activestorage 5.2.1 → 5.2.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e3cb1f60951d79219c1e3b4424ffd1c4b50678c70a24dca0c1a4a015ea468802
-  data.tar.gz: 830ffc76e9876db10f3e7dcba276b20c41c5d83ed8afbd210334811cf71ddbf8
+  metadata.gz: 91213c28f24de81bd5f9fb70fc824cebab2a78b4a9a7e7181dab0073241e10df
+  data.tar.gz: be7321827bdee9da52fb288c8625c1d06c13efcea0e7e38115294cc7c87f1629
 SHA512:
-  metadata.gz: e94e32e5bf798b0d4313ae66d7cbb60c381997d76980e387e671c6977ee2738f31b6cfc8f37f9ccf1e1f455d7b6261455359811ed1877d5a49214d22f1dca1cb
-  data.tar.gz: cef3b437d62a555be6bbc2681c81429099661108042dcc1030a3af51a9590165487c78fadffdec0481f7b2559b68dc53f4a2a034b13e8868cd4efe34d0fcc9c5
+  metadata.gz: 020ebe643211ff9093027c6ec35a0626e565779a0f0d9a27723cb452b1c66cf9c1b10df89aec84cf068ef1d24ddb90ef8b844054eaaa497bc41b59e42a0f0514
+  data.tar.gz: 9c3e51fbe837f60c86eb993d9ba1d85b66362a298fb432629f1dca0b79bdbd500c86fb6640d99d023636d4f8094867367b7cb2bd5d2b6616fe93fa9a8dea6a13

data/CHANGELOG.md

@@ -1,3 +1,12 @@
+## Rails 5.2.1.1 (November 27, 2018) ##
+
+*   Prevent content type and disposition bypass in storage service URLs.
+
+    Fix CVE-2018-16477.
+
+    *Rosa Gutierrez*
+
+
 ## Rails 5.2.1 (August 07, 2018) ##
 
 *   Fix direct upload with zero-byte files.

data/app/controllers/active_storage/disk_controller.rb

@@ -11,10 +11,10 @@ class ActiveStorage::DiskController < ActiveStorage::BaseController
 
   def show
     if key = decode_verified_key
-      response.headers["Content-Type"] = params[:content_type] || DEFAULT_SEND_FILE_TYPE
-      response.headers["Content-Disposition"] = params[:disposition] || DEFAULT_SEND_FILE_DISPOSITION
+      response.headers["Content-Type"] = key[:content_type] || DEFAULT_SEND_FILE_TYPE
+      response.headers["Content-Disposition"] = key[:disposition] || DEFAULT_SEND_FILE_DISPOSITION
 
-      disk_service.download key do |chunk|
+      disk_service.download key[:key] do |chunk|
         response.stream.write chunk
       end
     else

data/app/models/active_storage/blob.rb

@@ -120,8 +120,8 @@ class ActiveStorage::Blob < ActiveRecord::Base
   def service_url(expires_in: service.url_expires_in, disposition: :inline, filename: nil, **options)
     filename = ActiveStorage::Filename.wrap(filename || self.filename)
 
-    service.url key, expires_in: expires_in, filename: filename, content_type: content_type,
-      disposition: forcibly_serve_as_binary? ? :attachment : disposition, **options
+    service.url key, expires_in: expires_in, filename: filename, content_type: content_type_for_service_url,
+      disposition: forced_disposition_for_service_url || disposition, **options
   end
 
   # Returns a URL that can be used to directly upload a file for this blob on the service. This URL is intended to be
@@ -152,7 +152,7 @@ class ActiveStorage::Blob < ActiveRecord::Base
     self.byte_size    = io.size
     self.identified   = true
 
-    service.upload(key, io, checksum: checksum)
+    service.upload key, io, checksum: checksum, **service_metadata
   end
 
   # Downloads the file associated with this blob. If no block is given, the entire file is read into memory and returned.
@@ -203,5 +203,29 @@ class ActiveStorage::Blob < ActiveRecord::Base
       ActiveStorage.content_types_to_serve_as_binary.include?(content_type)
     end
 
+    def allowed_inline?
+      ActiveStorage.content_types_allowed_inline.include?(content_type)
+    end
+
+    def content_type_for_service_url
+      forcibly_serve_as_binary? ? ActiveStorage.binary_content_type : content_type
+    end
+
+    def forced_disposition_for_service_url
+      if forcibly_serve_as_binary? || !allowed_inline?
+        :attachment
+      end
+    end
+
+    def service_metadata
+      if forcibly_serve_as_binary?
+        { content_type: ActiveStorage.binary_content_type, disposition: :attachment, filename: filename }
+      elsif !allowed_inline?
+        { content_type: content_type, disposition: :attachment, filename: filename }
+      else
+        { content_type: content_type }
+      end
+    end
+
     ActiveSupport.run_load_hooks(:active_storage_blob, self)
 end

data/app/models/active_storage/blob/identifiable.rb

@@ -2,7 +2,10 @@
 
 module ActiveStorage::Blob::Identifiable
   def identify
-    update! content_type: identify_content_type, identified: true unless identified?
+    unless identified?
+      update! content_type: identify_content_type, identified: true
+      update_service_metadata
+    end
   end
 
   def identified?
@@ -17,4 +20,8 @@ module ActiveStorage::Blob::Identifiable
     def download_identifiable_chunk
       service.download_chunk key, 0...4.kilobytes
     end
+
+    def update_service_metadata
+      service.update_metadata key, service_metadata if service_metadata.any?
+    end
 end

data/lib/active_storage.rb

@@ -48,4 +48,6 @@ module ActiveStorage
   mattr_accessor :paths, default: {}
   mattr_accessor :variable_content_types, default: []
   mattr_accessor :content_types_to_serve_as_binary, default: []
+  mattr_accessor :content_types_allowed_inline, default: []
+  mattr_accessor :binary_content_type, default: "application/octet-stream"
 end

data/lib/active_storage/engine.rb

@@ -37,6 +37,18 @@ module ActiveStorage
       text/xml
       application/xml
       application/xhtml+xml
+      application/mathml+xml
+      text/cache-manifest
+    )
+
+    config.active_storage.content_types_allowed_inline = %w(
+      image/png
+      image/gif
+      image/jpg
+      image/jpeg
+      image/vnd.adobe.photoshop
+      image/vnd.microsoft.icon
+      application/pdf
     )
 
     config.eager_load_namespaces << ActiveStorage
@@ -51,6 +63,8 @@ module ActiveStorage
 
         ActiveStorage.variable_content_types = app.config.active_storage.variable_content_types || []
         ActiveStorage.content_types_to_serve_as_binary = app.config.active_storage.content_types_to_serve_as_binary || []
+        ActiveStorage.content_types_allowed_inline = app.config.active_storage.content_types_allowed_inline || []
+        ActiveStorage.binary_content_type = app.config.active_storage.binary_content_type || "application/octet-stream"
       end
     end
 

data/lib/active_storage/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveStorage
     MAJOR = 5
     MINOR = 2
     TINY  = 1
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_storage/service.rb

@@ -64,10 +64,16 @@ module ActiveStorage
 
     # Upload the +io+ to the +key+ specified. If a +checksum+ is provided, the service will
     # ensure a match when the upload has completed or raise an ActiveStorage::IntegrityError.
-    def upload(key, io, checksum: nil)
+    def upload(key, io, checksum: nil, **options)
       raise NotImplementedError
     end
 
+    # Update metadata for the file identified by +key+ in the service.
+    # Override in subclasses only if the service needs to store specific
+    # metadata that has to be updated upon identification.
+    def update_metadata(key, **metadata)
+    end
+
     # Return the content of the file at the +key+.
     def download(key)
       raise NotImplementedError

data/lib/active_storage/service/azure_storage_service.rb

@@ -17,7 +17,7 @@ module ActiveStorage
       @container = container
     end
 
-    def upload(key, io, checksum: nil)
+    def upload(key, io, checksum: nil, **)
       instrument :upload, key: key, checksum: checksum do
         begin
           blobs.create_block_blob(container, key, IO.try_convert(io) || io, content_md5: checksum)

data/lib/active_storage/service/disk_service.rb

@@ -15,7 +15,7 @@ module ActiveStorage
       @root = root
     end
 
-    def upload(key, io, checksum: nil)
+    def upload(key, io, checksum: nil, **)
       instrument :upload, key: key, checksum: checksum do
         IO.copy_stream(io, make_path_for(key))
         ensure_integrity_of(key, checksum) if checksum
@@ -75,17 +75,23 @@ module ActiveStorage
 
     def url(key, expires_in:, filename:, disposition:, content_type:)
       instrument :url, key: key do |payload|
-        verified_key_with_expiration = ActiveStorage.verifier.generate(key, expires_in: expires_in, purpose: :blob_key)
-
-        generated_url =
-          url_helpers.rails_disk_service_url(
-            verified_key_with_expiration,
-            host: current_host,
-            filename: filename,
-            disposition: content_disposition_with(type: disposition, filename: filename),
+        content_disposition = content_disposition_with(type: disposition, filename: filename)
+        verified_key_with_expiration = ActiveStorage.verifier.generate(
+          {
+            key: key,
+            disposition: content_disposition,
             content_type: content_type
-          )
+          },
+          { expires_in: expires_in,
+          purpose: :blob_key }
+        )
 
+        generated_url = url_helpers.rails_disk_service_url(verified_key_with_expiration,
+          host: current_host,
+          disposition: content_disposition,
+          content_type: content_type,
+          filename: filename
+        )
         payload[:url] = generated_url
 
         generated_url

data/lib/active_storage/service/gcs_service.rb

@@ -15,22 +15,30 @@ module ActiveStorage
       @config = config
     end
 
-    def upload(key, io, checksum: nil)
+    def upload(key, io, checksum: nil, content_type: nil, disposition: nil, filename: nil)
       instrument :upload, key: key, checksum: checksum do
         begin
-          # The official GCS client library doesn't allow us to create a file with no Content-Type metadata.
-          # We need the file we create to have no Content-Type so we can control it via the response-content-type
-          # param in signed URLs. Workaround: let the GCS client create the file with an inferred
-          # Content-Type (usually "application/octet-stream") then clear it.
-          bucket.create_file(io, key, md5: checksum).update do |file|
-            file.content_type = nil
-          end
+          # GCS's signed URLs don't include params such as response-content-type response-content_disposition
+          # in the signature, which means an attacker can modify them and bypass our effort to force these to
+          # binary and attachment when the file's content type requires it. The only way to force them is to
+          # store them as object's metadata.
+          content_disposition = content_disposition_with(type: disposition, filename: filename) if disposition && filename
+          bucket.create_file(io, key, md5: checksum, content_type: content_type, content_disposition: content_disposition)
         rescue Google::Cloud::InvalidArgumentError
           raise ActiveStorage::IntegrityError
         end
       end
     end
 
+    def update_metadata(key, content_type:, disposition: nil, filename: nil)
+      instrument :update_metadata, key: key, content_type: content_type, disposition: disposition do
+        file_for(key).update do |file|
+          file.content_type = content_type
+          file.content_disposition = content_disposition_with(type: disposition, filename: filename) if disposition && filename
+        end
+      end
+    end
+
     # FIXME: Download in chunks when given a block.
     def download(key)
       instrument :download, key: key do

data/lib/active_storage/service/mirror_service.rb

@@ -24,9 +24,9 @@ module ActiveStorage
 
     # Upload the +io+ to the +key+ specified to all services. If a +checksum+ is provided, all services will
     # ensure a match when the upload has completed or raise an ActiveStorage::IntegrityError.
-    def upload(key, io, checksum: nil)
+    def upload(key, io, checksum: nil, **options)
       each_service.collect do |service|
-        service.upload key, io.tap(&:rewind), checksum: checksum
+        service.upload key, io.tap(&:rewind), checksum: checksum, **options
       end
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activestorage
 version: !ruby/object:Gem::Version
-  version: 5.2.1
+  version: 5.2.1.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-08-07 00:00:00.000000000 Z
+date: 2018-11-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.1
+        version: 5.2.1.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.1
+        version: 5.2.1.1
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.1
+        version: 5.2.1.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 5.2.1
+        version: 5.2.1.1
 - !ruby/object:Gem::Dependency
   name: marcel
   requirement: !ruby/object:Gem::Requirement
@@ -124,8 +124,8 @@ homepage: http://rubyonrails.org
 licenses:
 - MIT
 metadata:
-  source_code_uri: https://github.com/rails/rails/tree/v5.2.1/activestorage
-  changelog_uri: https://github.com/rails/rails/blob/v5.2.1/activestorage/CHANGELOG.md
+  source_code_uri: https://github.com/rails/rails/tree/v5.2.1.1/activestorage
+  changelog_uri: https://github.com/rails/rails/blob/v5.2.1.1/activestorage/CHANGELOG.md
 post_install_message: 
 rdoc_options: []
 require_paths: