activestorage 6.1.4.6 → 6.1.6.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of activestorage might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 4f78821f730cf6d374a408a0b130b92437182d3026404916ca79618e7c8b2ffd
4
- data.tar.gz: 613fab9e9ce486a0897f55c0cf654e0edd98549cdc963813367289651f1bb03e
3
+ metadata.gz: 8fb7344362927b3834f94b8e5cd2420f3c5060066804ccdedace833169d98bf1
4
+ data.tar.gz: 0d3225047a9550eea6007f80b212ce28455795d55ecbfa0e902e480a048c7ceb
5
5
  SHA512:
6
- metadata.gz: bf9329ba6d4500c9f31b0390fabd11854354d3ad6b131280e148912487deb119168dfe35a4fb92db4ee55708c665065b76845f815c96b26557405eb0e13a71a3
7
- data.tar.gz: 88cbbc25f7b4d8cbeb5eb57805d79f4d7df2288391835a9abe3aace1680a265edb369bf284dfc99713be94e74998323474f87bb70cb89b7ba7a01273ced37b3d
6
+ metadata.gz: 43a65bfab6574ff8f1b8d324da2d305baa99a871971814033fb232c60deaa7e2ed8348da24419e6f73ad13271c0eafcbaefde0598a1ed5cbff5bc8da0fdf3991
7
+ data.tar.gz: 388a9c9628a15f9ac638a592cdbd527db9ab2d7bbb2e8d2492a8e987ea2744e3663e7dbaff18f80d780e199f5a8019d008e05843223cac8649fa9d8e33827cb2
data/CHANGELOG.md CHANGED
@@ -1,3 +1,32 @@
1
+ ## Rails 6.1.6.1 (July 12, 2022) ##
2
+
3
+ * No changes.
4
+
5
+
6
+ ## Rails 6.1.5.1 (April 26, 2022) ##
7
+
8
+ * No changes.
9
+
10
+
11
+ ## Rails 6.1.5 (March 09, 2022) ##
12
+
13
+ * Attachments can be deleted after their association is no longer defined.
14
+
15
+ Fixes #42514
16
+
17
+ *Don Sisco*
18
+
19
+
20
+ ## Rails 6.1.4.7 (March 08, 2022) ##
21
+
22
+ * Added image transformation validation via configurable allow-list.
23
+
24
+ Variant now offers a configurable allow-list for
25
+ transformation methods in addition to a configurable deny-list for arguments.
26
+
27
+ [CVE-2022-21831]
28
+
29
+
1
30
  ## Rails 6.1.4.6 (February 11, 2022) ##
2
31
 
3
32
  * No changes.
@@ -37,7 +66,7 @@
37
66
 
38
67
  * Fix Active Storage update task when running in an engine.
39
68
 
40
- Justin Malčić*
69
+ *Justin Malčić*
41
70
 
42
71
  * Don't raise an error if the mime type is not recognized.
43
72
 
data/MIT-LICENSE CHANGED
@@ -1,4 +1,4 @@
1
- Copyright (c) 2017-2020 David Heinemeier Hansson, Basecamp
1
+ Copyright (c) 2017-2022 David Heinemeier Hansson, Basecamp
2
2
 
3
3
  Permission is hereby granted, free of charge, to any person obtaining
4
4
  a copy of this software and associated documentation files (the
@@ -51,7 +51,7 @@ class ActiveStorage::Attachment < ActiveStorage::Record
51
51
  end
52
52
 
53
53
  def dependent
54
- record.attachment_reflections[name]&.options[:dependent]
54
+ record.attachment_reflections[name]&.options&.fetch(:dependent, nil)
55
55
  end
56
56
  end
57
57
 
@@ -4,7 +4,7 @@
4
4
  # These variants are used to create thumbnails, fixed-size avatars, or any other derivative image from the
5
5
  # original.
6
6
  #
7
- # Variants rely on {ImageProcessing}[https://github.com/janko-m/image_processing] gem for the actual transformations
7
+ # Variants rely on {ImageProcessing}[https://github.com/janko/image_processing] gem for the actual transformations
8
8
  # of the file, so you must add <tt>gem "image_processing"</tt> to your Gemfile if you wish to use variants. By
9
9
  # default, images will be processed with {ImageMagick}[http://imagemagick.org] using the
10
10
  # {MiniMagick}[https://github.com/minimagick/minimagick] gem, but you can also switch to the
@@ -46,9 +46,9 @@
46
46
  #
47
47
  # Visit the following links for a list of available ImageProcessing commands and ImageMagick/libvips operations:
48
48
  #
49
- # * {ImageProcessing::MiniMagick}[https://github.com/janko-m/image_processing/blob/master/doc/minimagick.md#methods]
49
+ # * {ImageProcessing::MiniMagick}[https://github.com/janko/image_processing/blob/master/doc/minimagick.md#methods]
50
50
  # * {ImageMagick reference}[https://www.imagemagick.org/script/mogrify.php]
51
- # * {ImageProcessing::Vips}[https://github.com/janko-m/image_processing/blob/master/doc/vips.md#methods]
51
+ # * {ImageProcessing::Vips}[https://github.com/janko/image_processing/blob/master/doc/vips.md#methods]
52
52
  # * {ruby-vips reference}[http://www.rubydoc.info/gems/ruby-vips/Vips/Image]
53
53
  class ActiveStorage::Variant
54
54
  attr_reader :blob, :variation
@@ -10,7 +10,7 @@ require "mini_mime"
10
10
  #
11
11
  # ActiveStorage::Variation.new(resize_to_limit: [100, 100], monochrome: true, trim: true, rotate: "-90")
12
12
  #
13
- # The options map directly to {ImageProcessing}[https://github.com/janko-m/image_processing] commands.
13
+ # The options map directly to {ImageProcessing}[https://github.com/janko/image_processing] commands.
14
14
  class ActiveStorage::Variation
15
15
  attr_reader :transformations
16
16
 
@@ -86,6 +86,21 @@ module ActiveStorage
86
86
  ActiveStorage.draw_routes = app.config.active_storage.draw_routes != false
87
87
  ActiveStorage.resolve_model_to_route = app.config.active_storage.resolve_model_to_route || :rails_storage_redirect
88
88
 
89
+ ActiveStorage.supported_image_processing_methods += app.config.active_storage.supported_image_processing_methods || []
90
+ ActiveStorage.unsupported_image_processing_arguments = app.config.active_storage.unsupported_image_processing_arguments || %w(
91
+ -debug
92
+ -display
93
+ -distribute-cache
94
+ -help
95
+ -path
96
+ -print
97
+ -set
98
+ -verbose
99
+ -version
100
+ -write
101
+ -write-mask
102
+ )
103
+
89
104
  ActiveStorage.variable_content_types = app.config.active_storage.variable_content_types || []
90
105
  ActiveStorage.web_image_content_types = app.config.active_storage.web_image_content_types || []
91
106
  ActiveStorage.content_types_to_serve_as_binary = app.config.active_storage.content_types_to_serve_as_binary || []
@@ -9,8 +9,8 @@ module ActiveStorage
9
9
  module VERSION
10
10
  MAJOR = 6
11
11
  MINOR = 1
12
- TINY = 4
13
- PRE = "6"
12
+ TINY = 6
13
+ PRE = "1"
14
14
 
15
15
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
16
16
  end
@@ -1,5 +1,7 @@
1
1
  # frozen_string_literal: true
2
2
 
3
+ require "shellwords"
4
+
3
5
  module ActiveStorage
4
6
  class Previewer::VideoPreviewer < Previewer
5
7
  class << self
@@ -13,6 +13,9 @@ module ActiveStorage
13
13
  module Transformers
14
14
  class ImageProcessingTransformer < Transformer
15
15
  private
16
+ class UnsupportedImageProcessingMethod < StandardError; end
17
+ class UnsupportedImageProcessingArgument < StandardError; end
18
+
16
19
  def process(file, format:)
17
20
  processor.
18
21
  source(file).
@@ -28,6 +31,10 @@ module ActiveStorage
28
31
 
29
32
  def operations
30
33
  transformations.each_with_object([]) do |(name, argument), list|
34
+ if ActiveStorage.variant_processor == :mini_magick
35
+ validate_transformation(name, argument)
36
+ end
37
+
31
38
  if name.to_s == "combine_options"
32
39
  raise ArgumentError, <<~ERROR.squish
33
40
  Active Storage's ImageProcessing transformer doesn't support :combine_options,
@@ -40,6 +47,64 @@ module ActiveStorage
40
47
  end
41
48
  end
42
49
  end
50
+
51
+ def validate_transformation(name, argument)
52
+ method_name = name.to_s.tr("-", "_")
53
+
54
+ unless ActiveStorage.supported_image_processing_methods.any? { |method| method_name == method }
55
+ raise UnsupportedImageProcessingMethod, <<~ERROR.squish
56
+ One or more of the provided transformation methods is not supported.
57
+ ERROR
58
+ end
59
+
60
+ if argument.present?
61
+ if argument.is_a?(String) || argument.is_a?(Symbol)
62
+ validate_arg_string(argument)
63
+ elsif argument.is_a?(Array)
64
+ validate_arg_array(argument)
65
+ elsif argument.is_a?(Hash)
66
+ validate_arg_hash(argument)
67
+ end
68
+ end
69
+ end
70
+
71
+ def validate_arg_string(argument)
72
+ unsupported_arguments = ActiveStorage.unsupported_image_processing_arguments.any? do |bad_arg|
73
+ argument.to_s.downcase.include?(bad_arg)
74
+ end
75
+
76
+ raise UnsupportedImageProcessingArgument if unsupported_arguments
77
+ end
78
+
79
+ def validate_arg_array(argument)
80
+ argument.each do |arg|
81
+ if arg.is_a?(Integer) || arg.is_a?(Float)
82
+ next
83
+ elsif arg.is_a?(String) || arg.is_a?(Symbol)
84
+ validate_arg_string(arg)
85
+ elsif arg.is_a?(Array)
86
+ validate_arg_array(arg)
87
+ elsif arg.is_a?(Hash)
88
+ validate_arg_hash(arg)
89
+ end
90
+ end
91
+ end
92
+
93
+ def validate_arg_hash(argument)
94
+ argument.each do |key, value|
95
+ validate_arg_string(key)
96
+
97
+ if value.is_a?(Integer) || value.is_a?(Float)
98
+ next
99
+ elsif value.is_a?(String) || value.is_a?(Symbol)
100
+ validate_arg_string(value)
101
+ elsif value.is_a?(Array)
102
+ validate_arg_array(value)
103
+ elsif value.is_a?(Hash)
104
+ validate_arg_hash(value)
105
+ end
106
+ end
107
+ end
43
108
  end
44
109
  end
45
110
  end
@@ -1,7 +1,7 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  #--
4
- # Copyright (c) 2017-2020 David Heinemeier Hansson, Basecamp
4
+ # Copyright (c) 2017-2022 David Heinemeier Hansson, Basecamp
5
5
  #
6
6
  # Permission is hereby granted, free of charge, to any person obtaining
7
7
  # a copy of this software and associated documentation files (the
@@ -58,6 +58,297 @@ module ActiveStorage
58
58
  mattr_accessor :content_types_to_serve_as_binary, default: []
59
59
  mattr_accessor :content_types_allowed_inline, default: []
60
60
 
61
+ mattr_accessor :supported_image_processing_methods, default: [
62
+ "adaptive_blur",
63
+ "adaptive_resize",
64
+ "adaptive_sharpen",
65
+ "adjoin",
66
+ "affine",
67
+ "alpha",
68
+ "annotate",
69
+ "antialias",
70
+ "append",
71
+ "apply",
72
+ "attenuate",
73
+ "authenticate",
74
+ "auto_gamma",
75
+ "auto_level",
76
+ "auto_orient",
77
+ "auto_threshold",
78
+ "backdrop",
79
+ "background",
80
+ "bench",
81
+ "bias",
82
+ "bilateral_blur",
83
+ "black_point_compensation",
84
+ "black_threshold",
85
+ "blend",
86
+ "blue_primary",
87
+ "blue_shift",
88
+ "blur",
89
+ "border",
90
+ "bordercolor",
91
+ "borderwidth",
92
+ "brightness_contrast",
93
+ "cache",
94
+ "canny",
95
+ "caption",
96
+ "channel",
97
+ "channel_fx",
98
+ "charcoal",
99
+ "chop",
100
+ "clahe",
101
+ "clamp",
102
+ "clip",
103
+ "clip_path",
104
+ "clone",
105
+ "clut",
106
+ "coalesce",
107
+ "colorize",
108
+ "colormap",
109
+ "color_matrix",
110
+ "colors",
111
+ "colorspace",
112
+ "colourspace",
113
+ "color_threshold",
114
+ "combine",
115
+ "combine_options",
116
+ "comment",
117
+ "compare",
118
+ "complex",
119
+ "compose",
120
+ "composite",
121
+ "compress",
122
+ "connected_components",
123
+ "contrast",
124
+ "contrast_stretch",
125
+ "convert",
126
+ "convolve",
127
+ "copy",
128
+ "crop",
129
+ "cycle",
130
+ "deconstruct",
131
+ "define",
132
+ "delay",
133
+ "delete",
134
+ "density",
135
+ "depth",
136
+ "descend",
137
+ "deskew",
138
+ "despeckle",
139
+ "direction",
140
+ "displace",
141
+ "dispose",
142
+ "dissimilarity_threshold",
143
+ "dissolve",
144
+ "distort",
145
+ "dither",
146
+ "draw",
147
+ "duplicate",
148
+ "edge",
149
+ "emboss",
150
+ "encoding",
151
+ "endian",
152
+ "enhance",
153
+ "equalize",
154
+ "evaluate",
155
+ "evaluate_sequence",
156
+ "extent",
157
+ "extract",
158
+ "family",
159
+ "features",
160
+ "fft",
161
+ "fill",
162
+ "filter",
163
+ "flatten",
164
+ "flip",
165
+ "floodfill",
166
+ "flop",
167
+ "font",
168
+ "foreground",
169
+ "format",
170
+ "frame",
171
+ "function",
172
+ "fuzz",
173
+ "fx",
174
+ "gamma",
175
+ "gaussian_blur",
176
+ "geometry",
177
+ "gravity",
178
+ "grayscale",
179
+ "green_primary",
180
+ "hald_clut",
181
+ "highlight_color",
182
+ "hough_lines",
183
+ "iconGeometry",
184
+ "iconic",
185
+ "identify",
186
+ "ift",
187
+ "illuminant",
188
+ "immutable",
189
+ "implode",
190
+ "insert",
191
+ "intensity",
192
+ "intent",
193
+ "interlace",
194
+ "interline_spacing",
195
+ "interpolate",
196
+ "interpolative_resize",
197
+ "interword_spacing",
198
+ "kerning",
199
+ "kmeans",
200
+ "kuwahara",
201
+ "label",
202
+ "lat",
203
+ "layers",
204
+ "level",
205
+ "level_colors",
206
+ "limit",
207
+ "limits",
208
+ "linear_stretch",
209
+ "linewidth",
210
+ "liquid_rescale",
211
+ "list",
212
+ "loader",
213
+ "log",
214
+ "loop",
215
+ "lowlight_color",
216
+ "magnify",
217
+ "map",
218
+ "mattecolor",
219
+ "median",
220
+ "mean_shift",
221
+ "metric",
222
+ "mode",
223
+ "modulate",
224
+ "moments",
225
+ "monitor",
226
+ "monochrome",
227
+ "morph",
228
+ "morphology",
229
+ "mosaic",
230
+ "motion_blur",
231
+ "name",
232
+ "negate",
233
+ "noise",
234
+ "normalize",
235
+ "opaque",
236
+ "ordered_dither",
237
+ "orient",
238
+ "page",
239
+ "paint",
240
+ "pause",
241
+ "perceptible",
242
+ "ping",
243
+ "pointsize",
244
+ "polaroid",
245
+ "poly",
246
+ "posterize",
247
+ "precision",
248
+ "preview",
249
+ "process",
250
+ "quality",
251
+ "quantize",
252
+ "quiet",
253
+ "radial_blur",
254
+ "raise",
255
+ "random_threshold",
256
+ "range_threshold",
257
+ "red_primary",
258
+ "regard_warnings",
259
+ "region",
260
+ "remote",
261
+ "render",
262
+ "repage",
263
+ "resample",
264
+ "resize",
265
+ "resize_to_fill",
266
+ "resize_to_fit",
267
+ "resize_to_limit",
268
+ "resize_and_pad",
269
+ "respect_parentheses",
270
+ "reverse",
271
+ "roll",
272
+ "rotate",
273
+ "sample",
274
+ "sampling_factor",
275
+ "saver",
276
+ "scale",
277
+ "scene",
278
+ "screen",
279
+ "seed",
280
+ "segment",
281
+ "selective_blur",
282
+ "separate",
283
+ "sepia_tone",
284
+ "shade",
285
+ "shadow",
286
+ "shared_memory",
287
+ "sharpen",
288
+ "shave",
289
+ "shear",
290
+ "sigmoidal_contrast",
291
+ "silent",
292
+ "similarity_threshold",
293
+ "size",
294
+ "sketch",
295
+ "smush",
296
+ "snaps",
297
+ "solarize",
298
+ "sort_pixels",
299
+ "sparse_color",
300
+ "splice",
301
+ "spread",
302
+ "statistic",
303
+ "stegano",
304
+ "stereo",
305
+ "storage_type",
306
+ "stretch",
307
+ "strip",
308
+ "stroke",
309
+ "strokewidth",
310
+ "style",
311
+ "subimage_search",
312
+ "swap",
313
+ "swirl",
314
+ "synchronize",
315
+ "taint",
316
+ "text_font",
317
+ "threshold",
318
+ "thumbnail",
319
+ "tile_offset",
320
+ "tint",
321
+ "title",
322
+ "transform",
323
+ "transparent",
324
+ "transparent_color",
325
+ "transpose",
326
+ "transverse",
327
+ "treedepth",
328
+ "trim",
329
+ "type",
330
+ "undercolor",
331
+ "unique_colors",
332
+ "units",
333
+ "unsharp",
334
+ "update",
335
+ "valid_image",
336
+ "view",
337
+ "vignette",
338
+ "virtual_pixel",
339
+ "visual",
340
+ "watermark",
341
+ "wave",
342
+ "wavelet_denoise",
343
+ "weight",
344
+ "white_balance",
345
+ "white_point",
346
+ "white_threshold",
347
+ "window",
348
+ "window_group"
349
+ ]
350
+ mattr_accessor :unsupported_image_processing_arguments
351
+
61
352
  mattr_accessor :service_urls_expire_in, default: 5.minutes
62
353
 
63
354
  mattr_accessor :routes_prefix, default: "/rails/active_storage"
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: activestorage
3
3
  version: !ruby/object:Gem::Version
4
- version: 6.1.4.6
4
+ version: 6.1.6.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2022-02-11 00:00:00.000000000 Z
11
+ date: 2022-07-12 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,70 +16,70 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 6.1.4.6
19
+ version: 6.1.6.1
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 6.1.4.6
26
+ version: 6.1.6.1
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: actionpack
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
31
  - - '='
32
32
  - !ruby/object:Gem::Version
33
- version: 6.1.4.6
33
+ version: 6.1.6.1
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - '='
39
39
  - !ruby/object:Gem::Version
40
- version: 6.1.4.6
40
+ version: 6.1.6.1
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: activejob
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - '='
46
46
  - !ruby/object:Gem::Version
47
- version: 6.1.4.6
47
+ version: 6.1.6.1
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - '='
53
53
  - !ruby/object:Gem::Version
54
- version: 6.1.4.6
54
+ version: 6.1.6.1
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: activerecord
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
59
  - - '='
60
60
  - !ruby/object:Gem::Version
61
- version: 6.1.4.6
61
+ version: 6.1.6.1
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
66
  - - '='
67
67
  - !ruby/object:Gem::Version
68
- version: 6.1.4.6
68
+ version: 6.1.6.1
69
69
  - !ruby/object:Gem::Dependency
70
70
  name: marcel
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
73
  - - "~>"
74
74
  - !ruby/object:Gem::Version
75
- version: 1.0.0
75
+ version: '1.0'
76
76
  type: :runtime
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
80
  - - "~>"
81
81
  - !ruby/object:Gem::Version
82
- version: 1.0.0
82
+ version: '1.0'
83
83
  - !ruby/object:Gem::Dependency
84
84
  name: mini_mime
85
85
  requirement: !ruby/object:Gem::Requirement
@@ -188,10 +188,11 @@ licenses:
188
188
  - MIT
189
189
  metadata:
190
190
  bug_tracker_uri: https://github.com/rails/rails/issues
191
- changelog_uri: https://github.com/rails/rails/blob/v6.1.4.6/activestorage/CHANGELOG.md
192
- documentation_uri: https://api.rubyonrails.org/v6.1.4.6/
191
+ changelog_uri: https://github.com/rails/rails/blob/v6.1.6.1/activestorage/CHANGELOG.md
192
+ documentation_uri: https://api.rubyonrails.org/v6.1.6.1/
193
193
  mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
194
- source_code_uri: https://github.com/rails/rails/tree/v6.1.4.6/activestorage
194
+ source_code_uri: https://github.com/rails/rails/tree/v6.1.6.1/activestorage
195
+ rubygems_mfa_required: 'true'
195
196
  post_install_message:
196
197
  rdoc_options: []
197
198
  require_paths:
@@ -207,7 +208,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
207
208
  - !ruby/object:Gem::Version
208
209
  version: '0'
209
210
  requirements: []
210
- rubygems_version: 3.2.22
211
+ rubygems_version: 3.3.3
211
212
  signing_key:
212
213
  specification_version: 4
213
214
  summary: Local and cloud file storage framework.