carrierwave 0.11.2 → 1.3.2

data/lib/carrierwave/uploader/cache.rb

@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 module CarrierWave
 
   class FormNotMultipart < UploadError
@@ -54,13 +52,7 @@ module CarrierWave
         # It's recommended that you keep cache files in one place only.
         #
         def clean_cached_files!(seconds=60*60*24)
-          Dir.glob(File.expand_path(File.join(cache_dir, '*'), CarrierWave.root)).each do |dir|
-            time = dir.scan(/(\d+)-\d+-\d+/).first.map { |t| t.to_i }
-            time = Time.at(*time)
-            if time < (Time.now.utc - seconds)
-              FileUtils.rm_rf(dir)
-            end
-          end
+          cache_storage.new(CarrierWave::Uploader::Base.new).clean_cache!(seconds)
         end
       end
 
@@ -89,10 +81,8 @@ module CarrierWave
         _content = file.read
         if _content.is_a?(File) # could be if storage is Fog
           sanitized = CarrierWave::Storage::Fog.new(self).retrieve!(File.basename(_content.path))
-          sanitized.read if sanitized.exists?
-
         else
-          sanitized = SanitizedFile.new :tempfile => StringIO.new(file.read),
+          sanitized = SanitizedFile.new :tempfile => StringIO.new(_content),
             :filename => File.basename(path), :content_type => file.content_type
         end
         sanitized
@@ -127,22 +117,28 @@ module CarrierWave
       #
       def cache!(new_file = sanitized_file)
         new_file = CarrierWave::SanitizedFile.new(new_file)
+        return if new_file.empty?
+
+        raise CarrierWave::FormNotMultipart if new_file.is_path? && ensure_multipart_form
 
-        unless new_file.empty?
-          raise CarrierWave::FormNotMultipart if new_file.is_path? && ensure_multipart_form
+        self.cache_id = CarrierWave.generate_cache_id unless cache_id
 
-          with_callbacks(:cache, new_file) do
-            self.cache_id = CarrierWave.generate_cache_id unless cache_id
+        @filename = new_file.filename
+        self.original_filename = new_file.filename
 
-            @filename = new_file.filename
-            self.original_filename = new_file.filename
+        begin
+          # first, create a workfile on which we perform processings
+          if move_to_cache
+            @file = new_file.move_to(File.expand_path(workfile_path, root), permissions, directory_permissions)
+          else
+            @file = new_file.copy_to(File.expand_path(workfile_path, root), permissions, directory_permissions)
+          end
 
-            if move_to_cache
-              @file = new_file.move_to(cache_path, permissions, directory_permissions)
-            else
-              @file = new_file.copy_to(cache_path, permissions, directory_permissions)
-            end
+          with_callbacks(:cache, @file) do
+            @file = cache_storage.cache!(@file)
           end
+        ensure
+          FileUtils.rm_rf(workfile_path(''))
         end
       end
 
@@ -161,14 +157,29 @@ module CarrierWave
         with_callbacks(:retrieve_from_cache, cache_name) do
           self.cache_id, self.original_filename = cache_name.to_s.split('/', 2)
           @filename = original_filename
-          @file = CarrierWave::SanitizedFile.new(cache_path)
+          @file = cache_storage.retrieve_from_cache!(full_filename(original_filename))
         end
       end
 
+      ##
+      # Calculates the path where the cache file should be stored.
+      #
+      # === Parameters
+      #
+      # [for_file (String)] name of the file <optional>
+      #
+      # === Returns
+      #
+      # [String] the cache path
+      #
+      def cache_path(for_file=full_filename(original_filename))
+        File.join(*[cache_dir, @cache_id, for_file].compact)
+      end
+
     private
 
-      def cache_path
-        File.expand_path(File.join(cache_dir, cache_name), root)
+      def workfile_path(for_file=original_filename)
+        File.join(CarrierWave.tmp_path, @cache_id, version_name.to_s, for_file)
       end
 
       attr_reader :cache_id, :original_filename
@@ -179,7 +190,7 @@ module CarrierWave
       def cache_id=(cache_id)
         # Earlier version used 3 part cache_id. Thus we should allow for
         # the cache_id to have both 3 part and 4 part formats.
-        raise CarrierWave::InvalidParameter, "invalid cache id" unless cache_id =~ /\A[\d]+\-[\d]+(\-[\d]{4})?\-[\d]{4}\z/
+        raise CarrierWave::InvalidParameter, "invalid cache id" unless cache_id =~ /\A(-)?[\d]+\-[\d]+(\-[\d]{4})?\-[\d]{4}\z/
         @cache_id = cache_id
       end
 
@@ -188,6 +199,9 @@ module CarrierWave
         @original_filename = filename
       end
 
+      def cache_storage
+        @cache_storage ||= self.class.cache_storage.new(self)
+      end
     end # Cache
   end # Uploader
 end # CarrierWave

data/lib/carrierwave/uploader/callbacks.rb

@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 module CarrierWave
   module Uploader
     module Callbacks

data/lib/carrierwave/uploader/configuration.rb

@@ -5,7 +5,7 @@ module CarrierWave
       extend ActiveSupport::Concern
 
       included do
-        class_attribute :_storage, :instance_writer => false
+        class_attribute :_storage, :_cache_storage, :instance_writer => false
 
         add_config :root
         add_config :base_path
@@ -23,12 +23,14 @@ module CarrierWave
         add_config :remove_previously_stored_files_after_update
 
         # fog
+        add_config :fog_provider
         add_config :fog_attributes
         add_config :fog_credentials
         add_config :fog_directory
         add_config :fog_public
         add_config :fog_authenticated_url_expiration
         add_config :fog_use_ssl_for_aws
+        add_config :fog_aws_accelerate
 
         # Mounting
         add_config :ignore_integrity_errors
@@ -38,6 +40,7 @@ module CarrierWave
         add_config :validate_processing
         add_config :validate_download
         add_config :mount_on
+        add_config :cache_only
 
         # set default values
         reset_config
@@ -69,36 +72,76 @@ module CarrierWave
         #     storage MyCustomStorageEngine
         #
         def storage(storage = nil)
-          if storage
-            self._storage = storage.is_a?(Symbol) ? eval(storage_engines[storage]) : storage
+          case storage
+          when Symbol
+            if storage_engine = storage_engines[storage]
+              self._storage = eval storage_engine
+            else
+              raise CarrierWave::UnknownStorageError, "Unknown storage: #{storage}"
+            end
+          when nil
+            storage
+          else
+            self._storage = storage
           end
           _storage
         end
         alias_method :storage=, :storage
 
+        ##
+        # Sets the cache storage engine to be used when storing cache files with this uploader.
+        # Same as .storage except for required methods being #cache!(CarrierWave::SanitizedFile),
+        # #retrieve_from_cache! and #delete_dir!.
+        #
+        # === Parameters
+        #
+        # [storage (Symbol, Class)] The cache storage engine to use for this uploader
+        #
+        # === Returns
+        #
+        # [Class] the cache storage engine to be used with this uploader
+        #
+        # === Examples
+        #
+        #     cache_storage :file
+        #     cache_storage CarrierWave::Storage::File
+        #     cache_storage MyCustomStorageEngine
+        #
+        def cache_storage(storage = nil)
+          if storage
+            self._cache_storage = storage.is_a?(Symbol) ? eval(storage_engines[storage]) : storage
+          end
+          _cache_storage
+        end
+        alias_method :cache_storage=, :cache_storage
+
         def add_config(name)
           class_eval <<-RUBY, __FILE__, __LINE__ + 1
+            @#{name} = nil
+
             def self.eager_load_fog(fog_credentials)
               # see #1198. This will hopefully no longer be necessary after fog 2.0
+              require self.fog_provider
+              require 'carrierwave/storage/fog'
               Fog::Storage.new(fog_credentials) if fog_credentials.present?
-            end
+            end unless defined? eager_load_fog
 
             def self.#{name}(value=nil)
               @#{name} = value if value
               eager_load_fog(value) if value && '#{name}' == 'fog_credentials'
               return @#{name} if self.object_id == #{self.object_id} || defined?(@#{name})
               name = superclass.#{name}
-              return nil if name.nil? && !instance_variable_defined?("@#{name}")
+              return nil if name.nil? && !instance_variable_defined?(:@#{name})
               @#{name} = name && !name.is_a?(Module) && !name.is_a?(Symbol) && !name.is_a?(Numeric) && !name.is_a?(TrueClass) && !name.is_a?(FalseClass) ? name.dup : name
             end
 
             def self.#{name}=(value)
-              eager_load_fog(value) if '#{name}' == 'fog_credentials'
+              eager_load_fog(value) if '#{name}' == 'fog_credentials' && value.present?
               @#{name} = value
             end
 
             def #{name}=(value)
-              self.class.eager_load_fog(value) if '#{name}' == 'fog_credentials'
+              self.class.eager_load_fog(value) if '#{name}' == 'fog_credentials' && value.present?
               @#{name} = value
             end
 
@@ -107,7 +150,7 @@ module CarrierWave
               value = self.class.#{name} unless instance_variable_defined?(:@#{name})
               if value.instance_of?(Proc)
                 value.arity >= 1 ? value.call(self) : value.call
-              else 
+              else
                 value
               end
             end
@@ -130,11 +173,14 @@ module CarrierWave
               :fog  => "CarrierWave::Storage::Fog"
             }
             config.storage = :file
+            config.cache_storage = :file
+            config.fog_provider = 'fog'
             config.fog_attributes = {}
             config.fog_credentials = {}
             config.fog_public = true
             config.fog_authenticated_url_expiration = 600
             config.fog_use_ssl_for_aws = true
+            config.fog_aws_accelerate = false
             config.store_dir = 'uploads'
             config.cache_dir = 'uploads/tmp'
             config.delete_tmp_file_after_storage = true
@@ -158,4 +204,3 @@ module CarrierWave
     end
   end
 end
-

data/lib/carrierwave/uploader/content_type_whitelist.rb

@@ -35,7 +35,7 @@ module CarrierWave
       def check_content_type_whitelist!(new_file)
         content_type = new_file.content_type
         if content_type_whitelist && !whitelisted_content_type?(content_type)
-          raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.content_type_whitelist_error", content_type: content_type)
+          raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.content_type_whitelist_error", content_type: content_type, allowed_types: Array(content_type_whitelist).join(", "))
         end
       end
 

data/lib/carrierwave/uploader/default_url.rb

@@ -1,19 +1,17 @@
-# encoding: utf-8
-
 module CarrierWave
   module Uploader
     module DefaultUrl
 
       def url(*args)
-        super || default_url
+        super || default_url(*args)
       end
 
       ##
       # Override this method in your uploader to provide a default url
       # in case no file has been cached/stored yet.
       #
-      def default_url; end
+      def default_url(*args); end
 
     end # DefaultPath
   end # Uploader
-end # CarrierWave
+end # CarrierWave

data/lib/carrierwave/uploader/download.rb

@@ -1,6 +1,5 @@
-# encoding: utf-8
-
 require 'open-uri'
+require 'ssrf_filter'
 
 module CarrierWave
   module Uploader
@@ -12,13 +11,18 @@ module CarrierWave
       include CarrierWave::Uploader::Cache
 
       class RemoteFile
-        def initialize(uri)
+        attr_reader :uri
+
+        def initialize(uri, remote_headers = {}, skip_ssrf_protection: false)
           @uri = uri
+          @remote_headers = remote_headers.reverse_merge('User-Agent' => "CarrierWave/#{CarrierWave::VERSION}")
+          @file, @content_type, @headers = nil
+          @skip_ssrf_protection = skip_ssrf_protection
         end
 
         def original_filename
-          filename = filename_from_header || File.basename(file.base_uri.path)
-          mime_type = MIME::Types[file.content_type].first
+          filename = filename_from_header || filename_from_uri
+          mime_type = MIME::Types[content_type].first
           unless File.extname(filename).present? || mime_type.blank?
             filename = "#{filename}.#{mime_type.extensions.first}"
           end
@@ -33,26 +37,53 @@ module CarrierWave
           @uri.scheme =~ /^https?$/
         end
 
-      private
+        def content_type
+          @content_type || 'application/octet-stream'
+        end
+
+        def headers
+          @headers || {}
+        end
+
+        private
 
         def file
           if @file.blank?
-            @file = Kernel.open(@uri.to_s)
-            @file = @file.is_a?(String) ? StringIO.new(@file) : @file
+            if @skip_ssrf_protection
+              @file = (URI.respond_to?(:open) ? URI : Kernel).open(@uri.to_s, @remote_headers)
+              @file = @file.is_a?(String) ? StringIO.new(@file) : @file
+              @content_type = @file.content_type
+              @headers = @file.meta
+              @uri = @file.base_uri
+            else
+              request = nil
+              response = SsrfFilter.get(@uri, headers: @remote_headers) do |req|
+                request = req
+              end
+              response.value
+              @file = StringIO.new(response.body)
+              @content_type = response.content_type
+              @headers = response
+              @uri = request.uri
+            end
           end
           @file
 
-        rescue Exception => e
+        rescue StandardError => e
           raise CarrierWave::DownloadError, "could not download file: #{e.message}"
         end
 
         def filename_from_header
-          if file.meta.include? 'content-disposition'
-            match = file.meta['content-disposition'].match(/filename="?([^"]+)/)
+          if headers['content-disposition']
+            match = headers['content-disposition'].match(/filename="?([^"]+)/)
             return match[1] unless match.nil? || match[1].empty?
           end
         end
 
+        def filename_from_uri
+          URI::DEFAULT_PARSER.unescape(File.basename(@uri.path))
+        end
+
         def method_missing(*args, &block)
           file.send(*args, &block)
         end
@@ -64,10 +95,11 @@ module CarrierWave
       # === Parameters
       #
       # [url (String)] The URL where the remote file is stored
+      # [remote_headers (Hash)] Request headers
       #
-      def download!(uri)
+      def download!(uri, remote_headers = {})
         processed_uri = process_uri(uri)
-        file = RemoteFile.new(processed_uri)
+        file = RemoteFile.new(processed_uri, remote_headers, skip_ssrf_protection: skip_ssrf_protection?(processed_uri))
         raise CarrierWave::DownloadError, "trying to download a file which is not served over HTTP" unless file.http?
         cache!(file)
       end
@@ -84,11 +116,30 @@ module CarrierWave
       rescue URI::InvalidURIError
         uri_parts = uri.split('?')
         # regexp from Ruby's URI::Parser#regexp[:UNSAFE], with [] specifically removed
-        encoded_uri = URI.encode(uri_parts.shift, /[^\-_.!~*'()a-zA-Z\d;\/?:@&=+$,]/)
-        encoded_uri << '?' << URI.encode(uri_parts.join('?')) if uri_parts.any?
+        encoded_uri = URI::DEFAULT_PARSER.escape(uri_parts.shift, /[^\-_.!~*'()a-zA-Z\d;\/?:@&=+$,]/)
+        encoded_uri << '?' << URI::DEFAULT_PARSER.escape(uri_parts.join('?')) if uri_parts.any?
         URI.parse(encoded_uri) rescue raise CarrierWave::DownloadError, "couldn't parse URL"
       end
 
+      ##
+      # If this returns true, SSRF protection will be bypassed.
+      # You can override this if you want to allow accessing specific local URIs that are not SSRF exploitable.
+      #
+      # === Parameters
+      #
+      # [uri (URI)] The URI where the remote file is stored
+      #
+      # === Examples
+      #
+      #     class MyUploader < CarrierWave::Uploader::Base
+      #       def skip_ssrf_protection?(uri)
+      #         uri.hostname == 'localhost' && uri.port == 80
+      #       end
+      #     end
+      #
+      def skip_ssrf_protection?(uri)
+        false
+      end
     end # Download
   end # Uploader
 end # CarrierWave

data/lib/carrierwave/uploader/extension_blacklist.rb

@@ -4,7 +4,7 @@ module CarrierWave
       extend ActiveSupport::Concern
 
       included do
-        before :cache, :check_blacklist!
+        before :cache, :check_extension_blacklist!
       end
 
       ##
@@ -16,32 +16,36 @@ module CarrierWave
       # the Regexp expression, also case insensitive.
       #
       # === Returns
-      
-      # [NilClass, Array[String,Regexp]] a black list of extensions which are prohibited to be uploaded
+
+      # [NilClass, String, Regexp, Array[String, Regexp]] a black list of extensions which are prohibited to be uploaded
       #
       # === Examples
       #
-      #     def extension_black_list
+      #     def extension_blacklist
       #       %w(swf tiff)
       #     end
       #
       # Basically the same, but using a Regexp:
       #
-      #     def extension_black_list
+      #     def extension_blacklist
       #       [/swf/, 'tiff']
       #     end
       #
- 
-      def extension_black_list; end
+
+      def extension_blacklist; end
 
     private
 
-      def check_blacklist!(new_file)
+      def check_extension_blacklist!(new_file)
         extension = new_file.extension.to_s
-        if extension_black_list and extension_black_list.detect { |item| extension =~ /\A#{item}\z/i }
-          raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.extension_black_list_error", :extension => new_file.extension.inspect, :prohibited_types => extension_black_list.join(", "))
+        if extension_blacklist && blacklisted_extension?(extension)
+          raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.extension_blacklist_error", extension: new_file.extension.inspect, prohibited_types: Array(extension_blacklist).join(", "))
         end
       end
+
+      def blacklisted_extension?(extension)
+        Array(extension_blacklist).any? { |item| extension =~ /\A#{item}\z/i }
+      end
     end
   end
 end

data/lib/carrierwave/uploader/extension_whitelist.rb

@@ -1,12 +1,10 @@
-# encoding: utf-8
-
 module CarrierWave
   module Uploader
     module ExtensionWhitelist
       extend ActiveSupport::Concern
 
       included do
-        before :cache, :check_whitelist!
+        before :cache, :check_extension_whitelist!
       end
 
       ##
@@ -19,31 +17,36 @@ module CarrierWave
       #
       # === Returns
       #
-      # [NilClass, Array[String,Regexp]] a white list of extensions which are allowed to be uploaded
+      # [NilClass, String, Regexp, Array[String, Regexp]] a white list of extensions which are allowed to be uploaded
       #
       # === Examples
       #
-      #     def extension_white_list
+      #     def extension_whitelist
       #       %w(jpg jpeg gif png)
       #     end
       #
       # Basically the same, but using a Regexp:
       #
-      #     def extension_white_list
+      #     def extension_whitelist
       #       [/jpe?g/, 'gif', 'png']
       #     end
       #
-      def extension_white_list; end
+      def extension_whitelist; end
 
     private
 
-      def check_whitelist!(new_file)
+      def check_extension_whitelist!(new_file)
         extension = new_file.extension.to_s
-        if extension_white_list and not extension_white_list.detect { |item| extension =~ /\A#{item}\z/i }
-          raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.extension_white_list_error", :extension => new_file.extension.inspect, :allowed_types => extension_white_list.join(", "))
+        if extension_whitelist && !whitelisted_extension?(extension)
+          raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.extension_whitelist_error", extension: new_file.extension.inspect, allowed_types: Array(extension_whitelist).join(", "))
         end
       end
 
+      def whitelisted_extension?(extension)
+        downcase_extension = extension.downcase
+        Array(extension_whitelist).any? { |item| downcase_extension =~ /\A#{item}\z/i }
+      end
+
     end # ExtensionWhitelist
   end # Uploader
 end # CarrierWave

data/lib/carrierwave/uploader/file_size.rb

@@ -0,0 +1,43 @@
+require 'active_support'
+
+module CarrierWave
+  module Uploader
+    module FileSize
+      extend ActiveSupport::Concern
+
+      included do
+        before :cache, :check_size!
+      end
+
+      ##
+      # Override this method in your uploader to provide a Range of Size which
+      # are allowed to be uploaded.
+      # === Returns
+      #
+      # [NilClass, Range] a size range which are permitted to be uploaded
+      #
+      # === Examples
+      #
+      #     def size_range
+      #       3256...5748
+      #     end
+      #
+      def size_range; end
+
+      private
+
+      def check_size!(new_file)
+        size = new_file.size
+        expected_size_range = size_range
+        if expected_size_range.is_a?(::Range)
+          if size < expected_size_range.min
+            raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.min_size_error", :min_size => ActiveSupport::NumberHelper.number_to_human_size(expected_size_range.min))
+          elsif size > expected_size_range.max
+            raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.max_size_error", :max_size => ActiveSupport::NumberHelper.number_to_human_size(expected_size_range.max))
+          end
+        end
+      end
+
+    end # FileSize
+  end # Uploader
+end # CarrierWave

data/lib/carrierwave/uploader/mountable.rb

@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 module CarrierWave
   module Uploader
     module Mountable
@@ -7,13 +5,14 @@ module CarrierWave
       attr_reader :model, :mounted_as
 
       ##
-      # If a model is given as the first parameter, it will be stored in the uploader, and
-      # available throught +#model+. Likewise, mounted_as stores the name of the column
-      # where this instance of the uploader is mounted. These values can then be used inside
-      # your uploader.
+      # If a model is given as the first parameter, it will be stored in the
+      # uploader, and available through +#model+. Likewise, mounted_as stores
+      # the name of the column where this instance of the uploader is mounted.
+      # These values can then be used inside your uploader.
       #
-      # If you do not wish to mount your uploaders with the ORM extensions in -more then you
-      # can override this method inside your uploader. Just be sure to call +super+
+      # If you do not wish to mount your uploaders with the ORM extensions in
+      # -more then you can override this method inside your uploader. Just be
+      # sure to call +super+
       #
       # === Parameters
       #

data/lib/carrierwave/uploader/processing.rb

@@ -1,5 +1,3 @@
-# encoding: utf-8
-
 module CarrierWave
   module Uploader
     module Processing
@@ -11,7 +9,7 @@ module CarrierWave
         class_attribute :processors, :instance_writer => false
         self.processors = []
 
-        after :cache, :process!
+        before :cache, :process!
       end
 
       module ClassMethods
@@ -73,15 +71,17 @@ module CarrierWave
       def process!(new_file=nil)
         return unless enable_processing
 
-        self.class.processors.each do |method, args, condition|
-          if(condition)
-            if condition.respond_to?(:call)
-              next unless condition.call(self, :args => args, :method => method, :file => new_file)
-            else
-              next unless self.send(condition, new_file)
+        with_callbacks(:process, new_file) do
+          self.class.processors.each do |method, args, condition|
+            if(condition)
+              if condition.respond_to?(:call)
+                next unless condition.call(self, :args => args, :method => method, :file => new_file)
+              else
+                next unless self.send(condition, new_file)
+              end
             end
+            self.send(method, *args)
           end
-          self.send(method, *args)
         end
       end