activestorage 7.1.5.2 → 8.1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e2fdc79c02f31ae87546d38d509d76e6745aa1613b53d3242036eaede2df98c
-  data.tar.gz: db43b46d975c7794b7dcc9948899b4c1cdd1f4d8002266e6bd9078fee560732f
+  metadata.gz: 95a8a27a89ab0f4be63e4f466fcf5a7eedf15ed806d7b061257ab56aafadc1a6
+  data.tar.gz: 4f7046ccc16df5fb3bd06080e914fb54c0ad2009d5dbcb1080dcab7bf945f1e3
 SHA512:
-  metadata.gz: 93ff6753974b1f2ce12bb81c867c5ae0432de55dcb90db8e768c9911152651f48594c312f321c5e8e5971be826556f8338e20b80a07fd736a54884b0af2f790c
-  data.tar.gz: fa516053c9d81e0c6ac8003e5aeaee1be1e62c16e32c9ae0ec2fbcae41ebb255c3e49e780c5b1b58ca57049ee3ed421ecc08eb822d42ba58fb30e86d6c1ebdaf
+  metadata.gz: f187b18f73b712921f1dc2252fe5a645ce83b84dad1dc97d6b24be9f136a634e2b0da3290d2a8f9284ae6134bfc8b62fc8e7a7b9f4974b9f3dee6a6ed0af17aa
+  data.tar.gz: 24b2da33d24f7f2d34623482b2a2c818e3d87d7dfa8a165e1ff6091134548e37b8dc9eb3908a69231d3e8e9fa3320f75db1a0dabcb54b048e4e543319ec2f555

data/CHANGELOG.md

@@ -1,366 +1,167 @@
-## Rails 7.1.5.2 (August 13, 2025) ##
+## Rails 8.1.2.1 (March 23, 2026) ##
 
-    Remove dangerous transformations
+*   Filter user supplied metadata in DirectUploadController
 
-    [CVE-2025-24293]
+    [CVE-2026-33173]
 
-    *Zack Deveau*
+    *Jean Boussier*
 
-## Rails 7.1.5.1 (December 10, 2024) ##
-
-*   No changes.
-
-
-## Rails 7.1.5 (October 30, 2024) ##
-
-*   No changes.
-
-
-## Rails 7.1.4.2 (October 23, 2024) ##
-
-*   No changes.
-
-
-## Rails 7.1.4.1 (October 15, 2024) ##
-
-*   No changes.
+*   Configurable maxmimum streaming chunk size
 
+    Makes sure that byte ranges for blobs don't exceed 100mb by default.
+    Content ranges that are too big can result in denial of service.
 
-## Rails 7.1.4 (August 22, 2024) ##
+    [CVE-2026-33174]
 
-*   Fixes race condition for multiple preprocessed video variants.
+    *Gannon McGibbon*
 
-    *Justin Searls*
+*   Limit range requests to a single range
 
+    [CVE-2026-33658]
 
-## Rails 7.1.3.4 (June 04, 2024) ##
-
-*   No changes.
-
-
-## Rails 7.1.3.3 (May 16, 2024) ##
-
-*   No changes.
-
-
-## Rails 7.1.3.2 (February 21, 2024) ##
-
-*   No changes.
-
-
-## Rails 7.1.3.1 (February 21, 2024) ##
-
-*   No changes.
+    *Jean Boussier*
 
 
-## Rails 7.1.3 (January 16, 2024) ##
+*   Prevent path traversal in `DiskService`.
 
-*   Fix N+1 query when fetching preview images for non-image assets.
+    `DiskService#path_for` now raises an `InvalidKeyError` when passed keys with dot segments (".",
+    ".."), or if the resolved path is outside the storage root directory.
 
-    *Aaron Patterson & Justin Searls*
+    `#path_for` also now consistently raises `InvalidKeyError` if the key is invalid in any way, for
+    example containing null bytes or having an incompatible encoding. Previously, the exception
+    raised may have been `ArgumentError` or `Encoding::CompatibilityError`.
 
-*   Fix all Active Storage database related models to respect
-    `ActiveRecord::Base.table_name_prefix` configuration.
+    `DiskController` now explicitly rescues `InvalidKeyError` with appropriate HTTP status codes.
 
-    *Chedli Bourguiba*
+    [CVE-2026-33195]
 
-*   Fix `ActiveStorage::Representations::ProxyController` not returning the proper
-    preview image variant for previewable files.
+    *Mike Dalessio*
 
-    *Chedli Bourguiba*
+*   Prevent glob injection in `DiskService#delete_prefixed`.
 
-*   Fix `ActiveStorage::Representations::ProxyController` to proxy untracked
-    variants.
+    Escape glob metacharacters in the resolved path before passing to `Dir.glob`.
 
-    *Chedli Bourguiba*
+    Note that this change breaks any existing code that is relying on `delete_prefixed` to expand
+    glob metacharacters. This change presumes that is unintended behavior (as other storage services
+    do not respect these metacharacters).
 
-*   Fix direct upload forms when submit button contains nested elements.
+    [CVE-2026-33202]
 
-    *Marc Köhlbrugge*
+    *Mike Dalessio*
 
-*   When using the `preprocessed: true` option, avoid enqueuing transform jobs
-    for blobs that are not representable.
 
-    *Chedli Bourguiba*
-
-*   Process preview image variant when calling `ActiveStorage::Preview#processed`.
-    For example, `attached_pdf.preview(:thumb).processed` will now immediately
-    generate the full-sized preview image and the `:thumb` variant of it.
-    Previously, the `:thumb` variant would not be generated until a further call
-    to e.g. `processed.url`.
-
-    *Chedli Bourguiba* and *Jonathan Hefner*
-
-*   Prevent `ActiveRecord::StrictLoadingViolationError` when strict loading is
-    enabled and the variant of an Active Storage preview has already been
-    processed (for example, by calling `ActiveStorage::Preview#url`).
-
-    *Jonathan Hefner*
-
-*   Fix `preprocessed: true` option for named variants of previewable files.
-
-    *Nico Wenterodt*
-
-
-## Rails 7.1.2 (November 10, 2023) ##
-
-*   No changes.
-
-
-## Rails 7.1.1 (October 11, 2023) ##
-
-*   No changes.
-
-
-## Rails 7.1.0 (October 05, 2023) ##
-
-*   No changes.
-
-
-## Rails 7.1.0.rc2 (October 01, 2023) ##
-
-*   No changes.
-
-
-## Rails 7.1.0.rc1 (September 27, 2023) ##
-
-*   Add `expires_at` option to `ActiveStorage::Blob#signed_id`.
-
-    ```ruby
-    rails_blob_path(user.avatar, disposition: "attachment", expires_at: 30.minutes.from_now)
-    <%= image_tag rails_blob_path(user.avatar.variant(resize: "100x100"), expires_at: 30.minutes.from_now) %>
-    ```
+## Rails 8.1.2 (January 08, 2026) ##
 
-    *Aki*
+*   Restore ADC when signing URLs with IAM for GCS
 
-*   Allow attaching File and Pathname when assigning attributes, e.g.
+    ADC was previously used for automatic authorization when signing URLs with IAM.
+    Now it is again, but the auth client is memoized so that new credentials are only
+    requested when the current ones expire. Other auth methods can now be used
+    instead by setting the authorization on `ActiveStorage::Service::GCSService#iam_client`.
 
     ```ruby
-    User.create!(avatar: File.open("image.jpg"))
-    User.create!(avatar: file_fixture("image.jpg"))
+    ActiveStorage::Blob.service.iam_client.authorization = Google::Auth::ImpersonatedServiceAccountCredentials.new(options)
     ```
 
-    *Dorian Marié*
-
-
-## Rails 7.1.0.beta1 (September 13, 2023) ##
-
-*   Disables the session in `ActiveStorage::Blobs::ProxyController`
-    and `ActiveStorage::Representations::ProxyController`
-    in order to allow caching by default in some CDNs as CloudFlare
-
-    Fixes #44136
-
-    *Bruno Prieto*
-
-*   Add `tags` to `ActiveStorage::Analyzer::AudioAnalyzer` output
+    This is safer than setting `Google::Apis::RequestOptions.default.authorization`
+    because it only applies to Active Storage and does not affect other Google API
+    clients.
 
-    *Keaton Roux*
+    *Justin Malčić*
 
-*   Add an option to preprocess variants
 
-    ActiveStorage variants are processed on the fly when they are needed but
-    sometimes we're sure that they are accessed and want to processed them
-    upfront.
+## Rails 8.1.1 (October 28, 2025) ##
 
-    `preprocessed` option is added when declaring variants.
-
-    ```
-    class User < ApplicationRecord
-      has_one_attached :avatar do |attachable|
-        attachable.variant :thumb, resize_to_limit: [100, 100], preprocessed: true
-      end
-    end
-    ```
-
-    *Shouichi Kamiya*
-
-*   Fix variants not included when eager loading multiple records containing a single attachment
+*   No changes.
 
-    When using the `with_attached_#{name}` scope for a `has_one_attached` relation,
-    attachment variants were not eagerly loaded.
 
-    *Russell Porter*
+## Rails 8.1.0 (October 22, 2025) ##
 
-*   Allow an ActiveStorage attachment to be removed via a form post
+*   Add structured events for Active Storage:
+    - `active_storage.service_upload`
+    - `active_storage.service_download`
+    - `active_storage.service_streaming_download`
+    - `active_storage.preview`
+    - `active_storage.service_delete`
+    - `active_storage.service_delete_prefixed`
+    - `active_storage.service_exist`
+    - `active_storage.service_url`
+    - `active_storage.service_mirror`
 
-    Attachments can already be removed by updating the attachment to be nil such as:
-    ```ruby
-    User.find(params[:id]).update!(avatar: nil)
-    ```
+    *Gannon McGibbon*
 
-    However, a form cannot post a nil param, it can only post an empty string. But, posting an
-    empty string would result in an `ActiveSupport::MessageVerifier::InvalidSignature: mismatched digest`
-    error being raised, because it's being treated as a signed blob id.
+*   Allow analyzers and variant transformer to be fully configurable
 
-    Now, nil and an empty string are treated as a delete, which allows attachments to be removed via:
     ```ruby
-    User.find(params[:id]).update!(params.require(:user).permit(:avatar))
+    # ActiveStorage.analyzers can be set to an empty array:
+    config.active_storage.analyzers = []
+    # => ActiveStorage.analyzers = []
 
+    # or use custom analyzer:
+    config.active_storage.analyzers = [ CustomAnalyzer ]
+    # => ActiveStorage.analyzers = [ CustomAnalyzer ]
     ```
 
-    *Nate Matykiewicz*
-
-*   Remove mini_mime usage in favour of marcel.
-
-    We have two libraries that are have similar usage. This change removes
-    dependency on mini_mime and makes use of similar methods from marcel.
-
-    *Vipul A M*
+    If no configuration is provided, it will use the default analyzers.
 
-*   Allow destroying active storage variants
+    You can also disable variant processor to remove warnings on startup about missing gems.
 
     ```ruby
-    User.first.avatar.variant(resize_to_limit: [100, 100]).destroy
+    config.active_storage.variant_processor = :disabled
     ```
 
-    *Shouichi Kamiya*, *Yuichiro NAKAGAWA*, *Ryohei UEDA*
-
-*   Add `sample_rate` to `ActiveStorage::Analyzer::AudioAnalyzer` output
-
-    *Matija Čupić*
-
-*   Remove deprecated `purge` and `purge_later` methods from the attachments association.
+    *zzak*, *Alexandre Ruban*
 
-    *Rafael Mendonça França*
-
-*   Remove deprecated behavior when assigning to a collection of attachments.
-
-    Instead of appending to the collection, the collection is now replaced.
+*   Remove deprecated `:azure` storage service.
 
     *Rafael Mendonça França*
 
-*   Remove deprecated `ActiveStorage::Current#host` and `ActiveStorage::Current#host=` methods.
+*   Remove unnecessary calls to the GCP metadata server.
 
-    *Rafael Mendonça França*
-
-*   Remove deprecated invalid default content types in Active Storage configurations.
-
-    *Rafael Mendonça França*
-
-*   Add missing preview event to `ActiveStorage::LogSubscriber`
-
-    A `preview` event is being instrumented in `ActiveStorage::Previewer`.
-    However it was not added inside ActiveStorage's LogSubscriber class.
-
-    This will allow to have logs for when a preview happens
-    in the same fashion as all other ActiveStorage events such as
-    `upload` and `download` inside `Rails.logger`.
-
-    *Chedli Bourguiba*
-
-*   Fix retrieving rotation value from FFmpeg on version 5.0+.
-
-    In FFmpeg version 5.0+ the rotation value has been removed from tags.
-    Instead the value can be found in side_data_list. Along with
-    this update it's possible to have values of -90, -270 to denote the video
-    has been rotated.
-
-    *Haroon Ahmed*
-
-*   Touch all corresponding model records after ActiveStorage::Blob is analyzed
-
-    This fixes a race condition where a record can be requested and have a cache entry built, before
-    the initial `analyze_later` completes, which will not be invalidated until something else
-    updates the record. This also invalidates cache entries when a blob is re-analyzed, which
-    is helpful if a bug is fixed in an analyzer or a new analyzer is added.
-
-    *Nate Matykiewicz*
-
-*   Add ability to use pre-defined variants when calling `preview` or
-    `representation` on an attachment.
+    Calling Google::Auth.get_application_default triggers an explicit call to
+    the metadata server - given it was being called for significant number of
+    file operations, it can lead to considerable tail latencies and even metadata
+    server overloads. Instead, it's preferable (and significantly more efficient)
+    that applications use:
 
     ```ruby
-    class User < ActiveRecord::Base
-      has_one_attached :file do |attachable|
-        attachable.variant :thumb, resize_to_limit: [100, 100]
-      end
-    end
-
-    <%= image_tag user.file.representation(:thumb) %>
+    Google::Apis::RequestOptions.default.authorization = Google::Auth.get_application_default(...)
     ```
 
-    *Richard Böhme*
+    In the cases applications do not set that, the GCP libraries automatically determine credentials.
 
-*   Method `attach` always returns the attachments except when the record
-    is persisted, unchanged, and saving it fails, in which case it returns `nil`.
+    This also enables using credentials other than those of the associated GCP
+    service account like when using impersonation.
 
-    *Santiago Bartesaghi*
+    *Alex Coomans*
 
-*   Fixes multiple `attach` calls within transaction not uploading files correctly.
+*   Direct upload progress accounts for server processing time.
 
-    In the following example, the code failed to upload all but the last file to the configured service.
-    ```ruby
-    ActiveRecord::Base.transaction do
-      user.attachments.attach({
-        content_type: "text/plain",
-        filename: "dummy.txt",
-        io: ::StringIO.new("dummy"),
-      })
-      user.attachments.attach({
-        content_type: "text/plain",
-        filename: "dummy2.txt",
-        io: ::StringIO.new("dummy2"),
-      })
-    end
-
-    assert_equal 2, user.attachments.count
-    assert user.attachments.first.service.exist?(user.attachments.first.key)  # Fails
-    ```
+    *Jeremy Daer*
 
-    This was addressed by keeping track of the subchanges pending upload, and uploading them
-    once the transaction is committed.
+*   Delegate `ActiveStorage::Filename#to_str` to `#to_s`
 
-    Fixes #41661
+    Supports checking String equality:
 
-    *Santiago Bartesaghi*, *Bruno Vezoli*, *Juan Roig*, *Abhay Nikam*
-
-*   Raise an exception if `config.active_storage.service` is not set.
-
-    If Active Storage is configured and `config.active_storage.service` is not
-    set in the respective environment's configuration file, then an exception
-    is raised with a meaningful message when attempting to use Active Storage.
-
-    *Ghouse Mohamed*
-
-*   Fixes proxy downloads of files over 5mb
-
-    Previously, trying to view and/or download files larger than 5mb stored in
-    services like S3 via proxy mode could return corrupted files at around
-    5.2mb or cause random halts in the download. Now,
-    `ActiveStorage::Blobs::ProxyController` correctly handles streaming these
-    larger files from the service to the client without any issues.
-
-    Fixes #44679
-
-    *Felipe Raul*
-
-*   Saving attachment(s) to a record returns the blob/blobs object
-
-    Previously, saving attachments did not return the blob/blobs that
-    were attached. Now, saving attachments to a record with `#attach`
-    method returns the blob or array of blobs that were attached to
-    the record. If it fails to save the attachment(s), then it returns
-    `false`.
-
-    *Ghouse Mohamed*
-
-*   Don't stream responses in redirect mode
+    ```ruby
+    filename = ActiveStorage::Filename.new("file.txt")
+    filename == "file.txt" # => true
+    filename in "file.txt" # => true
+    "file.txt" == filename # => true
+    ```
 
-    Previously, both redirect mode and proxy mode streamed their
-    responses which caused a new thread to be created, and could end
-    up leaking connections in the connection pool. But since redirect
-    mode doesn't actually send any data, it doesn't need to be
-    streamed.
+    *Sean Doyle*
 
-    *Luke Lau*
+*   A Blob will no longer autosave associated Attachment.
 
-*   Safe for direct upload on Libraries or Frameworks
+    This fixes an issue where a record with an attachment would have
+    its dirty attributes reset, preventing your `after commit` callbacks
+    on that record to behave as expected.
 
-    Enable the use of custom headers during direct uploads, which allows for
-    the inclusion of Authorization bearer tokens or other forms of authorization
-    tokens through headers.
+    Note that this change doesn't require any changes on your application
+    and is supposed to be internal. Active Storage Attachment will continue
+    to be autosaved (through a different relation).
 
-    *Radamés Roriz*
+    *Edouard-chin*
 
-Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/activestorage/CHANGELOG.md) for previous changes.
+Please check [8-0-stable](https://github.com/rails/rails/blob/8-0-stable/activestorage/CHANGELOG.md) for previous changes.

data/README.md

@@ -1,6 +1,6 @@
 # Active Storage
 
-Active Storage makes it simple to upload and reference files in cloud services like [Amazon S3](https://aws.amazon.com/s3/), [Google Cloud Storage](https://cloud.google.com/storage/docs/), or [Microsoft Azure Storage](https://azure.microsoft.com/en-us/services/storage/), and attach those files to Active Records. Supports having one main service and mirrors in other services for redundancy. It also provides a disk service for testing or local deployments, but the focus is on cloud storage.
+Active Storage makes it simple to upload and reference files in cloud services like [Amazon S3](https://aws.amazon.com/s3/), or [Google Cloud Storage](https://cloud.google.com/storage/docs/), and attach those files to Active Records. Supports having one main service and mirrors in other services for redundancy. It also provides a disk service for testing or local deployments, but the focus is on cloud storage.
 
 Files can be uploaded from the server to the cloud or directly from the client to the cloud.
 
@@ -73,7 +73,7 @@ end
 ```erb
 <%= form_with model: @message, local: true do |form| %>
   <%= form.text_field :title, placeholder: "Title" %><br>
-  <%= form.text_area :content %><br><br>
+  <%= form.textarea :content %><br><br>
 
   <%= form.file_field :images, multiple: true %><br>
   <%= form.submit %>
@@ -88,7 +88,7 @@ class MessagesController < ApplicationController
   end
 
   def create
-    message = Message.create! params.require(:message).permit(:title, :content, images: [])
+    message = Message.create! params.expect(message: [ :title, :content, images: [] ])
     redirect_to message
   end
 
@@ -173,7 +173,10 @@ Active Storage, with its included JavaScript library, supports uploading directl
     ```erb
     <%= form.file_field :attachments, multiple: true, direct_upload: true %>
     ```
-3. That's it! Uploads begin upon form submission.
+
+3. Configure CORS on third-party storage services to allow direct upload requests.
+
+4. That's it! Uploads begin upon form submission.
 
 ### Direct upload JavaScript events
 
@@ -203,6 +206,6 @@ Bug reports for the Ruby on \Rails project can be filed here:
 
 * https://github.com/rails/rails/issues
 
-Feature requests should be discussed on the rails-core mailing list here:
+Feature requests should be discussed on the rubyonrails-core forum here:
 
 * https://discuss.rubyonrails.org/c/rubyonrails-core

data/app/assets/javascripts/activestorage.esm.js

@@ -672,7 +672,7 @@ class DirectUploadController {
     }));
   }
   uploadRequestDidProgress(event) {
-    const progress = event.loaded / event.total * 100;
+    const progress = event.loaded / event.total * 90;
     if (progress) {
       this.dispatch("progress", {
         progress: progress
@@ -707,6 +707,42 @@ class DirectUploadController {
       xhr: xhr
     });
     xhr.upload.addEventListener("progress", (event => this.uploadRequestDidProgress(event)));
+    xhr.upload.addEventListener("loadend", (() => {
+      this.simulateResponseProgress(xhr);
+    }));
+  }
+  simulateResponseProgress(xhr) {
+    let progress = 90;
+    const startTime = Date.now();
+    const updateProgress = () => {
+      const elapsed = Date.now() - startTime;
+      const estimatedResponseTime = this.estimateResponseTime();
+      const responseProgress = Math.min(elapsed / estimatedResponseTime, 1);
+      progress = 90 + responseProgress * 9;
+      this.dispatch("progress", {
+        progress: progress
+      });
+      if (xhr.readyState !== XMLHttpRequest.DONE && progress < 99) {
+        requestAnimationFrame(updateProgress);
+      }
+    };
+    xhr.addEventListener("loadend", (() => {
+      this.dispatch("progress", {
+        progress: 100
+      });
+    }));
+    requestAnimationFrame(updateProgress);
+  }
+  estimateResponseTime() {
+    const fileSize = this.file.size;
+    const MB = 1024 * 1024;
+    if (fileSize < MB) {
+      return 1e3;
+    } else if (fileSize < 10 * MB) {
+      return 2e3;
+    } else {
+      return 3e3 + fileSize / MB * 50;
+    }
   }
 }
 
@@ -845,4 +881,4 @@ function autostart() {
 
 setTimeout(autostart, 1);
 
-export { DirectUpload, DirectUploadController, DirectUploadsController, start };
+export { DirectUpload, DirectUploadController, DirectUploadsController, dispatchEvent, start };

data/app/assets/javascripts/activestorage.js

@@ -662,7 +662,7 @@
       }));
     }
     uploadRequestDidProgress(event) {
-      const progress = event.loaded / event.total * 100;
+      const progress = event.loaded / event.total * 90;
       if (progress) {
         this.dispatch("progress", {
           progress: progress
@@ -697,6 +697,42 @@
         xhr: xhr
       });
       xhr.upload.addEventListener("progress", (event => this.uploadRequestDidProgress(event)));
+      xhr.upload.addEventListener("loadend", (() => {
+        this.simulateResponseProgress(xhr);
+      }));
+    }
+    simulateResponseProgress(xhr) {
+      let progress = 90;
+      const startTime = Date.now();
+      const updateProgress = () => {
+        const elapsed = Date.now() - startTime;
+        const estimatedResponseTime = this.estimateResponseTime();
+        const responseProgress = Math.min(elapsed / estimatedResponseTime, 1);
+        progress = 90 + responseProgress * 9;
+        this.dispatch("progress", {
+          progress: progress
+        });
+        if (xhr.readyState !== XMLHttpRequest.DONE && progress < 99) {
+          requestAnimationFrame(updateProgress);
+        }
+      };
+      xhr.addEventListener("loadend", (() => {
+        this.dispatch("progress", {
+          progress: 100
+        });
+      }));
+      requestAnimationFrame(updateProgress);
+    }
+    estimateResponseTime() {
+      const fileSize = this.file.size;
+      const MB = 1024 * 1024;
+      if (fileSize < MB) {
+        return 1e3;
+      } else if (fileSize < 10 * MB) {
+        return 2e3;
+      } else {
+        return 3e3 + fileSize / MB * 50;
+      }
     }
   }
   const inputSelector = "input[type=file][data-direct-upload-url]:not([disabled])";
@@ -822,6 +858,7 @@
   exports.DirectUpload = DirectUpload;
   exports.DirectUploadController = DirectUploadController;
   exports.DirectUploadsController = DirectUploadsController;
+  exports.dispatchEvent = dispatchEvent;
   exports.start = start;
   Object.defineProperty(exports, "__esModule", {
     value: true

data/app/controllers/active_storage/direct_uploads_controller.rb

@@ -11,7 +11,7 @@ class ActiveStorage::DirectUploadsController < ActiveStorage::BaseController
 
   private
     def blob_args
-      params.require(:blob).permit(:filename, :byte_size, :checksum, :content_type, metadata: {}).to_h.symbolize_keys
+      params.expect(blob: [:filename, :byte_size, :checksum, :content_type, metadata: {}]).to_h.symbolize_keys
     end
 
     def direct_upload_json(blob)

data/app/controllers/active_storage/disk_controller.rb

@@ -17,6 +17,8 @@ class ActiveStorage::DiskController < ActiveStorage::BaseController
     end
   rescue Errno::ENOENT
     head :not_found
+  rescue ActiveStorage::InvalidKeyError
+    head :not_found
   end
 
   def update
@@ -25,13 +27,15 @@ class ActiveStorage::DiskController < ActiveStorage::BaseController
         named_disk_service(token[:service_name]).upload token[:key], request.body, checksum: token[:checksum]
         head :no_content
       else
-        head :unprocessable_entity
+        head ActionDispatch::Constants::UNPROCESSABLE_CONTENT
       end
     else
       head :not_found
     end
   rescue ActiveStorage::IntegrityError
-    head :unprocessable_entity
+    head ActionDispatch::Constants::UNPROCESSABLE_CONTENT
+  rescue ActiveStorage::InvalidKeyError
+    head ActionDispatch::Constants::UNPROCESSABLE_CONTENT
   end
 
   private