camaleon_cms 2.9.2 → 2.9.4

data/lib/camaleon_cms/uploader_path_security.rb

@@ -0,0 +1,146 @@
+# frozen_string_literal: true
+
+require 'addressable/uri'
+
+module CamaleonCms
+  # Shared helpers that keep file-upload path handling in a single place so the
+  # canonicalization guard and same-site URL detection cannot drift between
+  # RuntimeUploaderConcern and UploaderHelper (which both include this module).
+  module UploaderPathSecurity
+    # Canonicalizes a string path and verifies it stays within the allowed upload
+    # roots (the Rails public dir or the system tmp dir). Returns the expanded path
+    # when valid, or nil when the path escapes the roots or is otherwise hostile
+    # (null bytes, nil).
+    #
+    # `extra_roots` widens the set for this call only, so trusted application code
+    # (plugins, jobs, imports) can stage files elsewhere. It MUST come from
+    # application code or operator configuration — never from a request parameter,
+    # since Admin::MediaController#crop feeds params[:cp_img_path] into this check and
+    # the default roots are what stop it reading arbitrary files.
+    def cama_canonical_upload_path(path, extra_roots: [])
+      expanded = File.expand_path(path)
+      roots = cama_allowed_upload_roots(extra_roots)
+      return expanded if roots.any? { |r| expanded == r || expanded.start_with?(r + File::SEPARATOR) }
+
+      nil
+    rescue ArgumentError, TypeError
+      nil
+    end
+
+    # The default roots plus any caller-supplied ones, and the private-media directory
+    # while the uploader is in private mode (so private files can be cropped without
+    # widening the roots for anything else).
+    def cama_allowed_upload_roots(extra_roots = [])
+      roots = [Rails.public_path.to_s, Dir.tmpdir]
+      roots << cama_private_upload_root if cama_private_upload_mode?
+      roots.concat(Array.wrap(extra_roots).compact_blank.map { |r| File.expand_path(r.to_s) })
+      roots.compact_blank
+    end
+
+    def cama_private_upload_root
+      Rails.root.join(CamaleonCmsUploader::PRIVATE_DIRECTORY).to_s
+    end
+
+    def cama_private_upload_mode?
+      respond_to?(:cama_uploader, true) && cama_uploader.try(:is_private_uploader?).present?
+    rescue StandardError
+      false
+    end
+
+    # Reads a caller-supplied root list off an options hash, accepting either key
+    # form. Only application code populates this; see cama_canonical_upload_path.
+    def cama_extra_upload_roots(options)
+      opts = options.try(:to_h) || {}
+      Array.wrap(opts[:allowed_roots] || opts['allowed_roots'])
+    end
+
+    # Removes a staged upload file, but only after confirming it canonicalizes
+    # inside the given staging root. A bug in the calling code therefore cannot
+    # turn into a deletion elsewhere on the filesystem. Returns true when a file
+    # was removed.
+    def cama_purge_staged_file(path, root)
+      return false if path.blank? || root.blank?
+      return false unless path_within?(path, root)
+
+      FileUtils.rm_f(path)
+      true
+    rescue ArgumentError, TypeError
+      false
+    end
+
+    # Upper bound on the decoded byte size of a base64 payload, computed without
+    # decoding it, so an oversized upload can be rejected before it is allocated.
+    # Overestimates by at most two bytes (padding), erring toward rejecting early.
+    def cama_base64_decoded_size(payload)
+      payload.to_s.bytesize * 3 / 4
+    end
+
+    # Passes an upload error through untouched, first removing the staging file when
+    # this upload owns it (remove_source), so a rejected upload leaves nothing behind
+    # in the web-served public/tmp directory. Shared so the cleanup rule cannot drift
+    # between RuntimeUploaderConcern and UploaderHelper.
+    def cama_upload_failure(error, uploaded_io, settings)
+      # The first (malicious-content) rejection in upload_file runs before settings are
+      # deep-symbolized, so honor a string-keyed remove_source too — otherwise a rejected upload
+      # owning its staging file leaks it in the web-served public/tmp directory.
+      remove_source = settings[:remove_source] || settings['remove_source']
+      return error unless remove_source
+
+      cama_purge_staged_file(uploaded_io.try(:path), File.join(Rails.public_path, 'tmp').to_s)
+      error
+    end
+
+    # True when the canonicalized path stays strictly inside the given root
+    # directory. Used as a defense-in-depth check around write sinks.
+    def path_within?(path, root)
+      File.expand_path(path).start_with?("#{File.expand_path(root)}#{File::SEPARATOR}")
+    rescue ArgumentError, TypeError
+      false
+    end
+
+    def same_site_url?(url, site)
+      uri = Addressable::URI.parse(url)
+      site_uri = Addressable::URI.parse(site.the_url(locale: nil))
+      same_host?(uri.host, site_uri.host) && uri.inferred_port == site_uri.inferred_port
+    rescue Addressable::URI::InvalidURIError
+      false
+    end
+
+    # Case-insensitive host comparison that also ignores a single trailing dot, so
+    # a fully-qualified form ("site.com.") still matches the site host ("site.com")
+    # instead of being classified as a remote host — which would trigger a needless
+    # (and re-validated) outbound fetch to the site itself.
+    def same_host?(host_a, host_b)
+      return false if host_a.blank? || host_b.blank?
+
+      host_a.downcase.chomp('.') == host_b.downcase.chomp('.')
+    end
+
+    def site_url_path(url, site)
+      uri = Addressable::URI.parse(url)
+      path = uri.path.to_s
+      # Strip the site's mount subpath (relative_url_root), if any, so that a
+      # same-site URL under e.g. "http://host/blog/" maps to public/... and not
+      # public/blog/...
+      base = Addressable::URI.parse(site.the_url(locale: nil)).path.to_s.chomp('/')
+      path = path.sub(%r{\A#{Regexp.escape(base)}(?=/|$)}, '') if base.present?
+      strip_locale_prefix(path, site)
+    rescue Addressable::URI::InvalidURIError
+      url
+    end
+
+    # Removes a leading locale segment (e.g. "/es") on multi-language sites. To
+    # avoid mis-stripping a real first directory that merely shares a language
+    # code's name, only strip when the stripped path points at an existing file
+    # under the public dir; otherwise keep the path as-is.
+    def strip_locale_prefix(path, site)
+      langs = site.get_languages
+      return path unless langs.size > 1
+
+      stripped = path.sub(%r{\A/(?:#{Regexp.union(langs.map(&:to_s))})(?=/|$)}, '')
+      return path if stripped == path
+
+      File.exist?(File.expand_path(File.join(Rails.public_path, stripped))) ? stripped : path
+    end
+  end
+end

data/lib/camaleon_cms/uploader_pipeline.rb

@@ -0,0 +1,350 @@
+# frozen_string_literal: true
+
+require 'net/http'
+require 'tempfile'
+
+module CamaleonCms
+  # Staging and persistence pipeline shared by the two uploader entry points:
+  # CamaleonCms::RuntimeUploaderConcern (controllers) and CamaleonCms::UploaderHelper
+  # (views, ActiveJobs, standalone objects). Both include this module, so a fix to
+  # upload staging or persistence cannot land in one entry point and not the other.
+  #
+  # Nothing here may read request state such as `params`: UploaderHelper is documented
+  # in config/initializers/custom_initializers.rb as includable from an ActiveJob, where
+  # no request exists. Context differences go through the message seam at the bottom.
+  module UploaderPipeline
+    # upload a file into server
+    # settings:
+    #   folder: Directory where the file will be saved (default: "")
+    #     sample: temporal => will save in /rails_path/public/temporal
+    #   generate_thumb: true, # generate thumb image if this is image format (default true)
+    #   maximum: maximum bytes permitted to upload (default: 1000MG)
+    #   dimension: dimension for the image (sample: 30x30 | x30 | 30x | 300x300?)
+    #   formats: extensions permitted, sample: jpg,png,... or generic: images | videos | audios | documents (default *)
+    #   remove_source: Boolean (delete source file after saved if this is true, default false)
+    #   same_name: Boolean (save the file with the same name if defined true, else search for a non used name)
+    #   versions: (String) Create additional multiple versions of the image uploaded,
+    #     sample: '300x300,505x350' ==> Will create two extra images with these dimensions
+    #     sample "test.png", versions: '200x200,450x450' will generate: thumb/test-png_200x200.png, test-png_450x450.png
+    #   thumb_size: String (redefine the dimensions of the thumbnail, sample: '100x100' ==> only for images)
+    #   temporal_time: if great than 0 seconds, then this file will expire (removed) in that time (default: 0)
+    #     To manage jobs, please check https://edgeguides.rubyonrails.org/active_job_basics.html
+    #     Note: if you are using temporal_time, you will need to copy the file to another directory later
+    # sample: upload_file(params[:my_file], {formats: "images", folder: "temporal"})
+    # sample: upload_file(params[:my_file], {formats: "jpg,png,gif,mp3,mp4",
+    #           temporal_time: 10.minutes, maximum: 10.megabytes})
+    def upload_file(uploaded_io, settings = {})
+      cached_name = uploaded_io.is_a?(ActionDispatch::Http::UploadedFile) ? uploaded_io.original_filename : nil
+      return { error: 'File is empty', file: nil, size: nil } if uploaded_io.blank?
+
+      if uploaded_io.is_a?(String) && uploaded_io.match(%r{^https?://}).present? # download url file
+        tmp = cama_tmp_upload(uploaded_io)
+        return tmp if tmp[:error].present?
+
+        settings[:remove_source] = true
+        uploaded_io = tmp[:file_path]
+      end
+      if uploaded_io.is_a?(String)
+        expanded = cama_canonical_upload_path(uploaded_io, extra_roots: cama_extra_upload_roots(settings))
+        return { error: 'Invalid file path' } unless expanded
+
+        uploaded_io = expanded
+      end
+      uploaded_io = File.open(uploaded_io) if uploaded_io.is_a?(String)
+      if settings[:dimension].present?
+        uploaded_io = File.open(cama_resize_upload(uploaded_io.path, settings[:dimension]))
+      end
+
+      # Permission first: a trusted upload never reads the file in order to scan it.
+      if !cama_trusted_for_unfiltered_upload? && file_content_unsafe?(uploaded_io)
+        return cama_upload_failure({ error: 'Potentially malicious content found!' }, uploaded_io, settings)
+      end
+
+      settings = settings.to_h.deep_symbolize_keys
+      settings[:uploaded_io] = uploaded_io
+      settings = {
+        folder: '',
+        maximum: current_site.get_option('filesystem_max_size', 100).to_f.megabytes,
+        formats: '*',
+        generate_thumb: true,
+        temporal_time: 0,
+        filename: begin
+          cached_name || uploaded_io.original_filename
+        rescue StandardError
+          uploaded_io.path.split('/').last
+        end.cama_fix_filename,
+        file_size: File.size(uploaded_io.to_io),
+        remove_source: false,
+        same_name: false,
+        versions: '',
+        thumb_size: nil
+      }.merge!(settings)
+      settings[:formats] = '*' if settings[:formats].nil?
+      settings[:folder] = '' if settings[:folder].nil? # e.g. crop_url passes no folder
+      io_before_hook = settings[:uploaded_io]
+      hooks_run('before_upload', settings)
+
+      # A before_upload handler may rebind settings[:uploaded_io] to bytes the top-of-method
+      # scan never saw (e.g. an image optimizer rewriting an SVG). For an untrusted uploader,
+      # re-scan the substituted IO so a handler cannot launder a blocked payload past the scan.
+      # Keyed on object identity: an unchanged IO was already scanned, and a permission-holder
+      # is exempt exactly as above.
+      if !settings[:uploaded_io].equal?(io_before_hook) && !cama_trusted_for_unfiltered_upload? &&
+         file_content_unsafe?(settings[:uploaded_io])
+        return cama_upload_failure({ error: 'Potentially malicious content found!' }, settings[:uploaded_io], settings)
+      end
+
+      # guard against path traversal
+      unless cama_uploader.valid_folder_path?(settings[:folder])
+        return cama_upload_failure({ error: 'Invalid file path' }, uploaded_io, settings)
+      end
+
+      # formats validations
+      err = validate_file_format_or_error(uploaded_io.path, settings[:formats])
+      return cama_upload_failure(err, uploaded_io, settings) if err
+
+      # file size validations
+      err = cama_size_limit_error(settings[:file_size], settings[:maximum])
+      return cama_upload_failure(err, uploaded_io, settings) if err
+
+      # save file
+      key = File.join(settings[:folder], settings[:filename]).to_s.cama_fix_slash
+      res = cama_uploader.add_file(settings[:uploaded_io], key, { same_name: settings[:same_name] })
+
+      # generate image versions
+      if res['file_type'] == 'image'
+        settings[:versions].to_s.delete(' ').split(',').each do |v|
+          version_path = cama_resize_upload(settings[:uploaded_io].path, v, { replace: false })
+          cama_uploader.add_file(version_path, cama_uploader.version_path(res['key'], v), is_thumb: true,
+                                                                                          same_name: true)
+          FileUtils.rm_f(version_path)
+        end
+      end
+
+      # generate thumb
+      if settings[:generate_thumb] && res['thumb'].present?
+        cama_uploader_generate_thumbnail(uploaded_io.path, res['key'], settings[:thumb_size],
+                                         settings[:remove_source])
+      end
+      FileUtils.rm_f(uploaded_io.path) if settings[:remove_source] && File.exist?(uploaded_io.path)
+
+      hooks_run('after_upload', settings)
+
+      # temporal file upload (always put as local for temporal files)
+      CamaleonCmsUploader.delete_block.call(settings, cama_uploader, key) if settings[:temporal_time] > 0
+
+      res
+    end
+
+    # upload tmp file
+    # support for url and local path
+    # sample:
+    # cama_tmp_upload('https://camaleon.website/media/132/logo2.png')  ==> /var/rails/my_project/public/tmp/1/logo2.png
+    # cama_tmp_upload('/var/www/media/132/logo 2.png')  ==> /var/rails/my_project/public/tmp/1/logo-2.png
+    # accept args:
+    #   name: to indicate the name to use,
+    #     sample: cama_tmp_upload('/var/www/media/132/logo 2.png', {name: 'owen.png', formats: 'images'})
+    #   formats: extensions permitted, sample: jpg,png,... or generic: images | videos | audios | documents (default *)
+    #   dimension: 20x30
+    # return: {file_path, error}
+    def cama_tmp_upload(uploaded_io, args = {})
+      tmp_path = args[:path] || File.join(Rails.public_path, 'tmp', current_site.id.to_s).to_s
+      FileUtils.mkdir_p(tmp_path)
+      # Default to the site limit so the size guard below actually applies: callers
+      # such as crop/crop_url pass no :maximum, which left it dead code.
+      args[:maximum] ||= current_site.get_option('filesystem_max_size', 100).to_f.megabytes
+      saved = false
+      downloaded_tmp_file = nil
+      staged_path = nil
+      if uploaded_io.is_a?(String) && uploaded_io.start_with?('data:') # create tmp file using base64 format
+        path, err = cama_stage_data_uri(uploaded_io, args, tmp_path)
+        return err if err
+
+        staged_path = path
+        _tmp_name = File.basename(args[:name].to_s)
+        uploaded_io = File.open(path)
+        saved = true
+      elsif uploaded_io.is_a?(String) && uploaded_io.start_with?('http://', 'https://')
+        err = validate_file_format_or_error(uploaded_io, args[:formats])
+        return err if err
+
+        if same_site_url?(uploaded_io, current_site)
+          uploaded_io = File.join(Rails.public_path, site_url_path(uploaded_io, current_site)).to_s
+        else
+          remote_file = cama_download_remote_file(uploaded_io)
+          return remote_file if remote_file[:error].present?
+
+          downloaded_tmp_file = remote_file[:file]
+          uploaded_io = downloaded_tmp_file
+        end
+        _tmp_name = if uploaded_io.is_a?(String)
+                      uploaded_io.split('/').last.split('?').first
+                    else
+                      uploaded_io.path.split('/').last
+                    end
+        args[:name] = args[:name] || _tmp_name
+      end
+      if uploaded_io.is_a?(String)
+        expanded = cama_canonical_upload_path(uploaded_io, extra_roots: cama_extra_upload_roots(args))
+        return { error: 'Invalid file path' } unless expanded
+
+        uploaded_io = expanded
+      end
+      uploaded_io = File.open(uploaded_io) if uploaded_io.is_a?(String)
+      err = validate_file_format_or_error(_tmp_name || uploaded_io.path, args[:formats])
+      return err if err
+
+      actual_size = begin
+        uploaded_io.size
+      rescue StandardError
+        File.size(uploaded_io)
+      end
+      err = cama_size_limit_error(actual_size, args[:maximum])
+      return err if err
+
+      name = args[:name] || uploaded_io&.original_filename || uploaded_io.path.split('/').last
+      name = "#{File.basename(name, File.extname(name)).parameterize}#{File.extname(name)}"
+      path ||= uploader_verify_name(File.join(tmp_path, name))
+      unless saved
+        # Same rule as the data: branch above -- read, scan, and only then write, so no
+        # source can land unscanned in public/tmp. The scan is keyed on `name`, the output
+        # filename, because that is the extension the web server will serve the bytes under;
+        # only the uploader's permission decides whether it runs.
+        content = uploaded_io.read
+        if !cama_trusted_for_unfiltered_upload? && content_unsafe?(content, filename: name)
+          return { error: 'Potentially malicious content found!' }
+        end
+
+        File.open(path, 'wb') { |f| f.write(content) }
+        staged_path = path
+      end
+      path = cama_resize_upload(path, args[:dimension]) if args[:dimension].present?
+      { file_path: path, error: nil }
+    rescue StandardError
+      # A raised error leaves no half-written file behind in the served staging dir.
+      cama_purge_staged_file(staged_path, tmp_path)
+      raise
+    ensure
+      downloaded_tmp_file&.close!
+    end
+
+    # Message seam. Rendering user-facing upload errors differs by execution context,
+    # so the pipeline never calls a translator directly.
+    #
+    # `ct` runs the `on_translation` hook that lets plugins override the text, which a
+    # shared I18n.t call would silently drop. CamaleonCms::UploaderHelper overrides all
+    # three to route through `ct` / `cama_t` / `number_to_human_size` (it includes
+    # CamaleonHelper itself). CamaleonCms::RuntimeUploaderConcern overrides only
+    # cama_uploader_ct, routing through `ct` when its host has one — true for
+    # CamaleonCms::CamaleonController since #1223 restored CamaleonHelper there. The
+    # defaults below are what remains: `t`/`human_size` on the concern path, and all
+    # three for concern hosts without `ct` (ActiveJobs, standalone objects).
+    def cama_uploader_ct(key, args = {})
+      I18n.t("camaleon_cms.common.#{key}", **args)
+    end
+
+    def cama_uploader_t(key, args = {})
+      I18n.t(key, **args)
+    end
+
+    def cama_uploader_human_size(bytes)
+      ActiveSupport::NumberHelper.number_to_human_size(bytes)
+    end
+
+    private
+
+    # Download remote files with SSRF guardrails: validate host/IP and reject redirects.
+    # NOTE: UserUrlValidator.validate is intentionally called here even though the
+    # crop_url controller path may have already validated the URL — this ensures
+    # every caller of cama_tmp_upload is protected (defense-in-depth).
+    def cama_download_remote_file(url)
+      validator = UserUrlValidator.new
+      validation_result = validator.validate(url, reject_path_traversal: true)
+      return { error: validation_result.join(', ') } if validation_result.is_a?(Array)
+
+      uri = URI.parse(url)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == 'https'
+      # Pin the socket to the exact IP the validator vetted so a hostname whose DNS
+      # answer changes between the SSRF check and the fetch (DNS rebinding) cannot
+      # redirect the request to an internal address; SNI/cert checks keep the host.
+      http.ipaddr = validator.resolved_ip if validator.resolved_ip
+      http.open_timeout = 10
+      http.read_timeout = 10
+      response = http.start do |conn|
+        conn.request(Net::HTTP::Get.new(uri.request_uri.presence || '/'))
+      end
+
+      return { error: 'Redirects are not allowed for remote uploads.' } if response.is_a?(Net::HTTPRedirection)
+
+      unless response.is_a?(Net::HTTPSuccess)
+        return { error: "Unable to download remote file (HTTP #{response.code})." }
+      end
+
+      # Enforce the site's maximum upload size to prevent memory exhaustion from oversized responses.
+      max_bytes = current_site.get_option('filesystem_max_size', 100).to_f.megabytes
+      body = response.body
+      if body.bytesize > max_bytes
+        return { error: "Remote file too large (max #{ActiveSupport::NumberHelper.number_to_human_size(max_bytes)})." }
+      end
+
+      ext = File.extname(uri.path.to_s)
+      tempfile = Tempfile.new(['cama-upload-url', ext], binmode: true)
+      tempfile.write(body)
+      tempfile.rewind
+      { file: tempfile, error: nil }
+    rescue StandardError => e
+      { error: "Unable to download remote file: #{ERB::Util.html_escape(e.message)}" }
+    end
+
+    def validate_file_format_or_error(file, formats)
+      return if cama_uploader.class.validate_file_format(file, formats)
+
+      { error: "#{cama_uploader_ct('file_format_error')} (#{formats})" }
+    end
+
+    # Stages a base64 data: payload into tmp_path, bounding its size and scanning its
+    # content BEFORE the write, so nothing oversized or hostile ever reaches a path
+    # the web server would hand out. Returns [path, error]; exactly one is non-nil.
+    def cama_stage_data_uri(uploaded_io, args, tmp_path)
+      return [nil, { error: cama_uploader_t('camaleon_cms.admin.media.name_required').to_s }] if args[:name].blank?
+
+      # Strip any directory components so a hostile name (e.g. "../../etc/x")
+      # cannot escape tmp_path when the base64 payload is written below.
+      tmp_name = File.basename(args[:name].to_s)
+      err = validate_file_format_or_error(tmp_name, args[:formats])
+      return [nil, err] if err
+
+      payload = uploaded_io.split(';base64,').last
+      # Bound the payload before decoding, so an oversized upload is never allocated
+      # in full nor written into the served staging directory.
+      err = cama_size_limit_error(cama_base64_decoded_size(payload), args[:maximum])
+      return [nil, err] if err
+
+      # The decoded bytes are already in memory here, so scanning costs no extra copy.
+      decoded = Base64.decode64(payload)
+      if !cama_trusted_for_unfiltered_upload? && content_unsafe?(decoded, filename: tmp_name)
+        return [nil, { error: 'Potentially malicious content found!' }]
+      end
+
+      path = uploader_verify_name(File.join(tmp_path, tmp_name))
+      return [nil, { error: 'Invalid file path' }] unless path_within?(path, tmp_path)
+
+      File.open(path, 'wb') { |f| f.write(decoded) }
+      [path, nil]
+    end
+
+    # Returns an error hash when size exceeds maximum, nil otherwise.
+    # A non-positive maximum means "no limit" — a site whose stored filesystem_max_size is blank
+    # or 0 (also reached by plugin callers passing that option as :maximum) would otherwise fail
+    # every upload with "File size exceeded (0 Bytes)". The size comparison coerces for the same
+    # reason: a caller-supplied :maximum can be a numeric String, and a bare `String >= Integer`
+    # raises instead of enforcing the limit.
+    def cama_size_limit_error(size, maximum)
+      return if maximum.blank? || maximum.to_f <= 0 || maximum.to_f >= size
+
+      max_size = cama_uploader_human_size(maximum)
+      { error: "#{cama_uploader_ct('file_size_exceeded', default: 'File size exceeded')} (#{max_size})" }
+    end
+  end
+end

data/lib/camaleon_cms/uploader_support.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+module CamaleonCms
+  # Uploader backend resolution plus the filename and URL helpers that the staging
+  # and image-processing pipelines build on. Shared by the two uploader entry points,
+  # CamaleonCms::RuntimeUploaderConcern and CamaleonCms::UploaderHelper.
+  module UploaderSupport
+    # return the current uploader
+    def cama_uploader
+      @cama_uploader ||= lambda {
+        thumb = current_site.get_option('filesystem_thumb_size', '100x100').split('x')
+        args = {
+          server: current_site.get_option('filesystem_type', 'local').downcase,
+          thumb: { w: thumb[0], h: thumb[1] },
+          aws_settings: {
+            region: current_site.get_option('filesystem_region', 'us-west-2'),
+            access_key: current_site.get_option('filesystem_s3_access_key'),
+            secret_key: current_site.get_option('filesystem_s3_secret_key'),
+            bucket: current_site.get_option('filesystem_s3_bucket_name'),
+            cloud_front: current_site.get_option('filesystem_s3_cloudfront'),
+            # permit to add your custom attributes for
+            # file_upload https://docs.aws.amazon.com/sdkforruby/api/Aws/S3/Object.html#upload_file-instance_method
+            aws_file_upload_settings: ->(settings) { settings },
+            # permit to read custom attributes from aws file and add to file parsed object
+            aws_file_read_settings: ->(data, _s3_file) { data }
+          },
+          custom_uploader: nil # possibility to use custom file uploader
+        }
+        hooks_run('on_uploader', args)
+        return args[:custom_uploader] if args[:custom_uploader].present?
+
+        base_args = { current_site: current_site, thumb: args[:thumb] }
+        case args[:server]
+        when 's3', 'aws'
+          CamaleonCmsAwsUploader.new(base_args.merge(aws_settings: args[:aws_settings]), self)
+        else
+          CamaleonCmsLocalUploader.new(base_args, self)
+        end
+      }.call
+    end
+
+    # helper to find an available filename for file_path in that directory
+    # sample: uploader_verify_name("/var/www/my_image.jpg")
+    #   return "/var/www/my_image_1.jpg" => if "/var/www/my_image.jpg" exist
+    #   return "/var/www/my_image.jpg" => if "/var/www/my_image.jpg" doesn't exist
+    def uploader_verify_name(file_path)
+      dir = File.dirname(file_path)
+      filename = File.basename(file_path).to_s.cama_fix_filename
+      files = Dir.entries(dir)
+      if files.include?(filename)
+        i = 1
+        _filename = filename
+        while files.include?(_filename)
+          _filename = "#{File.basename(filename, File.extname(filename))}_#{i}#{File.extname(filename)}"
+          i += 1
+        end
+        filename = _filename
+      end
+      "#{File.dirname(file_path)}/#{filename}"
+    end
+
+    # convert downloaded file path into public url
+    def cama_file_path_to_url(file_path)
+      file_path.sub(Rails.public_path.to_s, begin
+        root_url
+      rescue StandardError
+        cama_root_url
+      end)
+    end
+
+    # convert public url to file path
+    def cama_url_to_file_path(url)
+      File.join(Rails.public_path, URI(url.to_s).path)
+    end
+
+    def slugify(val)
+      val.to_s.downcase.strip.tr(' ', '-').gsub(/[^\w-]/, '')
+    end
+
+    def slugify_folder(val)
+      split_folder = val.split('/')
+      split_folder[-1] = slugify(split_folder[-1])
+      split_folder.join('/')
+    end
+  end
+end

data/lib/camaleon_cms/version.rb

@@ -1,3 +1,3 @@
 module CamaleonCms
-  VERSION = '2.9.2'.freeze
+  VERSION = '2.9.4'.freeze
 end

data/lib/camaleon_cms.rb

@@ -1,5 +1,28 @@
 require 'camaleon_cms/engine'
 require 'camaleon_cms/version'
+require 'camaleon_cms/content_security'
+require 'camaleon_cms/unsafe_markup'
+require 'camaleon_cms/svg_content_checker'
+require 'camaleon_cms/media_security_headers'
+require 'camaleon_cms/uploader_content_security'
+require 'camaleon_cms/uploader_path_security'
+require 'camaleon_cms/uploader_pipeline'
+require 'camaleon_cms/uploader_image_processing'
+require 'camaleon_cms/uploader_support'
+require 'camaleon_cms/captcha_image_generation'
+require 'camaleon_cms/task_reporter'
+require 'camaleon_cms/shortcode_registry'
 
 module CamaleonCms
 end
+
+# Declare core's bundled shortcode names through the boot DSL, then mark the registry available. This
+# runs at require time (before any request), so the save-time shortcode gate can detect shortcodes
+# with no frontend request. If this ever raises the registry stays unavailable and the gate fails
+# closed (non-administrators are refused) rather than fail open on an empty set.
+begin
+  CamaleonCms::ShortcodeRegistry.register(*CamaleonCms::ShortcodeRegistry::CORE_SHORTCODES)
+  CamaleonCms::ShortcodeRegistry.mark_available!
+rescue StandardError => e
+  warn("CamaleonCms::ShortcodeRegistry boot registration failed (gate fails closed): #{e.message}")
+end

data/lib/ext/hash.rb

@@ -1,18 +1,44 @@
+require 'cgi'
+
 class Hash
+  # Attribute names are emitted verbatim, so they are restricted to a conservative subset of what
+  # HTML allows rather than escaped: escaping cannot help here, because the characters that turn one
+  # name into two (whitespace, `=`, `/`, quotes) are not HTML metacharacters. Covers the forms
+  # actually used - `id`, `class`, `data-*`, `aria-*`, `xml:lang`.
+  CAMA_HTML_ATTR_NAME = /\A[a-zA-Z_:][-a-zA-Z0-9_:.]*\z/
+
   # convert hash to string like class="class val" name='name val'
+  #
+  # Values are escaped for the HTML attribute context, so no value can close its own attribute and
+  # introduce another. `CGI.escapeHTML` is used rather than `ERB::Util.html_escape` deliberately: the
+  # latter is a no-op on an `html_safe` value, which would let a caller pass a string whose quote
+  # survives into the output. Callers of this method are building attribute values, never markup, so
+  # unconditional escaping is the correct contract.
+  #
+  # Pairs whose key is not a valid attribute name are dropped. A key such as `x onfocus=alert(1) y`
+  # would otherwise render as three attributes, so there is no safe way to emit it; anything with a
+  # space in it was already producing malformed markup before this guard existed.
   def to_attr_format(split = ' ')
     res = []
     each do |key, value|
-      res << "#{key} = \"#{value.to_s.gsub('"', '\"')}\""
+      next unless key.to_s.match?(CAMA_HTML_ATTR_NAME)
+
+      res << "#{key} = \"#{CGI.escapeHTML(value.to_s)}\""
     end
     res.join(split)
   end
 
   # convert hash to attributes for url_path
+  #
+  # Emits a Ruby fragment (`:key => "value"`) for code generation, not HTML, so it must NOT use the
+  # HTML escaper above — entity-encoding would corrupt the generated code. `inspect` produces a
+  # complete, correctly escaped double-quoted literal; the previous hand-rolled escape handled the
+  # quote but not the backslash, so a value like `a\b` became a backspace and `a\"b` produced a
+  # fragment that would not parse.
   def to_attr_url_format
     res = []
     each do |key, value|
-      res << ":#{key} => \"#{value.to_s.gsub('"', '\"')}\""
+      res << ":#{key} => #{value.to_s.inspect}"
     end
     res.join ','
   end