - name: Run tests
-        run: bundle exec rake test

data/.gitignore

@@ -1,5 +0,0 @@
-*.gem
-.byebug_history
-
-gemfiles/*.lock
-gemfiles/.bundle

data/Appraisals

@@ -1,8 +0,0 @@
-appraise "rails_6.0" do
-  gem "rails", "~> 6.0.0"
-end
-
-appraise "rails_master" do
-  git_source(:github) { |repo| "https://github.com/#{repo}.git" }
-  gem "rails", github: "rails/rails"
-end

data/Gemfile

@@ -1,3 +0,0 @@
-source "https://rubygems.org"
-
-gemspec

data/Gemfile.lock

@@ -1,155 +0,0 @@
-PATH
-  remote: .
-  specs:
-    activestorage-office-previewer (0.1.2)
-      activestorage (>= 6.0.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    actioncable (6.0.1)
-      actionpack (= 6.0.1)
-      nio4r (~> 2.0)
-      websocket-driver (>= 0.6.1)
-    actionmailbox (6.0.1)
-      actionpack (= 6.0.1)
-      activejob (= 6.0.1)
-      activerecord (= 6.0.1)
-      activestorage (= 6.0.1)
-      activesupport (= 6.0.1)
-      mail (>= 2.7.1)
-    actionmailer (6.0.1)
-      actionpack (= 6.0.1)
-      actionview (= 6.0.1)
-      activejob (= 6.0.1)
-      mail (~> 2.5, >= 2.5.4)
-      rails-dom-testing (~> 2.0)
-    actionpack (6.0.1)
-      actionview (= 6.0.1)
-      activesupport (= 6.0.1)
-      rack (~> 2.0)
-      rack-test (>= 0.6.3)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.0.1)
-      actionpack (= 6.0.1)
-      activerecord (= 6.0.1)
-      activestorage (= 6.0.1)
-      activesupport (= 6.0.1)
-      nokogiri (>= 1.8.5)
-    actionview (6.0.1)
-      activesupport (= 6.0.1)
-      builder (~> 3.1)
-      erubi (~> 1.4)
-      rails-dom-testing (~> 2.0)
-      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.0.1)
-      activesupport (= 6.0.1)
-      globalid (>= 0.3.6)
-    activemodel (6.0.1)
-      activesupport (= 6.0.1)
-    activerecord (6.0.1)
-      activemodel (= 6.0.1)
-      activesupport (= 6.0.1)
-    activestorage (6.0.1)
-      actionpack (= 6.0.1)
-      activejob (= 6.0.1)
-      activerecord (= 6.0.1)
-      marcel (~> 0.3.1)
-    activesupport (6.0.1)
-      concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2)
-    appraisal (2.2.0)
-      bundler
-      rake
-      thor (>= 0.14.0)
-    builder (3.2.3)
-    byebug (11.0.1)
-    concurrent-ruby (1.1.5)
-    crass (1.0.5)
-    erubi (1.9.0)
-    globalid (0.4.2)
-      activesupport (>= 4.2.0)
-    i18n (1.7.0)
-      concurrent-ruby (~> 1.0)
-    loofah (2.4.0)
-      crass (~> 1.0.2)
-      nokogiri (>= 1.5.9)
-    mail (2.7.1)
-      mini_mime (>= 0.1.1)
-    marcel (0.3.3)
-      mimemagic (~> 0.3.2)
-    method_source (0.9.2)
-    mimemagic (0.3.3)
-    mini_magick (4.9.5)
-    mini_mime (1.0.2)
-    mini_portile2 (2.4.0)
-    minitest (5.13.0)
-    nio4r (2.5.2)
-    nokogiri (1.10.6)
-      mini_portile2 (~> 2.4.0)
-    rack (2.0.7)
-    rack-test (1.1.0)
-      rack (>= 1.0, < 3)
-    rails (6.0.1)
-      actioncable (= 6.0.1)
-      actionmailbox (= 6.0.1)
-      actionmailer (= 6.0.1)
-      actionpack (= 6.0.1)
-      actiontext (= 6.0.1)
-      actionview (= 6.0.1)
-      activejob (= 6.0.1)
-      activemodel (= 6.0.1)
-      activerecord (= 6.0.1)
-      activestorage (= 6.0.1)
-      activesupport (= 6.0.1)
-      bundler (>= 1.3.0)
-      railties (= 6.0.1)
-      sprockets-rails (>= 2.0.0)
-    rails-dom-testing (2.0.3)
-      activesupport (>= 4.2.0)
-      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.3.0)
-      loofah (~> 2.3)
-    railties (6.0.1)
-      actionpack (= 6.0.1)
-      activesupport (= 6.0.1)
-      method_source
-      rake (>= 0.8.7)
-      thor (>= 0.20.3, < 2.0)
-    rake (13.0.1)
-    sprockets (4.0.0)
-      concurrent-ruby (~> 1.0)
-      rack (> 1, < 3)
-    sprockets-rails (3.2.1)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
-      sprockets (>= 3.0.0)
-    sqlite3 (1.4.1)
-    thor (0.20.3)
-    thread_safe (0.3.6)
-    tzinfo (1.2.5)
-      thread_safe (~> 0.1)
-    websocket-driver (0.7.1)
-      websocket-extensions (>= 0.1.0)
-    websocket-extensions (0.1.4)
-    zeitwerk (2.2.2)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  activestorage-office-previewer!
-  appraisal (~> 2.2)
-  byebug
-  mini_magick (~> 4.9.5)
-  minitest (~> 5.13.0)
-  rails (>= 6.0.0)
-  rake (~> 13.0.0)
-  sqlite3 (~> 1.4.1)
-
-BUNDLED WITH
-   1.17.2