carrierwave 3.1.2 → 3.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 419200b4437cec891e52a5175c1d7b3f4ac26bbe53d5a499ffd78e823deebed1
-  data.tar.gz: 429982feec40f1ffaa18900f45e7615caea384dc6fb9871a9df3010b150e03f4
+  metadata.gz: 3fce89671ca96c66db403199f1eab005bdb208ae699bcd6c6d58d470ec337d96
+  data.tar.gz: 0047624b2e05641fbb2d65d97815726e9bc296fc8cdb53c37815ead2ce30d6e4
 SHA512:
-  metadata.gz: 0ba037a1637b1e1991783ba94171869f25eb916643ae3769ac273dd967baef630e00add18beb53d773b7ab796b4ea9605d35bf349aa67c8086b205200a9a6b7e
-  data.tar.gz: 4accb3afbbb5a098552317d59194a9b8bfd2cf5f51c69d14ada968a4607469c7980eb66a54d3ac91c0ae9f3b0b54376ab9d8b6d4dd02cf7dd0eb74c93e7fd36b
+  metadata.gz: 5f63f1e37da1f107660263cc2d4be4e09dd0076e12bf80bc057449ddbd288887210ae17392d4092ff240c9992be3819721e7665a72023e4b58a8e9d351434d37
+  data.tar.gz: 205220c3605f50f23379781d94c587aee68a75aa7d4d854a258d362983122115641482098e81574dd873acce90deeb124d01b24c9ff7970dc45c2cb3146a9bd1

data/lib/carrierwave/sanitized_file.rb

@@ -317,10 +317,18 @@ module CarrierWave
     def declared_content_type
       @declared_content_type ||
         if @file.respond_to?(:content_type) && @file.content_type
-          Marcel::MimeType.for(declared_type: @file.content_type.to_s.chomp)
+          Marcel::MimeType.for(declared_type: first_declared_content_type(@file.content_type))
         end
     end
 
+    # Clients occasionally send more than one MIME type in a single header
+    # (e.g. "image/png; text/html" or "image/png, text/html"). Marcel 2 validates
+    # the declared type against the RFC grammar and rejects such values, so pick
+    # the first media type ourselves before handing it over.
+    def first_declared_content_type(content_type)
+      content_type.to_s.strip.split(/[;,\s]/, 2).first
+    end
+
     # Guess content type from its file extension. Limit what to be returned to prevent spoofing.
     def guessed_safe_content_type
       return unless path

data/lib/carrierwave/uploader/configuration.rb

@@ -88,7 +88,7 @@ module CarrierWave
               raise CarrierWave::UnknownStorageError, "Unknown storage: #{storage}"
             end
           when nil
-            storage
+            # noop
           else
             self._storage = storage
           end

data/lib/carrierwave/uploader/content_type_denylist.rb

@@ -54,7 +54,10 @@ module CarrierWave
       end
 
       def denylisted_content_type?(denylist, content_type)
-        Array(denylist).any? { |item| content_type =~ /#{item}/ }
+        Array(denylist).any? do |item|
+          item = Regexp.quote(item) if item.class != Regexp
+          content_type =~ /#{item}/
+        end
       end
 
     end # ContentTypeDenylist

data/lib/carrierwave/version.rb

@@ -1,3 +1,3 @@
 module CarrierWave
-  VERSION = "3.1.2".freeze
+  VERSION = "3.1.4".freeze
 end

data/lib/generators/templates/uploader.rb.erb

@@ -40,6 +40,14 @@ class <%= class_name %>Uploader < CarrierWave::Uploader::Base
   #   %w(jpg jpeg gif png)
   # end
 
+  # Add a content_type_allowlist to restrict uploads by MIME type.
+  # Without it, a user could upload a harmful file
+  # with a safe extension (content-type spoofing).
+  # For the previous extension_allowlist you might use something like this:
+  # def content_type_allowlist
+  #   /image\//
+  # end
+
   # Override the filename of the uploaded files:
   # Avoid using model.id or version_name here, see uploader/store.rb for details.
   # def filename

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: carrierwave
 version: !ruby/object:Gem::Version
-  version: 3.1.2
+  version: 3.1.4
 platform: ruby
 authors:
 - Jonas Nicklas
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-04-13 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -42,30 +41,42 @@ dependencies:
   name: image_processing
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: marcel
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: 1.0.0
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
@@ -240,6 +251,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: ruby-vips
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: rmagick
   requirement: !ruby/object:Gem::Requirement
@@ -369,8 +394,8 @@ files:
 homepage: https://github.com/carrierwaveuploader/carrierwave
 licenses:
 - MIT
-metadata: {}
-post_install_message:
+metadata:
+  changelog_uri: https://github.com/carrierwaveuploader/carrierwave/blob/master/CHANGELOG.md
 rdoc_options:
 - "--main"
 require_paths:
@@ -386,8 +411,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.22
-signing_key:
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Ruby file upload library
 test_files: []