carrierwave 1.3.2 → 3.0.2

data/lib/carrierwave/downloader/base.rb

@@ -0,0 +1,101 @@
+require 'open-uri'
+require 'ssrf_filter'
+require 'addressable'
+require 'carrierwave/downloader/remote_file'
+
+module CarrierWave
+  module Downloader
+    class Base
+      include CarrierWave::Utilities::Uri
+
+      attr_reader :uploader
+
+      def initialize(uploader)
+        @uploader = uploader
+      end
+
+      ##
+      # Downloads a file from given URL and returns a RemoteFile.
+      #
+      # === Parameters
+      #
+      # [url (String)] The URL where the remote file is stored
+      # [remote_headers (Hash)] Request headers
+      #
+      def download(url, remote_headers = {})
+        @current_download_retry_count = 0
+        headers = remote_headers.
+          reverse_merge('User-Agent' => "CarrierWave/#{CarrierWave::VERSION}")
+        uri = process_uri(url.to_s)
+        begin
+          if skip_ssrf_protection?(uri)
+            response = OpenURI.open_uri(process_uri(url.to_s), headers)
+          else
+            request = nil
+            if ::SsrfFilter::VERSION.to_f < 1.1
+              response = SsrfFilter.get(uri, headers: headers) do |req|
+                request = req
+              end
+            else
+              response = SsrfFilter.get(uri, headers: headers, request_proc: ->(req) { request = req }) do |res|
+                res.body # ensure to read body
+              end
+            end
+            response.uri = request.uri
+            response.value
+          end
+        rescue StandardError => e
+          if @current_download_retry_count < @uploader.download_retry_count
+            @current_download_retry_count += 1
+            sleep @uploader.download_retry_wait_time
+            retry
+          else
+            raise CarrierWave::DownloadError, "could not download file: #{e.message}"
+          end
+        end
+        CarrierWave::Downloader::RemoteFile.new(response)
+      end
+
+      ##
+      # Processes the given URL by parsing it, and escaping if necessary. Public to allow overriding.
+      #
+      # === Parameters
+      #
+      # [url (String)] The URL where the remote file is stored
+      #
+      def process_uri(source)
+        uri = Addressable::URI.parse(source)
+        uri.host = uri.normalized_host
+        # Perform decode first, as the path is likely to be already encoded
+        uri.path = encode_path(decode_uri(uri.path)) if uri.path =~ CarrierWave::Utilities::Uri::PATH_UNSAFE
+        uri.query = encode_non_ascii(uri.query) if uri.query
+        uri.fragment = encode_non_ascii(uri.fragment) if uri.fragment
+        URI.parse(uri.to_s)
+      rescue URI::InvalidURIError, Addressable::URI::InvalidURIError
+        raise CarrierWave::DownloadError, "couldn't parse URL: #{source}"
+      end
+
+      ##
+      # If this returns true, SSRF protection will be bypassed.
+      # You can override this if you want to allow accessing specific local URIs that are not SSRF exploitable.
+      #
+      # === Parameters
+      #
+      # [uri (URI)] The URI where the remote file is stored
+      #
+      # === Examples
+      #
+      #     class CarrierWave::Downloader::CustomDownloader < CarrierWave::Downloader::Base
+      #       def skip_ssrf_protection?(uri)
+      #         uri.hostname == 'localhost' && uri.port == 80
+      #       end
+      #     end
+      #
+      #     my_uploader.downloader = CarrierWave::Downloader::CustomDownloader
+      #
+      def skip_ssrf_protection?(uri)
+        false
+      end
+    end
+  end
+end

data/lib/carrierwave/downloader/remote_file.rb

@@ -0,0 +1,68 @@
+module CarrierWave
+  module Downloader
+    class RemoteFile
+      attr_reader :file, :uri
+
+      def initialize(file)
+        case file
+        when String
+          @file = StringIO.new(file)
+        when Net::HTTPResponse
+          body = file.body
+          raise CarrierWave::DownloadError, 'could not download file: No Content' if body.nil?
+
+          @file = StringIO.new(body)
+          @content_type = file.content_type
+          @headers = file
+          @uri = file.uri
+        else
+          @file = file
+          @content_type = file.content_type
+          @headers = file.meta
+          @uri = file.base_uri
+        end
+      end
+
+      def content_type
+        @content_type || 'application/octet-stream'
+      end
+
+      def headers
+        @headers || {}
+      end
+
+      def original_filename
+        filename = filename_from_header || filename_from_uri
+        mime_type = Marcel::TYPES[content_type]
+        unless File.extname(filename).present? || mime_type.blank?
+          extension = mime_type[0].first
+          filename = "#{filename}.#{extension}"
+        end
+        filename
+      end
+
+    private
+
+      def filename_from_header
+        return nil unless headers['content-disposition']
+
+        match = headers['content-disposition'].match(/filename=(?:"([^"]+)"|([^";]+))/)
+        return nil unless match
+
+        match[1].presence || match[2].presence
+      end
+
+      def filename_from_uri
+        CGI.unescape(File.basename(uri.path))
+      end
+
+      def method_missing(*args, &block)
+        file.send(*args, &block)
+      end
+
+      def respond_to_missing?(*args)
+        super || file.respond_to?(*args)
+      end
+    end
+  end
+end

data/lib/carrierwave/locale/en.yml

@@ -4,11 +4,14 @@ en:
       carrierwave_processing_error: failed to be processed
       carrierwave_integrity_error: is not of an allowed file type
       carrierwave_download_error: could not be downloaded
-      extension_whitelist_error: "You are not allowed to upload %{extension} files, allowed types: %{allowed_types}"
-      extension_blacklist_error: "You are not allowed to upload %{extension} files, prohibited types: %{prohibited_types}"
-      content_type_whitelist_error: "You are not allowed to upload %{content_type} files, allowed types: %{allowed_types}"
-      content_type_blacklist_error: "You are not allowed to upload %{content_type} files"
-      rmagick_processing_error: "Failed to manipulate with rmagick, maybe it is not an image?"
-      mini_magick_processing_error: "Failed to manipulate with MiniMagick, maybe it is not an image? Original Error: %{e}"
+      extension_allowlist_error: "You are not allowed to upload %{extension} files, allowed types: %{allowed_types}"
+      extension_denylist_error: "You are not allowed to upload %{extension} files, prohibited types: %{prohibited_types}"
+      content_type_allowlist_error: "You are not allowed to upload %{content_type} files, allowed types: %{allowed_types}"
+      content_type_denylist_error: "You are not allowed to upload %{content_type} files"
+      processing_error: "Failed to manipulate, maybe it is not an image?"
       min_size_error: "File size should be greater than %{min_size}"
       max_size_error: "File size should be less than %{max_size}"
+      min_width_error: "Image width should be greater than %{min_width}px"
+      max_width_error: "Image width should be less than %{max_width}px"
+      min_height_error: "Image height should be greater than %{min_height}px"
+      max_height_error: "Image height should be less than %{max_height}px"

data/lib/carrierwave/mount.rb

@@ -132,7 +132,7 @@ module CarrierWave
     #     end
     #
     def mount_uploader(column, uploader=nil, options={}, &block)
-      mount_base(column, uploader, options, &block)
+      mount_base(column, uploader, options.merge(multiple: false), &block)
 
       mod = Module.new
       include mod
@@ -163,36 +163,27 @@ module CarrierWave
         end
 
         def remote_#{column}_url=(url)
-          _mounter(:#{column}).remote_urls = [url]
+          _mounter(:#{column}).remote_urls = url
         end
 
         def remote_#{column}_request_header=(header)
           _mounter(:#{column}).remote_request_headers = [header]
         end
 
-        def write_#{column}_identifier
-          return if frozen?
-          mounter = _mounter(:#{column})
-
-          if mounter.remove?
-            write_uploader(mounter.serialization_column, nil)
-          elsif mounter.identifiers.first
-            write_uploader(mounter.serialization_column, mounter.identifiers.first)
-          end
-        end
-
         def #{column}_identifier
           _mounter(:#{column}).read_identifiers[0]
         end
 
-        def store_previous_changes_for_#{column}
-          attribute_changes = ::ActiveRecord.version.to_s.to_f >= 5.1 ? saved_changes : changes
-          @_previous_changes_for_#{column} = attribute_changes[_mounter(:#{column}).serialization_column]
+        def #{column}_integrity_error
+          #{column}_integrity_errors.last
         end
 
-        def remove_previously_stored_#{column}
-          before, after = @_previous_changes_for_#{column}
-          _mounter(:#{column}).remove_previous([before], [after])
+        def #{column}_processing_error
+          #{column}_processing_errors.last
+        end
+
+        def #{column}_download_error
+          #{column}_download_errors.last
         end
       RUBY
     end
@@ -240,9 +231,9 @@ module CarrierWave
     # [store_images!]           Stores all files that have been assigned with +images=+
     # [remove_images!]          Removes the uploaded file from the filesystem.
     #
-    # [images_integrity_error]  Returns an error object if the last files to be assigned caused an integrity error
-    # [images_processing_error] Returns an error object if the last files to be assigned caused a processing error
-    # [images_download_error]   Returns an error object if the last files to be remotely assigned caused a download error
+    # [image_integrity_errors]   Returns error objects of files which failed to pass integrity check
+    # [image_processing_errors]  Returns error objects of files which failed to be processed
+    # [image_download_errors]    Returns error objects of files which failed to be downloaded
     #
     # [image_identifiers]       Reads out the identifiers of the files
     #
@@ -286,7 +277,7 @@ module CarrierWave
     #     end
     #
     def mount_uploaders(column, uploader=nil, options={}, &block)
-      mount_base(column, uploader, options, &block)
+      mount_base(column, uploader, options.merge(multiple: true), &block)
 
       mod = Module.new
       include mod
@@ -325,38 +316,18 @@ module CarrierWave
           _mounter(:#{column}).remote_request_headers = headers
         end
 
-        def write_#{column}_identifier
-          return if frozen?
-          mounter = _mounter(:#{column})
-
-          if mounter.remove?
-            write_uploader(mounter.serialization_column, nil)
-          elsif mounter.identifiers.any?
-            write_uploader(mounter.serialization_column, mounter.identifiers)
-          end
-        end
-
         def #{column}_identifiers
           _mounter(:#{column}).read_identifiers
         end
-
-        def store_previous_changes_for_#{column}
-          attribute_changes = ::ActiveRecord.version.to_s.to_f >= 5.1 ? saved_changes : changes
-          @_previous_changes_for_#{column} = attribute_changes[_mounter(:#{column}).serialization_column]
-        end
-
-        def remove_previously_stored_#{column}
-          _mounter(:#{column}).remove_previous(*@_previous_changes_for_#{column})
-        end
       RUBY
     end
 
-    private
+  private
 
     def mount_base(column, uploader=nil, options={}, &block)
       include CarrierWave::Mount::Extension
 
-      uploader = build_uploader(uploader, &block)
+      uploader = build_uploader(uploader, column, &block)
       uploaders[column.to_sym] = uploader
       uploader_options[column.to_sym] = options
 
@@ -381,6 +352,8 @@ module CarrierWave
 
         def remove_#{column}!
           _mounter(:#{column}).remove!
+          self.remove_#{column} = true
+          write_#{column}_identifier
         end
 
         def remove_#{column}=(value)
@@ -395,34 +368,48 @@ module CarrierWave
           _mounter(:#{column}).store!
         end
 
-        def #{column}_integrity_error
-          _mounter(:#{column}).integrity_error
+        def #{column}_integrity_errors
+          _mounter(:#{column}).integrity_errors
         end
 
-        def #{column}_processing_error
-          _mounter(:#{column}).processing_error
+        def #{column}_processing_errors
+          _mounter(:#{column}).processing_errors
         end
 
-        def #{column}_download_error
-          _mounter(:#{column}).download_error
+        def #{column}_download_errors
+          _mounter(:#{column}).download_errors
+        end
+
+        def write_#{column}_identifier
+          _mounter(:#{column}).write_identifier
         end
 
         def mark_remove_#{column}_false
           _mounter(:#{column}).remove = false
         end
+
+        def reset_previous_changes_for_#{column}
+          _mounter(:#{column}).reset_changes!
+        end
+
+        def remove_previously_stored_#{column}
+          _mounter(:#{column}).remove_previous
+        end
+
+        def remove_rolled_back_#{column}
+          _mounter(:#{column}).remove_added
+        end
       RUBY
     end
 
-    def build_uploader(uploader, &block)
-      return uploader if uploader && !block_given?
+    def build_uploader(uploader, column, &block)
+      uploader ||= CarrierWave::Uploader::Base
+      return uploader unless block_given?
 
-      uploader = Class.new(uploader || CarrierWave::Uploader::Base)
-      const_set("Uploader#{uploader.object_id}".tr('-', '_'), uploader)
+      uploader = Class.new(uploader)
+      const_set("CarrierWave#{column.to_s.camelize}Uploader", uploader)
 
-      if block_given?
-        uploader.class_eval(&block)
-        uploader.recursively_apply_block_to_versions(&block)
-      end
+      uploader.class_eval(&block)
 
       uploader
     end
@@ -443,9 +430,9 @@ module CarrierWave
 
       def _mounter(column)
         # We cannot memoize in frozen objects :(
-        return Mounter.new(self, column) if frozen?
+        return Mounter.build(self, column) if frozen?
         @_mounters ||= {}
-        @_mounters[column] ||= Mounter.new(self, column)
+        @_mounters[column] ||= Mounter.build(self, column)
       end
 
     end # Extension