carrierwave-bombshelter 0.1.1.6 → 0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ddc7a42dec427229cd79adddd0c03ad8bf33e41c
-  data.tar.gz: 9693a53421f74da194e5462723a8ccedb9bec55f
+  metadata.gz: f7c3a39b71c781524915e471ed4e30b5bd2537b7
+  data.tar.gz: 7a5da68b7018a758449334c576c774c404b61c41
 SHA512:
-  metadata.gz: c5f9d4ac7e4746b93da1b9468d7af7d96d69abced9dbb2c75ebf6e28e9636f28dce9cdff020f8601191c0a382b0cf2a90a12a6d17ac1206f0db5dd6afea5e52d
-  data.tar.gz: 2352d890f35459d9e952a364ea38952a54ffb3d84ced7d71c1420d6b1e7f775a46e991f9c0a79119f65305829cf2901e8019d6afa1289159ecc58d3825536f7b
+  metadata.gz: bd06151492894cc3b0a32220e6cba3004563a60b0183b54d720f7d0a1965e921fd1f0b16b7d3fefb35e58bc45161fd7275a38ec8a4ee4859a33b1cc25cf4d9f8
+  data.tar.gz: 4154b8f5264f7fad9830b61ed9c814baf767bd76a256ed2c660a17f904225e967976b84a37b70d487a5aaecffc2059835567783a5a6bb8d90b71fe30a166903a

data/README.md

@@ -2,7 +2,7 @@
 
 [![Build Status](https://travis-ci.org/DarthSim/carrierwave-bombshelter.svg)](https://travis-ci.org/DarthSim/carrierwave-bombshelter)
 
-BombShelter is a module which protects your uploaders from [image bombs](https://www.bamsoftware.com/hacks/deflate.html). It checks pixel dimensions of uploaded image before ImageMagick touches it.
+BombShelter is a module which protects your uploaders from image bombs like [https://www.bamsoftware.com/hacks/deflate.html]() and [http://www.openwall.com/lists/oss-security/2016/05/03/18](). It checks type and pixel dimensions of uploaded image before ImageMagick touches it.
 
 <a href="https://evilmartians.com/">
 <img src="https://evilmartians.com/badges/sponsored-by-evil-martians.svg" alt="Sponsored by Evil Martians" width="236" height="54">
@@ -10,7 +10,7 @@ BombShelter is a module which protects your uploaders from [image bombs](https:/
 
 ## How it works
 
-BombShelter uses [fastimage](https://github.com/sdsykes/fastimage) gem, which reads just a header of an image to get info about it. BombShelter compares pixel dimensions of the uploaded image with maximum allowed ones and raises integrity error if image is too big. Works perfectly with ActiveRecord validators.
+BombShelter uses [fastimage](https://github.com/sdsykes/fastimage) gem, which reads just a header of an image to get info about it. BombShelter compares type and pixel dimensions of the uploaded image with allowed ones and raises integrity error if image is too big or have unsupported type. Works perfectly with ActiveRecord validators.
 
 ## Installation
 
@@ -38,7 +38,23 @@ class YourUploader < CarrierWave::Uploader::Base
 end
 ```
 
-By default BombShelter sets maximum allowed dimensions to 4096x4096, but you can set your own ones by defining `max_pixel_dimensions` method:
+You can change allowed image types by defining `image_type_whitelist` method (default are `[:jpeg, :png, :gif]`):
+
+```ruby
+class YourUploader < CarrierWave::Uploader::Base
+  include CarrierWave::BombShelter
+
+  def image_type_whitelist
+    %i(bmp jpeg png gif)
+  end
+end
+```
+
+**Note:** Whitelisted file types should be supported by [fastimage](https://github.com/sdsykes/fastimage).
+
+**Warning:** Allowing `svg` and `mvg` is totally insecure.
+
+You can change maximum allowed dimensions by defining `max_pixel_dimensions` method (default is 4096x4096):
 
 ```ruby
 class YourUploader < CarrierWave::Uploader::Base
@@ -54,6 +70,10 @@ end
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/DarthSim/carrierwave-bombshelter. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the [Contributor Covenant](http://contributor-covenant.org/) code of conduct.
 
+#### Locales
+
+Please don't create PRs that add locales. I can't maintain locales of languages that I don't know, and I can't poke you every time when I need to add a new string.
+
 ## License
 
 The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).

data/lib/carrierwave/bombshelter.rb

@@ -26,6 +26,10 @@ module CarrierWave
       [4096, 4096]
     end
 
+    def image_type_whitelist
+      %i(jpeg png gif)
+    end
+
     private
 
     def protect_from_image_bomb!(new_file)
@@ -35,9 +39,9 @@ module CarrierWave
     end
 
     def check_image_type!(image)
-      return if image.type
+      return if image.type && image_type_whitelist.include?(image.type)
       raise CarrierWave::IntegrityError,
-            I18n.translate(:'errors.messages.not_image')
+            I18n.translate(:'errors.messages.unsupported_image_type')
     end
 
     def check_pixel_dimensions!(image)

data/lib/carrierwave/bombshelter/version.rb

@@ -1,5 +1,5 @@
 module CarrierWave
   module BombShelter
-    VERSION = '0.1.1.6'.freeze
+    VERSION = '0.2'.freeze
   end
 end

data/lib/locale/en.yml

@@ -2,4 +2,4 @@ en:
   errors:
     messages:
       pixel_dimensions_error: "Image size should be less than or equal to %{x_size}x%{y_size}"
-      not_image: "File is not an image"
+      unsupported_image_type: "Image has an unsupported type"

data/lib/locale/ru.yml

@@ -2,4 +2,4 @@ ru:
   errors:
     messages:
       pixel_dimensions_error: "Изображение не должно превышать размера %{x_size}x%{y_size}"
-      not_image: "Файл не является изображением"
+      unsupported_image_type: "Изображение имеет неподдерживаемый тип"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: carrierwave-bombshelter
 version: !ruby/object:Gem::Version
-  version: 0.1.1.6
+  version: '0.2'
 platform: ruby
 authors:
 - DarthSim
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2016-04-12 00:00:00.000000000 Z
+date: 2016-05-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -126,10 +126,7 @@ files:
 - lib/carrierwave/bombshelter.rb
 - lib/carrierwave/bombshelter/version.rb
 - lib/locale/en.yml
-- lib/locale/fr.yml
 - lib/locale/ru.yml
-- lib/locale/tr.yml
-- lib/locale/zh-TW.yml
 homepage: https://github.com/DarthSim/carrierwave-bombshelter
 licenses:
 - MIT
@@ -155,3 +152,4 @@ signing_key:
 specification_version: 4
 summary: Protect your carrierwave from image bombs
 test_files: []
+has_rdoc: 

data/lib/locale/fr.yml

@@ -1,5 +0,0 @@
-fr:
-  errors:
-    messages:
-      pixel_dimensions_error: "La taille de l'image doit être inférieure ou égale à %{x_size}x%{y_size}"
-      not_image: "Ce fichier n'est pas une image"

data/lib/locale/tr.yml

@@ -1,5 +0,0 @@
-tr:
-  errors:
-    messages:
-      pixel_dimensions_error: "Görüntü boyutu %{x_size}x%{y_size} ölçüsüne eşit ya da daha küçük olmalıdır"
-      not_image: "Bir görüntü dosyası değil"

data/lib/locale/zh-TW.yml

@@ -1,5 +0,0 @@
-zh-TW:
-  errors:
-    messages:
-      pixel_dimensions_error: "圖片大小必須小於等於%{x_size}x%{y_size}"
-      not_image: "檔案不是圖片"