activestorage 6.0.4.6 → 6.0.4.7

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of activestorage might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: fd478b94709d7df9dbb70008f89cb1b5bf7e6984e025f3cadea8e1f7c27d0383
4
- data.tar.gz: 4ccf47891c900e624d8d93935460ad0951198cf5a096177fab0ffa46f4b89179
3
+ metadata.gz: b8abd4646a5f7b15789f20d256008fcd705b0ebefa2c253bd303badc8f80c947
4
+ data.tar.gz: 2cb4987c87f06cab5c713476aa1f47857402ded737c4b7bd27ebecf26517578e
5
5
  SHA512:
6
- metadata.gz: bbca4133f93dbc6a64151d30f4023f8da2e1e8fa6fb37c43e6e312ff090cd5c498e54f5abf0858ccab79d4a68b7631f4d98157dcc7a65bbda4d04ac9ec605840
7
- data.tar.gz: 49b603b52623d68bc21295a65337aad7025a822c02e1d90ef8e7eb7977aa03cab78b2100bebf77f15ab229483e6bd0d830a1d0d46cc7343a5f5dfdea2e9c4378
6
+ metadata.gz: 66125107a143936b03c67031ec099610a38d3c4fe1866bee350c3731df963d436873d898c81383953ca68a72eb6ca0954de5028e76dec4b9fc0fc84727b35bea
7
+ data.tar.gz: 14d18de480bc99e5f080eaab1f1f5aaf9c05b237cf12977cb2038fe031f24ebc0542df509243d3cf664204a26ec8099909468130f9d865c080bb78e069348523
data/CHANGELOG.md CHANGED
@@ -1,3 +1,13 @@
1
+ ## Rails 6.0.4.7 (March 08, 2022) ##
2
+
3
+ * Added image transformation validation via configurable allow-list.
4
+
5
+ Variant now offers a configurable allow-list for
6
+ transformation methods in addition to a configurable deny-list for arguments.
7
+
8
+ [CVE-2022-21831]
9
+
10
+
1
11
  ## Rails 6.0.4.6 (February 11, 2022) ##
2
12
 
3
13
  * No changes.
@@ -63,6 +63,20 @@ module ActiveStorage
63
63
  application/pdf
64
64
  )
65
65
 
66
+ default_unsupported_image_processing_arguments = %w(
67
+ -debug
68
+ -display
69
+ -distribute-cache
70
+ -help
71
+ -path
72
+ -print
73
+ -set
74
+ -verbose
75
+ -version
76
+ -write
77
+ -write-mask
78
+ )
79
+
66
80
  config.eager_load_namespaces << ActiveStorage
67
81
 
68
82
  initializer "active_storage.configs" do
@@ -74,6 +88,8 @@ module ActiveStorage
74
88
  ActiveStorage.paths = app.config.active_storage.paths || {}
75
89
  ActiveStorage.routes_prefix = app.config.active_storage.routes_prefix || "/rails/active_storage"
76
90
 
91
+ ActiveStorage.supported_image_processing_methods = app.config.active_storage.supported_image_processing_methods || []
92
+ ActiveStorage.unsupported_image_processing_arguments = app.config.active_storage.unsupported_image_processing_arguments || default_unsupported_image_processing_arguments
77
93
  ActiveStorage.variable_content_types = app.config.active_storage.variable_content_types || []
78
94
  ActiveStorage.content_types_to_serve_as_binary = app.config.active_storage.content_types_to_serve_as_binary || []
79
95
  ActiveStorage.service_urls_expire_in = app.config.active_storage.service_urls_expire_in || 5.minutes
@@ -10,7 +10,7 @@ module ActiveStorage
10
10
  MAJOR = 6
11
11
  MINOR = 0
12
12
  TINY = 4
13
- PRE = "6"
13
+ PRE = "7"
14
14
 
15
15
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
16
16
  end
@@ -6,6 +6,300 @@ module ActiveStorage
6
6
  module Transformers
7
7
  class ImageProcessingTransformer < Transformer
8
8
  private
9
+ class UnsupportedImageProcessingMethod < StandardError; end
10
+ class UnsupportedImageProcessingArgument < StandardError; end
11
+ SUPPORTED_IMAGE_PROCESSING_METHODS = [
12
+ "adaptive_blur",
13
+ "adaptive_resize",
14
+ "adaptive_sharpen",
15
+ "adjoin",
16
+ "affine",
17
+ "alpha",
18
+ "annotate",
19
+ "antialias",
20
+ "append",
21
+ "apply",
22
+ "attenuate",
23
+ "authenticate",
24
+ "auto_gamma",
25
+ "auto_level",
26
+ "auto_orient",
27
+ "auto_threshold",
28
+ "backdrop",
29
+ "background",
30
+ "bench",
31
+ "bias",
32
+ "bilateral_blur",
33
+ "black_point_compensation",
34
+ "black_threshold",
35
+ "blend",
36
+ "blue_primary",
37
+ "blue_shift",
38
+ "blur",
39
+ "border",
40
+ "bordercolor",
41
+ "borderwidth",
42
+ "brightness_contrast",
43
+ "cache",
44
+ "canny",
45
+ "caption",
46
+ "channel",
47
+ "channel_fx",
48
+ "charcoal",
49
+ "chop",
50
+ "clahe",
51
+ "clamp",
52
+ "clip",
53
+ "clip_path",
54
+ "clone",
55
+ "clut",
56
+ "coalesce",
57
+ "colorize",
58
+ "colormap",
59
+ "color_matrix",
60
+ "colors",
61
+ "colorspace",
62
+ "colourspace",
63
+ "color_threshold",
64
+ "combine",
65
+ "combine_options",
66
+ "comment",
67
+ "compare",
68
+ "complex",
69
+ "compose",
70
+ "composite",
71
+ "compress",
72
+ "connected_components",
73
+ "contrast",
74
+ "contrast_stretch",
75
+ "convert",
76
+ "convolve",
77
+ "copy",
78
+ "crop",
79
+ "cycle",
80
+ "deconstruct",
81
+ "define",
82
+ "delay",
83
+ "delete",
84
+ "density",
85
+ "depth",
86
+ "descend",
87
+ "deskew",
88
+ "despeckle",
89
+ "direction",
90
+ "displace",
91
+ "dispose",
92
+ "dissimilarity_threshold",
93
+ "dissolve",
94
+ "distort",
95
+ "dither",
96
+ "draw",
97
+ "duplicate",
98
+ "edge",
99
+ "emboss",
100
+ "encoding",
101
+ "endian",
102
+ "enhance",
103
+ "equalize",
104
+ "evaluate",
105
+ "evaluate_sequence",
106
+ "extent",
107
+ "extract",
108
+ "family",
109
+ "features",
110
+ "fft",
111
+ "fill",
112
+ "filter",
113
+ "flatten",
114
+ "flip",
115
+ "floodfill",
116
+ "flop",
117
+ "font",
118
+ "foreground",
119
+ "format",
120
+ "frame",
121
+ "function",
122
+ "fuzz",
123
+ "fx",
124
+ "gamma",
125
+ "gaussian_blur",
126
+ "geometry",
127
+ "gravity",
128
+ "grayscale",
129
+ "green_primary",
130
+ "hald_clut",
131
+ "highlight_color",
132
+ "hough_lines",
133
+ "iconGeometry",
134
+ "iconic",
135
+ "identify",
136
+ "ift",
137
+ "illuminant",
138
+ "immutable",
139
+ "implode",
140
+ "insert",
141
+ "intensity",
142
+ "intent",
143
+ "interlace",
144
+ "interline_spacing",
145
+ "interpolate",
146
+ "interpolative_resize",
147
+ "interword_spacing",
148
+ "kerning",
149
+ "kmeans",
150
+ "kuwahara",
151
+ "label",
152
+ "lat",
153
+ "layers",
154
+ "level",
155
+ "level_colors",
156
+ "limit",
157
+ "limits",
158
+ "linear_stretch",
159
+ "linewidth",
160
+ "liquid_rescale",
161
+ "list",
162
+ "loader",
163
+ "log",
164
+ "loop",
165
+ "lowlight_color",
166
+ "magnify",
167
+ "map",
168
+ "mattecolor",
169
+ "median",
170
+ "mean_shift",
171
+ "metric",
172
+ "mode",
173
+ "modulate",
174
+ "moments",
175
+ "monitor",
176
+ "monochrome",
177
+ "morph",
178
+ "morphology",
179
+ "mosaic",
180
+ "motion_blur",
181
+ "name",
182
+ "negate",
183
+ "noise",
184
+ "normalize",
185
+ "opaque",
186
+ "ordered_dither",
187
+ "orient",
188
+ "page",
189
+ "paint",
190
+ "pause",
191
+ "perceptible",
192
+ "ping",
193
+ "pointsize",
194
+ "polaroid",
195
+ "poly",
196
+ "posterize",
197
+ "precision",
198
+ "preview",
199
+ "process",
200
+ "quality",
201
+ "quantize",
202
+ "quiet",
203
+ "radial_blur",
204
+ "raise",
205
+ "random_threshold",
206
+ "range_threshold",
207
+ "red_primary",
208
+ "regard_warnings",
209
+ "region",
210
+ "remote",
211
+ "render",
212
+ "repage",
213
+ "resample",
214
+ "resize",
215
+ "resize_to_fill",
216
+ "resize_to_fit",
217
+ "resize_to_limit",
218
+ "resize_and_pad",
219
+ "respect_parentheses",
220
+ "reverse",
221
+ "roll",
222
+ "rotate",
223
+ "sample",
224
+ "sampling_factor",
225
+ "saver",
226
+ "scale",
227
+ "scene",
228
+ "screen",
229
+ "seed",
230
+ "segment",
231
+ "selective_blur",
232
+ "separate",
233
+ "sepia_tone",
234
+ "shade",
235
+ "shadow",
236
+ "shared_memory",
237
+ "sharpen",
238
+ "shave",
239
+ "shear",
240
+ "sigmoidal_contrast",
241
+ "silent",
242
+ "similarity_threshold",
243
+ "size",
244
+ "sketch",
245
+ "smush",
246
+ "snaps",
247
+ "solarize",
248
+ "sort_pixels",
249
+ "sparse_color",
250
+ "splice",
251
+ "spread",
252
+ "statistic",
253
+ "stegano",
254
+ "stereo",
255
+ "storage_type",
256
+ "stretch",
257
+ "strip",
258
+ "stroke",
259
+ "strokewidth",
260
+ "style",
261
+ "subimage_search",
262
+ "swap",
263
+ "swirl",
264
+ "synchronize",
265
+ "taint",
266
+ "text_font",
267
+ "threshold",
268
+ "thumbnail",
269
+ "tile_offset",
270
+ "tint",
271
+ "title",
272
+ "transform",
273
+ "transparent",
274
+ "transparent_color",
275
+ "transpose",
276
+ "transverse",
277
+ "treedepth",
278
+ "trim",
279
+ "type",
280
+ "undercolor",
281
+ "unique_colors",
282
+ "units",
283
+ "unsharp",
284
+ "update",
285
+ "valid_image",
286
+ "view",
287
+ "vignette",
288
+ "virtual_pixel",
289
+ "visual",
290
+ "watermark",
291
+ "wave",
292
+ "wavelet_denoise",
293
+ "weight",
294
+ "white_balance",
295
+ "white_point",
296
+ "white_threshold",
297
+ "window",
298
+ "window_group"
299
+ ].concat(ActiveStorage.supported_image_processing_methods)
300
+
301
+ UNSUPPORTED_IMAGE_PROCESSING_ARGUMENTS = ActiveStorage.unsupported_image_processing_arguments
302
+
9
303
  def process(file, format:)
10
304
  processor.
11
305
  source(file).
@@ -21,6 +315,16 @@ module ActiveStorage
21
315
 
22
316
  def operations
23
317
  transformations.each_with_object([]) do |(name, argument), list|
318
+ if ActiveStorage.variant_processor == :mini_magick
319
+ if name.to_s == "combine_options"
320
+ argument.each do |subtransformation_name, subtransformation_argument|
321
+ validate_transformation(subtransformation_name, subtransformation_argument)
322
+ end
323
+ else
324
+ validate_transformation(name, argument)
325
+ end
326
+ end
327
+
24
328
  if name.to_s == "combine_options"
25
329
  ActiveSupport::Deprecation.warn <<~WARNING.squish
26
330
  Active Storage's ImageProcessing transformer doesn't support :combine_options,
@@ -34,6 +338,60 @@ module ActiveStorage
34
338
  end
35
339
  end
36
340
  end
341
+
342
+ def validate_transformation(name, argument)
343
+ method_name = name.to_s.gsub("-","_")
344
+
345
+ unless SUPPORTED_IMAGE_PROCESSING_METHODS.any? { |method| method_name == method }
346
+ raise UnsupportedImageProcessingMethod, <<~ERROR.squish
347
+ One or more of the provided transformation methods is not supported.
348
+ ERROR
349
+ end
350
+
351
+ if argument.present?
352
+ if argument.is_a?(String) || argument.is_a?(Symbol)
353
+ validate_arg_string(argument)
354
+ elsif argument.is_a?(Array)
355
+ validate_arg_array(argument)
356
+ elsif argument.is_a?(Hash)
357
+ validate_arg_hash(argument)
358
+ end
359
+ end
360
+ end
361
+
362
+ def validate_arg_string(argument)
363
+ if UNSUPPORTED_IMAGE_PROCESSING_ARGUMENTS.any? { |bad_arg| argument.to_s.downcase.include?(bad_arg) }; raise UnsupportedImageProcessingArgument end
364
+ end
365
+
366
+ def validate_arg_array(argument)
367
+ argument.each do |arg|
368
+ if arg.is_a?(Integer) || arg.is_a?(Float)
369
+ next
370
+ elsif arg.is_a?(String) || arg.is_a?(Symbol)
371
+ validate_arg_string(arg)
372
+ elsif arg.is_a?(Array)
373
+ validate_arg_array(arg)
374
+ elsif arg.is_a?(Hash)
375
+ validate_arg_hash(arg)
376
+ end
377
+ end
378
+ end
379
+
380
+ def validate_arg_hash(argument)
381
+ argument.each do |key, value|
382
+ validate_arg_string(key)
383
+
384
+ if value.is_a?(Integer) || value.is_a?(Float)
385
+ next
386
+ elsif value.is_a?(String) || value.is_a?(Symbol)
387
+ validate_arg_string(value)
388
+ elsif value.is_a?(Array)
389
+ validate_arg_array(value)
390
+ elsif value.is_a?(Hash)
391
+ validate_arg_hash(value)
392
+ end
393
+ end
394
+ end
37
395
  end
38
396
  end
39
397
  end
@@ -52,10 +52,12 @@ module ActiveStorage
52
52
 
53
53
  mattr_accessor :paths, default: {}
54
54
 
55
- mattr_accessor :variable_content_types, default: []
56
- mattr_accessor :binary_content_type, default: "application/octet-stream"
57
- mattr_accessor :content_types_to_serve_as_binary, default: []
58
- mattr_accessor :content_types_allowed_inline, default: []
55
+ mattr_accessor :variable_content_types, default: []
56
+ mattr_accessor :binary_content_type, default: "application/octet-stream"
57
+ mattr_accessor :content_types_to_serve_as_binary, default: []
58
+ mattr_accessor :content_types_allowed_inline, default: []
59
+ mattr_accessor :supported_image_processing_methods, default: []
60
+ mattr_accessor :unsupported_image_processing_arguments
59
61
 
60
62
  mattr_accessor :service_urls_expire_in, default: 5.minutes
61
63
 
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: activestorage
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.0.4.6
4
+ version: 6.0.4.7
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2022-02-11 00:00:00.000000000 Z
11
+ date: 2022-03-08 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: actionpack
@@ -16,42 +16,42 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 6.0.4.6
19
+ version: 6.0.4.7
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 6.0.4.6
26
+ version: 6.0.4.7
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: activejob
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
31
  - - '='
32
32
  - !ruby/object:Gem::Version
33
- version: 6.0.4.6
33
+ version: 6.0.4.7
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - '='
39
39
  - !ruby/object:Gem::Version
40
- version: 6.0.4.6
40
+ version: 6.0.4.7
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: activerecord
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - '='
46
46
  - !ruby/object:Gem::Version
47
- version: 6.0.4.6
47
+ version: 6.0.4.7
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - '='
53
53
  - !ruby/object:Gem::Version
54
- version: 6.0.4.6
54
+ version: 6.0.4.7
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: marcel
57
57
  requirement: !ruby/object:Gem::Requirement
@@ -151,10 +151,10 @@ licenses:
151
151
  - MIT
152
152
  metadata:
153
153
  bug_tracker_uri: https://github.com/rails/rails/issues
154
- changelog_uri: https://github.com/rails/rails/blob/v6.0.4.6/activestorage/CHANGELOG.md
155
- documentation_uri: https://api.rubyonrails.org/v6.0.4.6/
154
+ changelog_uri: https://github.com/rails/rails/blob/v6.0.4.7/activestorage/CHANGELOG.md
155
+ documentation_uri: https://api.rubyonrails.org/v6.0.4.7/
156
156
  mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
157
- source_code_uri: https://github.com/rails/rails/tree/v6.0.4.6/activestorage
157
+ source_code_uri: https://github.com/rails/rails/tree/v6.0.4.7/activestorage
158
158
  post_install_message:
159
159
  rdoc_options: []
160
160
  require_paths:
@@ -170,7 +170,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
170
170
  - !ruby/object:Gem::Version
171
171
  version: '0'
172
172
  requirements: []
173
- rubygems_version: 3.2.22
173
+ rubygems_version: 3.1.6
174
174
  signing_key:
175
175
  specification_version: 4
176
176
  summary: Local and cloud file storage framework.