attachment_saver 1.0.1 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5a22b412009475caf986f038cc3613ce59ff940c
-  data.tar.gz: 072903d7678d8305718b416d62058623f4e7bc2d
+  metadata.gz: 6e98ac80c02ee411fd7ea5ad5b6c0ea691e9b4e8
+  data.tar.gz: 54a6365fa0959a3f273e7daf4b904ffa7b0fbff7
 SHA512:
-  metadata.gz: b945b2d6f38082b9bd9befa2fb20f9f58ba150c63382d46d2860228b573a1851f6a0197ce43866052dd5f1a089d1226e88faeae706d81990b39a0a52ad71e19c
-  data.tar.gz: cbabbc1710ec1bf2547104eb825baaa96939c73a8a4182dee0e4500fc067988292d562e52c923e8a81c5987ca11c0cd1cf821b33cab78a77aaf31581faf46261
+  metadata.gz: 81e68dc896fe18afa31e7e4573ccdbe9629f6d87f71a57e8a5ae4ac38a0f6c89fde78f38a3e60f3429908e8c685d4c9871cafc248cdfe6917b138b18c41e2a61
+  data.tar.gz: d2942a80062936f13e518a18dddf63e4a5514358fc677e43f7f2a2bcfd325e1c8581fa4b1774dce6bfabc98eece19843646c3a8f071891b947b1fd62b6e4a0bb

data/Rakefile

@@ -11,6 +11,7 @@ desc 'Test the columns_on_demand plugin.'
 Rake::TestTask.new(:test) do |t|
   t.libs << 'lib'
   t.libs << 'test'
-  t.test_files = FileList['test/*_test.rb']
+  t.pattern = 'test/*_test.rb'
   t.verbose = true
+  t.warning = false
 end

data/attachment_saver.gemspec

@@ -14,18 +14,12 @@ of processing.  Errors are carefully handled to minimize the possibility of
 broken uploads leaving incomplete or corrupt data.
 
 RMagick, MiniMagick, and ImageScience image processors are supported.
-
-
-Compatibility
-=============
-
-Currently tested against Rails 3.2.13 and 3.1.8, on Ruby 1.8.7 and 2.0.0p0.
-Was also tested compatible with 2.3.14 and 3.0.17.
 EOF
   gem.has_rdoc     = false
   gem.author       = "Will Bryant"
   gem.email        = "will.bryant@gmail.com"
   gem.homepage     = "http://github.com/willbryant/attachment_saver"
+  gem.license      = 'MIT'
   
   gem.executables  = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
   gem.files        = `git ls-files`.split("\n")
@@ -33,6 +27,7 @@ EOF
   gem.require_path = "lib"
   
   gem.add_dependency "activerecord"
+  gem.add_dependency "mimemagic"
   gem.add_development_dependency "rake"
   gem.add_development_dependency "image_science"
   gem.add_development_dependency "rmagick"

data/lib/attachment_saver.rb

@@ -1,5 +1,4 @@
 require 'attachment_saver_errors'
-require 'misc/file_size'
 require 'tmpdir'
 
 module AttachmentSaver

data/lib/attachment_saver/version.rb

@@ -1,3 +1,3 @@
 module AttachmentSaver
-  VERSION = '1.0.1'
+  VERSION = '1.1.0'
 end

data/lib/datastores/file_system.rb

@@ -83,7 +83,7 @@ module AttachmentSaver
       end
       
       def in_storage?
-        File.exists?(storage_filename)
+        File.exist?(storage_filename)
       end
       
       def public_path

data/lib/processors/image.rb

@@ -1,4 +1,5 @@
 require 'attachment_saver_errors'
+require 'mimemagic'
 
 class ImageProcessorError < AttachmentProcessorError; end
 
@@ -6,14 +7,40 @@ module AttachmentSaver
   module Processors
     # shared code for all image processors
     module Image
+      DEFAULT_VALID_IMAGE_TYPES = %w(image/jpeg image/png image/gif).freeze
+
       def image?
         return false if content_type.blank?
         parts = content_type.split(/\//)
         parts.size == 2 && parts.first.strip == 'image'
       end
+
+      def valid_image_type
+        valid_image_types = self.class.attachment_options[:valid_image_types] || DEFAULT_VALID_IMAGE_TYPES
+
+        uploaded_file.rewind
+        magic = MimeMagic.by_magic(uploaded_file)
+
+        if magic.nil?
+          # if it doesn't look like an image, make sure it's not labelled as an image
+          self.content_type = 'application/octet-stream' if image? || content_type.nil?
+        elsif !valid_image_types.include?(magic.type)
+          # overwrite the content type given by the untrusted client with the real content type; it may get refined later by the image processor
+          self.content_type = magic.type
+        else
+          # seems legit
+          return true
+        end
+
+        errors.add(:content_type, "is invalid") if respond_to?(:errors)
+        false
+      end
       
       def before_validate_attachment
-        examine_attachment unless uploaded_file.nil? || derived_image?
+        unless uploaded_file.nil? || derived_image?
+          return false unless valid_image_type
+          examine_image
+        end
       rescue ImageProcessorError
         # we examine all files, regardless of whether the client browser labelled them an
         # image, because they may be an image with the wrong extension or content type.

data/lib/processors/image_science.rb

@@ -19,7 +19,7 @@ module AttachmentSaver
         ::ImageScience.with_image_attributes(filename) {|image| block.call(image)}
       end
       
-      def examine_attachment
+      def examine_image
         with_image_attributes(uploaded_file_path) do |original_image|
           self.width = original_image.width if respond_to?(:width)
           self.height = original_image.height if respond_to?(:height)

data/lib/processors/mini_magick.rb

@@ -28,7 +28,7 @@ module AttachmentSaver
         with_image(filename, &block)
       end
       
-      def examine_attachment
+      def examine_image
         with_image_attributes(uploaded_file_path) do |original_image|
           self.content_type = original_image.mime_type unless self.class.attachment_options[:keep_content_type] || original_image.mime_type.blank?
           self.file_extension = original_image.file_type_extension unless self.class.attachment_options[:keep_file_extension] || original_image.file_type_extension.blank?
@@ -93,7 +93,7 @@ module AttachmentSaver
           left = (width - new_width)/2
           right = (height - new_height)/2
           image = dup
-          image << "-crop #{new_width}x#{new_height}+#{left}+#{right} +repage" # mini_magick's #crop doesn't support the repage flag
+          image.crop("#{new_width}x#{new_height}+#{left}+#{right}", "+repage")
           image.extend Operations
           block.call(image)
         end

data/lib/processors/r_magick.rb

@@ -23,7 +23,7 @@ module AttachmentSaver
         block.call(image.extend(Operations))
       end
       
-      def examine_attachment
+      def examine_image
         with_image_attributes(uploaded_file_path) do |original_image|
           self.width = original_image.width if respond_to?(:width)
           self.height = original_image.height if respond_to?(:height)

data/test/attachment_saver_test.rb

@@ -1,7 +1,7 @@
 require File.expand_path(File.join(File.dirname(__FILE__), 'test_helper'))
 require 'attachment_saver'
 
-class AttachmentSaverTest < Test::Unit::TestCase
+class AttachmentSaverTest < ActiveSupport::TestCase
   def test_split_filename
     assert_equal ['a', nil],        AttachmentSaver::split_filename('a')
     assert_equal ['a', ''],         AttachmentSaver::split_filename('a.')

data/test/file_system_datastore_test.rb

@@ -1,8 +1,8 @@
 require File.expand_path(File.join(File.dirname(__FILE__), 'test_helper'))
-require 'mocha'
+require 'mocha/test_unit'
 require 'datastores/file_system'
 
-class FileSystemDatastoreTest < Test::Unit::TestCase
+class FileSystemDatastoreTest < ActiveSupport::TestCase
   attr_accessor :storage_key, :original_filename, :content_type
   
   DEFAULT_ATTACHMENT_OPTIONS = {:storage_directory => File.join(TEST_TEMP_DIR, 'fs_store_test'),
@@ -151,6 +151,8 @@ class FileSystemDatastoreTest < Test::Unit::TestCase
       save_attachment_to_test(data)
       save_test_independent_files(file, data)
     end
+  ensure
+    FileUtils.unstub(:ln)
   end
   
   

data/test/image_fixtures.rb

@@ -60,6 +60,14 @@ class ImageFixtures
       :expected_extension => 'js' }
   end
   
+  def self.exploit_file
+    { :path => fixture_path('ssrf.png'), # actually a .mvg file
+      :content_type => 'image/png',
+      :original_filename => 'ssrf.png',
+      :expected_content_type => 'application/octet-stream',
+      :expected_extension => 'mvg' }
+  end
+
   def self.all_readable
     [valid, wrong_extension, no_extension, empty_extension]
   end

data/test/image_processor_test.rb

@@ -1,9 +1,9 @@
 require File.expand_path(File.join(File.dirname(__FILE__), 'test_helper'))
-require 'mocha'
+require 'mocha/test_unit'
 require 'processors/image'
 require File.expand_path(File.join(File.dirname(__FILE__), 'image_operations'))
 
-class ImageProcessorTest < Test::Unit::TestCase
+class ImageProcessorTest < ActiveSupport::TestCase
   class SomeModel
     include AttachmentSaver::Processors::Image
     
@@ -16,6 +16,7 @@ class ImageProcessorTest < Test::Unit::TestCase
   end
   
   def test_image?
+    SomeModel.attachment_options = {}
     [nil, '', '/', 'foo', 'foo/' '/bar', 'text/plain', 'x-image/invalid', 'image-x/invalid'].each do |mime|
       assert_equal false, SomeModel.new(mime).image?
     end
@@ -36,30 +37,32 @@ class ImageProcessorTest < Test::Unit::TestCase
   end
   
   def test_before_validate_attachment
-    model_without_upload = SomeModel.new('application/octet-stream') # note the content type doesn't have to be an image for examine_attachment to be called, since examine_attachment is supposed to fix up incorrect client-supplied content-types
+    SomeModel.attachment_options = {}
+    model_without_upload = SomeModel.new('application/octet-stream') # note the content type doesn't have to be an image for examine_image to be called, since examine_image is supposed to fix up incorrect client-supplied content-types
     model_without_upload.expects(:uploaded_file).times(1).returns(nil)
-    model_without_upload.expects(:examine_attachment).times(0)
+    model_without_upload.expects(:examine_image).times(0)
     model_without_upload.before_validate_attachment
     
     model_with_upload = SomeModel.new('application/octet-stream')
-    model_with_upload.expects(:uploaded_file).times(1).returns('dummy')
-    model_with_upload.expects(:examine_attachment).times(1)
+    model_with_upload.expects(:uploaded_file).at_least(:once).returns(StringIO.new('dummy'))
+    model_with_upload.expects(:examine_image).times(1)
     model_with_upload.before_validate_attachment
     
     model_with_non_image_upload = SomeModel.new('text/plain')
-    model_with_non_image_upload.expects(:uploaded_file).times(1).returns('dummy')
-    model_with_non_image_upload.expects(:examine_attachment).times(1).raises(ImageProcessorError)
+    model_with_non_image_upload.expects(:uploaded_file).at_least(:once).returns(StringIO.new('dummy'))
+    model_with_non_image_upload.expects(:examine_image).times(1).raises(ImageProcessorError)
     model_with_non_image_upload.before_validate_attachment
     assert_equal 'text/plain', model_with_non_image_upload.content_type
     
     model_with_mislabelled_non_image_upload = SomeModel.new('image/png')
-    model_with_mislabelled_non_image_upload.expects(:uploaded_file).times(1).returns('dummy')
-    model_with_mislabelled_non_image_upload.expects(:examine_attachment).times(1).raises(ImageProcessorError)
+    model_with_mislabelled_non_image_upload.expects(:uploaded_file).at_least(:once).returns(StringIO.new('dummy'))
+    model_with_mislabelled_non_image_upload.expects(:examine_image).times(1).raises(ImageProcessorError)
     model_with_mislabelled_non_image_upload.before_validate_attachment
     assert_equal 'application/octet-stream', model_with_mislabelled_non_image_upload.content_type
   end
   
   def test_from_geometry_string
+    SomeModel.attachment_options = {}
     ImageOperations::geometry_strings.each do |geometry, expected_result|
       assert_equal expected_result, AttachmentSaver::Processors::Image.from_geometry_string(geometry), "geometry parse of #{geometry} produced incorrect results"
     end

data/test/image_processor_test_common.rb

@@ -8,6 +8,7 @@ module ImageProcessorTestModel
   
   def self.included(base)
     base.cattr_accessor :attachment_options
+    base.attachment_options = {}
   end
   
   def initialize(uploaded_data)
@@ -36,7 +37,7 @@ module ImageProcessorTests
       model = processor_model.new(File.open(fixture[:path], 'rb'))
       model.content_type = fixture[:content_type]
       model.original_filename = fixture[:original_filename]
-      model.examine_attachment
+      model.examine_image
       assert_equal fixture[:expected_content_type], model.content_type
       assert_equal fixture[:width], model.width
       assert_equal fixture[:height], model.height
@@ -50,7 +51,7 @@ module ImageProcessorTests
     ImageFixtures.all_unreadable.each do |fixture|
       model = processor_model.new(File.open(fixture[:path], 'rb'))
       model.content_type = fixture[:content_type]
-      assert_raises(processor_exception) { model.examine_attachment }
+      assert_raises(processor_exception) { model.examine_image }
       assert_equal fixture[:expected_content_type], model.content_type
       assert_equal nil, model.width
       assert_equal nil, model.height
@@ -61,6 +62,15 @@ module ImageProcessorTests
     end
   end
   
+  def test_image_exploits
+    processor_model.attachment_options = {:valid_image_types => %w(image/png image/jpeg)}
+
+    model = processor_model.new(File.open(ImageFixtures.fixture_path('ssrf.png'), 'rb')) # actually a .mvg file
+    model.expects(:examine_attachment).times(0) # don't invoke the potentially vulnerable image processor code
+    model.before_validate_attachment
+    assert_not_equal 'image/png', model.content_type
+  end
+
   def test_derived_attributes_from_valid
     processor_model.attachment_options = {:formats => ImageOperations.resize_operations}
 

data/test/image_science_processor_test.rb

@@ -1,7 +1,7 @@
 require File.expand_path(File.join(File.dirname(__FILE__), 'image_processor_test_common'))
 require 'processors/image_science'
 
-class ImageScienceProcessorTest < Test::Unit::TestCase
+class ImageScienceProcessorTest < ActiveSupport::TestCase
   class ImageScienceTestModel
     include AttachmentSaver::InstanceMethods
     include AttachmentSaver::Processors::ImageScience

data/test/in_column_datastore_test.rb

@@ -1,8 +1,8 @@
 require File.expand_path(File.join(File.dirname(__FILE__), 'test_helper'))
-require 'mocha'
+require 'mocha/test_unit'
 require 'datastores/in_column'
 
-class InColumnDatastoreTest < Test::Unit::TestCase
+class InColumnDatastoreTest < ActiveSupport::TestCase
   attr_accessor :data, :original_filename, :content_type
   
   DEFAULT_ATTACHMENT_OPTIONS = {}

data/test/mini_magick_processor_test.rb

@@ -1,7 +1,7 @@
 require File.expand_path(File.join(File.dirname(__FILE__), 'image_processor_test_common'))
 require 'processors/mini_magick'
 
-class MiniMagickProcessorTest < Test::Unit::TestCase
+class MiniMagickProcessorTest < ActiveSupport::TestCase
   class MiniMagickTestModel
     include AttachmentSaver::InstanceMethods
     include AttachmentSaver::Processors::MiniMagick

data/test/model_test.rb

@@ -28,7 +28,7 @@ class Unprocessed < ActiveRecord::Base
 end
 
 class LoadedImage < ActiveRecord::Base
-  set_table_name 'images'
+  self.table_name = 'images'
   saves_attachment :processor => 'image_science' # don't create any derived images, but still process the image to get the attributes
 end
 
@@ -38,21 +38,21 @@ class AllInOneTableImages < ActiveRecord::Base
 end
 
 class ImageScienceImage < ActiveRecord::Base
-  set_table_name 'images'
+  self.table_name = 'images'
   saves_attachment :processor => 'ImageScience', :formats => {:small => '200x200'}
 end
 
 class RMagickImage < ActiveRecord::Base
-  set_table_name 'images'
+  self.table_name = 'images'
   saves_attachment :processor => 'RMagick', :formats => {:small => '200x200'}
 end
 
 class MiniMagickImage < ActiveRecord::Base
-  set_table_name 'images'
+  self.table_name = 'images'
   saves_attachment :processor => 'RMagick', :formats => {:small => '200x200'}
 end
 
-class ModelTest < Test::Unit::TestCase
+class ModelTest < ActiveSupport::TestCase
   module ValidUploadedFileAttributes
     def fixture=(value)
       @fixture = value

data/test/rmagick_processor_test.rb

@@ -1,7 +1,7 @@
 require File.expand_path(File.join(File.dirname(__FILE__), 'image_processor_test_common'))
 require 'processors/r_magick'
 
-class RMagickProcessorTest < Test::Unit::TestCase
+class RMagickProcessorTest < ActiveSupport::TestCase
   class RMagickTestModel
     include AttachmentSaver::InstanceMethods
     include AttachmentSaver::Processors::RMagick

data/test/test_helper.rb

@@ -7,17 +7,16 @@ end
 gem 'activesupport', ENV['RAILS_VERSION']
 gem 'activerecord',  ENV['RAILS_VERSION']
 
-require 'test/unit'
+require 'minitest/autorun'
 require 'active_support'
 require 'active_support/test_case'
 require 'active_record'
 require 'active_record/fixtures'
 
 begin
-  require 'ruby-debug'
-  Debugger.start
+  require 'byebug'
 rescue LoadError
-  # ruby-debug not installed, no debugging for you
+  # no debugging for you
 end
 
 RAILS_ROOT = File.dirname(__FILE__)
@@ -42,8 +41,6 @@ load(File.join(File.dirname(__FILE__), "/schema.rb"))
 
 require File.expand_path(File.join(File.dirname(__FILE__), '../init')) # load the plugin
 
-at_exit do # at_exits are run in reverse of declaration order, and Test::Unit runs from an at_exit, so we must declare ours before that require below
+at_exit do
   FileUtils.rm_rf(File.join(File.dirname(__FILE__), 'tmp'))
 end
-
-require 'test/unit'

metadata

@@ -1,97 +1,111 @@
 --- !ruby/object:Gem::Specification
 name: attachment_saver
 version: !ruby/object:Gem::Version
-  version: 1.0.1
+  version: 1.1.0
 platform: ruby
 authors:
 - Will Bryant
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-05-21 00:00:00.000000000 Z
+date: 2016-05-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: mimemagic
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: image_science
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: rmagick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: mini_magick
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '>='
+    - - ">="
       - !ruby/object:Gem::Version
         version: '0'
 description: |
@@ -103,19 +117,12 @@ description: |
   broken uploads leaving incomplete or corrupt data.
 
   RMagick, MiniMagick, and ImageScience image processors are supported.
-
-
-  Compatibility
-  =============
-
-  Currently tested against Rails 3.2.13 and 3.1.8, on Ruby 1.8.7 and 2.0.0p0.
-  Was also tested compatible with 2.3.14 and 3.0.17.
 email: will.bryant@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- .gitignore
+- ".gitignore"
 - MIT-LICENSE
 - README
 - Rakefile
@@ -127,7 +134,6 @@ files:
 - lib/datastores/file_system.rb
 - lib/datastores/in_column.rb
 - lib/misc/extended_tempfile.rb
-- lib/misc/file_size.rb
 - lib/misc/image_science_extensions.rb
 - lib/misc/mini_magick_extensions.rb
 - lib/processors/image.rb
@@ -156,7 +162,8 @@ files:
 - test/schema.rb
 - test/test_helper.rb
 homepage: http://github.com/willbryant/attachment_saver
-licenses: []
+licenses:
+- MIT
 metadata: {}
 post_install_message: 
 rdoc_options: []
@@ -164,17 +171,17 @@ require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>='
+  - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.2
+rubygems_version: 2.2.5
 signing_key: 
 specification_version: 4
 summary: Saves attachments in files, models, or columns.

data/lib/misc/file_size.rb

@@ -1,5 +0,0 @@
-class File
-  def size # for compatibility with StringIO & Tempfile
-    stat.size
-  end
-end