activestorage 8.1.4 → 8.1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 363218fe84c4760d1243ee6f1325312eab52a4d1d7c33f512022e1a8ad4ed8a5
-  data.tar.gz: 603439dba3d29a9f57b433232954d85d9ec70905ab6114d10e370b2136283258
+  metadata.gz: fdfb78984fbd5e8de07c60266b6996cf48474e219120bf89a916ea96aeb7a190
+  data.tar.gz: 752b81997b178d7cd7473b1c27d5199bb6e03bebc301b4660eee0f380cfa95c2
 SHA512:
-  metadata.gz: 5277345f853e82ae059c49bde6c2664f84516dfbd4da948e7a48b437da363682104b56fb895b75e7010f7201c5ced03106297c24bba67977a2567b045b2faa60
-  data.tar.gz: 27b8cbc33599414d28774b41d1d3891a1fb803e4316e217f24e47903f8a2d5e6f92fd7ffb2d50d9b02efddf26fa08ae6a199993dbbfc4cdad37aab813df1b906
+  metadata.gz: 9cd250255e0da480e917eafac48c4f36751e9c7e3c54c3b3cc63d1ab82cb5d12a30738b7489d1dbce08b4158a506605423612d6f29d2cee75f17afa291b0c01e
+  data.tar.gz: 4b185e00d70788a9a2f22f5e49681927177fcb9eb22918593a7b22d48a7f2de6448eb6732af5e699e75dd541c341888f2e357c9e167b99f44aeca2c38ce5a9fe

data/CHANGELOG.md

@@ -1,3 +1,127 @@
+## Rails 8.1.4.1 (November 03, 2026) ##
+
+*   Preserve committed proxy responses when a storage error interrupts a
+    streamed download.
+
+    [GHSA-4v2w-w6g6-f8f8]
+
+    *Jeremy Daer*
+
+*   Derive `ActiveStorage::Filename#base` and `#extension` from the sanitized
+    filename.
+
+    This prevents null bytes and invalid byte sequences in stored filename
+    metadata from raising when a blob is opened or represented. Existing blob
+    records are handled without a data migration.
+
+    [GHSA-p2pm-g2h6-7j5j]
+
+    *Jeremy Daer*
+
+*   Ship an ImageMagick security policy and apply it to every ImageMagick
+    process MiniMagick spawns.
+
+    ImageMagick chooses a coder from the content of the file it is given, and
+    some coders act on files named inside the image rather than on the image
+    itself. Active Storage constrained none of them, so an uploaded file could
+    reach any coder the host's policy allowed, through the ImageMagick analyzer
+    at attach time, with no variant or `analyze` call in the application.
+
+    Active Storage now ships a `policy.xml` in
+    `ActiveStorage::ImageMagick::POLICY_DIRECTORY` and prepends that directory
+    to `MAGICK_CONFIGURE_PATH` through `MiniMagick.cli_env`. ImageMagick applies
+    every policy file on its search path, so the shipped policy adds to the
+    host's policy rather than replacing it. A `MAGICK_CONFIGURE_PATH` set in the
+    environment or in `MiniMagick.cli_env`, including by an initializer or
+    dotenv, is kept after the shipped directory.
+
+    The shipped policy denies the coders that script ImageMagick (`MSL`), read
+    or delete files other than the image (`TEXT`, `EPHEMERAL`), fetch remote
+    references (`URL`, `HTTP`, `HTTPS`, `FTP`), display to a screen (`SHOW`,
+    `WIN`, `PLT`), or hand the file to Ghostscript (the `PS`, `EPS`, `EPT` and
+    `PDF` coders, every alias of them, and the `gs` delegate), or reach a file
+    directly (`FILE`, `MPC`, `XPS`, `PCL`), and it refuses `@filename`
+    indirection. The policy applies to every ImageMagick command MiniMagick
+    runs, not only Active Storage's.
+
+    These applications must act:
+
+    *   One whose variant processor is `:mini_magick` has to use mini_magick 5.1
+        or later, which applying the policy requires. With an older mini_magick,
+        it raises at boot.
+    *   One that renders PostScript or PDF through ImageMagick has to re-allow
+        the `gs` delegate and the coders it uses in the host's `policy.xml`. A
+        host policy that allows a coder overrides the shipped deny.
+    *   One that replaces `MiniMagick.cli_env` after it boots, clears the
+        environment with `MiniMagick.cli_prefix`, or installs its own
+        `MiniMagick::Shell` never receives the shipped policy and has to carry
+        its rules in ImageMagick's system policy. So does one that uses
+        GraphicsMagick, which does not read ImageMagick policies.
+
+    Every other application needs no change. See "ImageMagick Security Policy"
+    in the Active Storage guide.
+
+    [GHSA-f3w6-w445-fwh9]
+
+    *Mike Dalessio*
+
+*   Enforce the declared content length on Google Cloud Storage direct uploads.
+
+    The signed URL now requires an `x-goog-content-length-range` header matching the blob's
+    `byte_size`, so Cloud Storage rejects a body of any other size.
+
+    Browsers send the new header, so a bucket's CORS configuration must list
+    `x-goog-content-length-range` in `responseHeader`, or direct uploads from the browser fail.
+
+    [GHSA-hfr4-8rjc-97m2]
+
+    *Mike Dalessio*
+
+*   Sign GCS direct uploads with V2 when `cache_control` is set.
+
+    V4 signatures did not bind the Content-Type or Content-MD5 headers, so the uploader could
+    choose the stored Content-Type. Direct-upload URLs with `cache_control` are no longer limited
+    to 7 days, and the client sends `Cache-Control` unsigned.
+
+    [GHSA-3w93-6hmw-whh4]
+
+    *Mike Dalessio*
+
+*   Stop an uploaded filename choosing the extension of the tempfile Active
+    Storage hands to an external tool.
+
+    `ActiveStorage::Blob#open` named its tempfile after the uploaded filename,
+    extension and all. Tools that select a decoder from the extension alone,
+    such as FFmpeg's AviSynth demuxer on `.avs`, therefore took their
+    instructions from the uploader. The extension is now kept only when it
+    denotes the blob's recorded media type, and dropped otherwise.
+
+    [GHSA-v924-7rp8-4mxh]
+
+    *Mike Dalessio*
+
+*   Restrict the formats ffmpeg and ffprobe will open when previewing and
+    analyzing video and audio.
+
+    Active Storage now passes `-format_whitelist` before the input at every
+    ffmpeg and ffprobe call site, limiting demuxer selection to common audio and
+    video container formats. Configure the list with
+    `config.active_storage.ffmpeg_allowed_formats`, or set it to `nil` to let
+    ffmpeg choose any demuxer it was built with.
+
+    Files in other formats, such as MXF, DV, AC3, WavPack, AU, W64, and raw
+    H.264 or MPEG-1/2 video streams, now fail to preview with
+    `ActiveStorage::PreviewError`, and their analysis stores no media metadata
+    and logs a warning. Add their demuxers to the list to keep them.
+
+    ```ruby
+    config.active_storage.ffmpeg_allowed_formats += %w[ mxf ]
+    ```
+
+    [GHSA-3f4q-8x5m-76v8]
+
+    *Mike Dalessio*
+
 ## Rails 8.1.4 (September 24, 2026) ##
 
 *   Warn instead of aborting boot when `image_processing` 2.x is installed without `ruby-vips`

data/app/controllers/concerns/active_storage/streaming.rb

@@ -69,13 +69,18 @@ module ActiveStorage::Streaming
           stream.write chunk
         end
       rescue ActiveStorage::FileNotFoundError
+        raise if response.committed?
+
         expires_now
         head :not_found
       rescue
-        # Status and caching headers are already set, but not committed.
-        # Change the status to 500 manually.
-        expires_now
-        head :internal_server_error
+        # Until the first chunk is written, status and caching headers are set
+        # but not committed. Change the status to 500 manually.
+        unless response.committed?
+          expires_now
+          head :internal_server_error
+        end
+
         raise
       end
     end

data/app/models/active_storage/blob.rb

@@ -305,7 +305,8 @@ class ActiveStorage::Blob < ActiveStorage::Record
 
   # Downloads the blob to a tempfile on disk. Yields the tempfile.
   #
-  # The tempfile's name is prefixed with +ActiveStorage-+ and the blob's ID. Its extension matches that of the blob.
+  # The tempfile's name is prefixed with +ActiveStorage-+ and the blob's ID. It keeps the blob filename's
+  # extension when that extension denotes the blob's content type, and has no extension otherwise.
   #
   # By default, the tempfile is created in <tt>Dir.tmpdir</tt>. Pass +tmpdir:+ to create it in a different directory:
   #
@@ -321,7 +322,7 @@ class ActiveStorage::Blob < ActiveStorage::Record
       key,
       checksum: checksum,
       verify: !composed,
-      name: [ "ActiveStorage-#{id}-", filename.extension_with_delimiter ],
+      name: [ "ActiveStorage-#{id}-", tempfile_extension ],
       tmpdir: tmpdir,
       &block
     )
@@ -360,6 +361,25 @@ class ActiveStorage::Blob < ActiveStorage::Record
   end
 
   private
+    # The extension is there for tools that cannot tell the type from the bytes (316d87e4: ImageMagick
+    # needs it for an SVG with no XML declaration), but some tools choose a decoder on it alone: FFmpeg
+    # runs a `.avs` file as an AviSynth script. So the uploaded extension is kept only when it denotes
+    # the blob's media type.
+    def tempfile_extension
+      extension = filename.extension_with_delimiter
+      return "" if extension.blank?
+
+      type_for_extension = Marcel::MimeType.for(name: filename.to_s)
+      return "" if type_for_extension == Marcel::MimeType::BINARY || type_for_extension != media_type
+
+      extension
+    end
+
+    # Marcel answers in canonical lowercase, so drop parameters and case before comparing.
+    def media_type
+      content_type.to_s.split(";").first.to_s.strip.downcase
+    end
+
     def compute_checksum_in_chunks(io)
       raise ArgumentError, "io must be rewindable" unless io.respond_to?(:rewind)
 

data/app/models/active_storage/filename.rb

@@ -25,7 +25,7 @@ class ActiveStorage::Filename
   #   ActiveStorage::Filename.new("racecar").base     # => "racecar"
   #   ActiveStorage::Filename.new(".gitignore").base  # => ".gitignore"
   def base
-    File.basename @filename, extension_with_delimiter
+    File.basename sanitized, extension_with_delimiter
   end
 
   # Returns the extension of the filename (i.e. the substring following the last dot, excluding a dot at the
@@ -35,7 +35,7 @@ class ActiveStorage::Filename
   #   ActiveStorage::Filename.new("racecar").extension_with_delimiter     # => ""
   #   ActiveStorage::Filename.new(".gitignore").extension_with_delimiter  # => ""
   def extension_with_delimiter
-    File.extname @filename
+    File.extname sanitized
   end
 
   # Returns the extension of the filename (i.e. the substring following the last dot, excluding a dot at
@@ -55,9 +55,10 @@ class ActiveStorage::Filename
   #   ActiveStorage::Filename.new("foo:bar.jpg").sanitized # => "foo-bar.jpg"
   #   ActiveStorage::Filename.new("foo/bar.jpg").sanitized # => "foo-bar.jpg"
   #
-  # Characters considered unsafe for storage (e.g. \, $, and the RTL override character) are replaced with a dash.
+  # Characters considered unsafe for storage (e.g. \, $, the null character, and the RTL override character) are
+  # replaced with a dash.
   def sanitized
-    @filename.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "�").strip.tr("\u{202E}%$|:;/<>?*\"\t\r\n\\", "-")
+    @filename.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "�").strip.tr("\u{202E}\u{0000}%$|:;/<>?*\"\t\r\n\\", "-")
   end
 
   # Returns the sanitized version of the filename.

data/lib/active_storage/analyzer/audio_analyzer.rb

@@ -60,9 +60,12 @@ module ActiveStorage
             "-show_streams",
             "-show_format",
             "-v", "error",
+            *ActiveStorage.ffmpeg_format_whitelist_arguments,
             file.path
           ]) do |output|
             JSON.parse(output.read)
+          end.tap do
+            logger.warn "Audio analysis failed because ffprobe exited with status #{$?.exitstatus}. The file may be corrupt, or in a format outside config.active_storage.ffmpeg_allowed_formats." unless $?.success?
           end
         end
       rescue Errno::ENOENT

data/lib/active_storage/analyzer/image_analyzer/image_magick.rb

@@ -1,13 +1,6 @@
 # frozen_string_literal: true
 
-begin
-  gem "mini_magick"
-  require "mini_magick"
-  ActiveStorage::MINIMAGICK_AVAILABLE = true # :nodoc:
-rescue LoadError => error
-  ActiveStorage::MINIMAGICK_AVAILABLE = false # :nodoc:
-  raise error unless error.message.include?("mini_magick")
-end
+require "active_storage/image_magick"
 
 module ActiveStorage
   # This analyzer relies on the third-party {MiniMagick}[https://github.com/minimagick/minimagick] gem. MiniMagick requires
@@ -24,6 +17,8 @@ module ActiveStorage
           return {}
         end
 
+        ActiveStorage.require_securable_mini_magick!
+
         download_blob_to_tempfile do |file|
           image = instrument("mini_magick") do
             MiniMagick::Image.new(file.path)

data/lib/active_storage/analyzer/video_analyzer.rb

@@ -140,9 +140,12 @@ module ActiveStorage
             "-show_streams",
             "-show_format",
             "-v", "error",
+            *ActiveStorage.ffmpeg_format_whitelist_arguments,
             file.path
           ]) do |output|
             JSON.parse(output.read)
+          end.tap do
+            logger.warn "Video analysis failed because ffprobe exited with status #{$?.exitstatus}. The file may be corrupt, or in a format outside config.active_storage.ffmpeg_allowed_formats." unless $?.success?
           end
         end
       rescue Errno::ENOENT

data/lib/active_storage/engine.rb

@@ -29,6 +29,7 @@ module ActiveStorage
     config.active_storage.paths = ActiveSupport::OrderedOptions.new
     config.active_storage.queues = ActiveSupport::InheritableOptions.new
     config.active_storage.precompile_assets = true
+    config.active_storage.ffmpeg_allowed_formats = ActiveStorage.ffmpeg_allowed_formats
 
     config.active_storage.variable_content_types = %w(
       image/png
@@ -92,6 +93,10 @@ module ActiveStorage
         ActiveStorage.previewers        = app.config.active_storage.previewers || []
         ActiveStorage.analyzers         = app.config.active_storage.analyzers || []
 
+        if ActiveStorage::MINIMAGICK_AVAILABLE && !ActiveStorage::MINIMAGICK_UNSECURABLE
+          ActiveStorage::ImageMagick.apply_policy
+        end
+
         begin
           ActiveStorage.variant_transformer =
             case ActiveStorage.variant_processor
@@ -123,7 +128,7 @@ module ActiveStorage
           when /mini_magick/
             ActiveStorage.logger.warn <<~WARNING.squish
               Generating image variants with ImageMagick requires the mini_magick gem.
-              Please add `gem "mini_magick", "~> 5.0"` to your Gemfile.
+              Please add `gem "mini_magick", "~> 5.1"` to your Gemfile.
             WARNING
           else
             raise
@@ -158,6 +163,7 @@ module ActiveStorage
         ActiveStorage.content_types_allowed_inline = app.config.active_storage.content_types_allowed_inline || []
         ActiveStorage.binary_content_type = app.config.active_storage.binary_content_type || "application/octet-stream"
         ActiveStorage.video_preview_arguments = app.config.active_storage.video_preview_arguments || "-y -vframes 1 -f image2"
+        ActiveStorage.ffmpeg_allowed_formats = app.config.active_storage.ffmpeg_allowed_formats
         ActiveStorage.track_variants = app.config.active_storage.track_variants || false
         ActiveStorage.streaming_chunk_max_size = app.config.active_storage.streaming_chunk_max_size || 100.megabytes
       end

data/lib/active_storage/gem_version.rb

@@ -10,7 +10,7 @@ module ActiveStorage
     MAJOR = 8
     MINOR = 1
     TINY  = 4
-    PRE   = nil
+    PRE   = "1"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/active_storage/image_magick/policy.xml

@@ -0,0 +1,68 @@
+<!--
+  Active Storage's ImageMagick security policy. Applied in addition to the host's policy.xml,
+  through MAGICK_CONFIGURE_PATH, to every ImageMagick process MiniMagick spawns.
+
+  This file must work under both ImageMagick 6 and ImageMagick 7. Use the "coder", "delegate"
+  and "path" domains, which every release of both honors. A domain one release does not know,
+  such as "module" on older ImageMagick 6 releases, is ignored rather than rejected.
+
+  ImageMagick picks a coder from the file's content, and several coders name the same underlying
+  reader through different tokens (PS, EPS, EPI, EPSF, EPSI, EPT; PDF, AI, EPDF, PDFA, POCKETMOD). A
+  coder rule matches one token, so every token is denied by coder.
+
+  Do not put a backtick anywhere in this file. ImageMagick's tokenizer treats a backtick as an
+  opening quote and silently drops every rule up to the next apostrophe.
+-->
+<policymap>
+  <!-- Scripting coder that reads and writes files named inside the image. -->
+  <policy domain="coder" rights="none" pattern="MSL"/>
+
+  <!-- Coders that read a file, or delete one, other than the image being processed. -->
+  <policy domain="coder" rights="none" pattern="EPHEMERAL"/>
+  <policy domain="coder" rights="none" pattern="TEXT"/>
+
+  <!-- Coder that reads back a pixel cache from a file the image header names. -->
+  <policy domain="coder" rights="none" pattern="MPC"/>
+
+  <!-- Coders that display to a screen. -->
+  <policy domain="coder" rights="none" pattern="SHOW"/>
+  <policy domain="coder" rights="none" pattern="WIN"/>
+  <policy domain="coder" rights="none" pattern="PLT"/>
+
+  <!-- Coders that read a reference from outside the image, remote or local. FILE reads file://. -->
+  <policy domain="coder" rights="none" pattern="URL"/>
+  <policy domain="coder" rights="none" pattern="HTTP"/>
+  <policy domain="coder" rights="none" pattern="HTTPS"/>
+  <policy domain="coder" rights="none" pattern="FTP"/>
+  <policy domain="coder" rights="none" pattern="FILE"/>
+
+  <!-- Interpreters that read and write files of their own. Ghostscript backs the PS and PDF
+       coders and their token aliases; GhostXPS and GhostPCL back XPS and PCL. The "gs" delegate
+       covers ImageMagick builds that run Ghostscript as an external command, and the coder rules
+       cover builds that link it in-process, where the delegate rule never applies. An
+       application that transforms PostScript or PDF through ImageMagick must allow the "gs"
+       delegate, and the coders it uses, again in the host's policy.xml. -->
+  <policy domain="delegate" rights="none" pattern="gs"/>
+  <policy domain="coder" rights="none" pattern="PS"/>
+  <policy domain="coder" rights="none" pattern="PS2"/>
+  <policy domain="coder" rights="none" pattern="PS3"/>
+  <policy domain="coder" rights="none" pattern="EPS"/>
+  <policy domain="coder" rights="none" pattern="EPS2"/>
+  <policy domain="coder" rights="none" pattern="EPS3"/>
+  <policy domain="coder" rights="none" pattern="EPI"/>
+  <policy domain="coder" rights="none" pattern="EPSF"/>
+  <policy domain="coder" rights="none" pattern="EPSI"/>
+  <policy domain="coder" rights="none" pattern="EPT"/>
+  <policy domain="coder" rights="none" pattern="EPT2"/>
+  <policy domain="coder" rights="none" pattern="EPT3"/>
+  <policy domain="coder" rights="none" pattern="PDF"/>
+  <policy domain="coder" rights="none" pattern="AI"/>
+  <policy domain="coder" rights="none" pattern="EPDF"/>
+  <policy domain="coder" rights="none" pattern="PDFA"/>
+  <policy domain="coder" rights="none" pattern="POCKETMOD"/>
+  <policy domain="coder" rights="none" pattern="XPS"/>
+  <policy domain="coder" rights="none" pattern="PCL"/>
+
+  <!-- Indirect reads such as text:@/etc/passwd, which substitute a file for an argument. -->
+  <policy domain="path" rights="none" pattern="@*"/>
+</policymap>

data/lib/active_storage/image_magick.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+# :markup: markdown
+
+require "active_storage"
+require "active_support/core_ext/object/blank"
+require "active_support/core_ext/string/filters"
+
+begin
+  gem "mini_magick"
+  require "mini_magick"
+  ActiveStorage::MINIMAGICK_AVAILABLE = true # :nodoc:
+rescue LoadError => error
+  ActiveStorage::MINIMAGICK_AVAILABLE = false # :nodoc:
+  raise error unless error.message.include?("mini_magick")
+end
+
+module ActiveStorage
+  # Adds Active Storage's ImageMagick security policy to every ImageMagick process MiniMagick spawns.
+  #
+  # ImageMagick reads every `policy.xml` on its configuration search path and applies all of them,
+  # so the shipped policy adds to the operator's policy rather than replacing it. `MAGICK_CONFIGURE_PATH`
+  # prepends to that search path; a value the operator has already set, in the environment or in
+  # `MiniMagick.cli_env`, is kept after the shipped directory.
+  module ImageMagick
+    POLICY_DIRECTORY = File.expand_path("image_magick", __dir__)
+
+    # Called when Active Storage loads, and again after the application initializes, so that a
+    # `MAGICK_CONFIGURE_PATH` or `MiniMagick.cli_env` set by an initializer or dotenv keeps the policy.
+    def self.apply_policy # :nodoc:
+      operator_paths = operator_paths(MiniMagick.cli_env["MAGICK_CONFIGURE_PATH"]).presence ||
+        operator_paths(ENV["MAGICK_CONFIGURE_PATH"])
+
+      MiniMagick.cli_env = MiniMagick.cli_env.merge("MAGICK_CONFIGURE_PATH" => configure_path(operator_paths)).freeze
+    end
+
+    def self.configure_path(operator_path)
+      [ POLICY_DIRECTORY, *operator_paths(operator_path) ].join(File::PATH_SEPARATOR)
+    end
+
+    def self.operator_paths(path)
+      Array(path).flat_map { |entry| entry.split(File::PATH_SEPARATOR) } - [ POLICY_DIRECTORY, "" ]
+    end
+    private_class_method :operator_paths
+  end
+end
+
+ActiveStorage::MINIMAGICK_UNSECURABLE = ActiveStorage::MINIMAGICK_AVAILABLE && !MiniMagick.respond_to?(:cli_env=) # :nodoc:
+
+module ActiveStorage
+  # Raises when the installed mini_magick cannot apply the shipped ImageMagick security policy.
+  # Called before Active Storage hands untrusted content to ImageMagick.
+  def self.require_securable_mini_magick! # :nodoc:
+    if MINIMAGICK_UNSECURABLE
+      raise <<~ERROR.squish
+        Active Storage's ImageMagick security policy requires mini_magick 5.1 or later. Please add
+        `gem "mini_magick", "~> 5.1"` to your Gemfile, or use the :vips variant processor.
+      ERROR
+    end
+  end
+end
+
+ActiveStorage::ImageMagick.apply_policy if ActiveStorage::MINIMAGICK_AVAILABLE && !ActiveStorage::MINIMAGICK_UNSECURABLE

data/lib/active_storage/previewer/video_previewer.rb

@@ -30,7 +30,7 @@ module ActiveStorage
 
     private
       def draw_relevant_frame_from(file, &block)
-        draw self.class.ffmpeg_path, "-i", file.path, *Shellwords.split(ActiveStorage.video_preview_arguments), "-", &block
+        draw self.class.ffmpeg_path, *ActiveStorage.ffmpeg_format_whitelist_arguments, "-i", file.path, *Shellwords.split(ActiveStorage.video_preview_arguments), "-", &block
       end
   end
 end

data/lib/active_storage/service/gcs_service.rb

@@ -89,27 +89,16 @@ module ActiveStorage
       end
     end
 
-    def url_for_direct_upload(key, expires_in:, checksum:, custom_metadata: {}, **)
+    def url_for_direct_upload(key, expires_in:, checksum:, content_length:, custom_metadata: {}, **)
       instrument :url, key: key do |payload|
-        headers = {}
-        version = :v2
-
-        if @config[:cache_control].present?
-          headers["Cache-Control"] = @config[:cache_control]
-          # v2 signing doesn't support non `x-goog-` headers. Only switch to v4 signing
-          # if necessary for back-compat; v4 limits the expiration of the URL to 7 days
-          # whereas v2 has no limit
-          version = :v4
-        end
-
-        headers.merge!(custom_metadata_headers(custom_metadata))
-
+        # V2 signatures bind the Content-Type (empty) and Content-MD5 headers. GCS leaves headers
+        # other than x-goog-* out of V2 signatures, so the client sends Cache-Control unsigned.
         args = {
           content_md5: checksum,
           expires: expires_in,
-          headers: headers,
+          headers: { "x-goog-content-length-range" => content_length_range(content_length), **custom_metadata_headers(custom_metadata) },
           method: "PUT",
-          version: version,
+          version: :v2,
         }
 
         if @config[:iam]
@@ -125,10 +114,10 @@ module ActiveStorage
       end
     end
 
-    def headers_for_direct_upload(key, checksum:, filename: nil, disposition: nil, custom_metadata: {}, **)
+    def headers_for_direct_upload(key, checksum:, content_length:, filename: nil, disposition: nil, custom_metadata: {}, **)
       content_disposition = content_disposition_with(type: disposition, filename: filename) if filename
 
-      headers = { "Content-MD5" => checksum, "Content-Disposition" => content_disposition, **custom_metadata_headers(custom_metadata) }
+      headers = { "Content-MD5" => checksum, "Content-Disposition" => content_disposition, "x-goog-content-length-range" => content_length_range(content_length), **custom_metadata_headers(custom_metadata) }
       if @config[:cache_control].present?
         headers["Cache-Control"] = @config[:cache_control]
       end
@@ -238,5 +227,9 @@ module ActiveStorage
       def custom_metadata_headers(metadata)
         metadata.transform_keys { |key| "x-goog-meta-#{key}" }
       end
+
+      def content_length_range(content_length)
+        "#{content_length},#{content_length}"
+      end
   end
 end

data/lib/active_storage/transformers/image_magick.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "active_storage/image_magick"
+ActiveStorage.require_securable_mini_magick!
 module ActiveStorage
   module Transformers
     class ImageMagick < ImageProcessingTransformer

data/lib/active_storage.rb

@@ -382,6 +382,12 @@ module ActiveStorage
 
   mattr_accessor :video_preview_arguments, default: "-y -vframes 1 -f image2"
 
+  mattr_accessor :ffmpeg_allowed_formats, default: %w[ mov matroska avi mpeg mpegts flv asf ogg mp3 wav flac aac aiff caf ].freeze
+
+  def self.ffmpeg_format_whitelist_arguments # :nodoc:
+    [ "-format_whitelist", Array(ffmpeg_allowed_formats).join(",") ] unless ffmpeg_allowed_formats.nil?
+  end
+
   module Transformers
     extend ActiveSupport::Autoload
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activestorage
 version: !ruby/object:Gem::Version
-  version: 8.1.4
+  version: 8.1.4.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
@@ -15,56 +15,56 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: actionpack
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: activejob
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 8.1.4
+        version: 8.1.4.1
 - !ruby/object:Gem::Dependency
   name: marcel
   requirement: !ruby/object:Gem::Requirement
@@ -166,6 +166,8 @@ files:
 - lib/active_storage/errors.rb
 - lib/active_storage/fixture_set.rb
 - lib/active_storage/gem_version.rb
+- lib/active_storage/image_magick.rb
+- lib/active_storage/image_magick/policy.xml
 - lib/active_storage/log_subscriber.rb
 - lib/active_storage/previewer.rb
 - lib/active_storage/previewer/mupdf_previewer.rb
@@ -193,10 +195,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v8.1.4/activestorage/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v8.1.4/
+  changelog_uri: https://github.com/rails/rails/blob/v8.1.4.1/activestorage/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v8.1.4.1/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v8.1.4/activestorage
+  source_code_uri: https://github.com/rails/rails/tree/v8.1.4.1/activestorage
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: