carrierwave 0.11.0 → 0.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 815b971ebb21afd416f1de7f2d5d35a67c7231bf
-  data.tar.gz: 59b36c18c02eefb0f81438b54200c5f857759589
+  metadata.gz: 53da23e707788e0f5ebe68c6d77bf5fbe8e0cff4
+  data.tar.gz: 6fb8dc63a96871a884fdf2b5931aadbe3b7c1766
 SHA512:
-  metadata.gz: 40f40f2cdd4e0657843260e6830e39e87465fd3b9e881e2dc3f1298479272cb0accbf7a9d4262f1c8df5d7573de4e7c49776b484ec7ad84fa7ad01462455676f
-  data.tar.gz: b967fe877468cb9c26bc7fdc7c861f37692ceaf2293457c3e4fe7f9faf773abda94243dceef9ef38c4fdad979853ecac47b22df0b36ae945af0dfb830bbdeed9
+  metadata.gz: 18558766d40c6d41d42a5aab1ab486998102c9bb00dba031f005c500f85e045315924614e8b2ca3169ba78ea5d9998263bf4c7832629e9f0dfd03c9e1670b64c
+  data.tar.gz: 20f9644c4157dec516f579c45380b98e3aaa5f9859af18a74cb2fc3970fe6fb57b55d5f1068e3eca465983df1dba471e2b8fb1fb852b1f8c01f37a2f731d3cab

data/README.md

@@ -161,6 +161,22 @@ class MyUploader < CarrierWave::Uploader::Base
 end
 ```
 
+### CVE-2016-3714 (ImageTragick)
+This version of CarrierWave has the ability to mitigate CVE-2016-3714. However, you **MUST** set a `content_type_whitelist` in your uploaders for this protection to be effective, and you **MUST** either disable ImageMagick's default SVG delegate or use the RSVG delegate for SVG processing.
+
+A valid whitelist that will restrict your uploader to images only, and mitigate the CVE is:
+
+```ruby
+class MyUploader < CarrierWave::Uploader::Base
+  def content_type_whitelist
+    [/image\//]
+  end
+end
+```
+
+**WARNING**: A `content_type_whitelist` is the only form of whitelist or blacklist supported by CarrierWave that can effectively mitigate against CVE-2016-3714. Use of `extension_type_whitelist` will not inspect the file headers, and thus still leaves your application open to the vulnerability.
+
+
 ### Filenames and unicode chars
 
 Another security issue you should care for is the file names (see

data/lib/carrierwave/sanitized_file.rb

@@ -3,6 +3,7 @@
 require 'pathname'
 require 'active_support/core_ext/string/multibyte'
 require 'mime/types'
+require 'mimemagic'
 
 module CarrierWave
 
@@ -244,12 +245,10 @@ module CarrierWave
     # [String] the content type of the file
     #
     def content_type
-      return @content_type if @content_type
-      if @file.respond_to?(:content_type) and @file.content_type
-        @content_type = @file.content_type.to_s.chomp
-      elsif path
-        @content_type = ::MIME::Types.type_for(path).first.to_s
-      end
+      @content_type ||=
+        existing_content_type ||
+        mime_magic_content_type ||
+        mime_types_content_type
     end
 
     ##
@@ -309,6 +308,22 @@ module CarrierWave
       return name.mb_chars.to_s
     end
 
+    def existing_content_type
+      if @file.respond_to?(:content_type) && @file.content_type
+        @file.content_type.to_s.chomp
+      end
+    end
+
+    def mime_magic_content_type
+      MimeMagic.by_magic(File.open(path)).try(:type) if path
+    rescue Errno::ENOENT
+      nil
+    end
+
+    def mime_types_content_type
+      ::MIME::Types.type_for(path).first.to_s if path
+    end
+
     def split_extension(filename)
       # regular expressions to try for identifying extensions
       extension_matchers = [

data/lib/carrierwave/storage.rb

@@ -1,9 +1,11 @@
 require "carrierwave/storage/abstract"
 require "carrierwave/storage/file"
 
-begin
-  require "fog"
-rescue LoadError
+%w(aws google openstack rackspace).each do |fog_dependency|
+  begin
+    require "fog/#{fog_dependency}"
+  rescue LoadError
+  end
 end
 
 require "carrierwave/storage/fog" if defined?(Fog)

data/lib/carrierwave/storage/fog.rb

@@ -1,7 +1,5 @@
 # encoding: utf-8
 
-require "fog"
-
 module CarrierWave
   module Storage
 

data/lib/carrierwave/version.rb

@@ -1,3 +1,3 @@
 module CarrierWave
-  VERSION = "0.11.0"
+  VERSION = "0.11.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: carrierwave
 version: !ruby/object:Gem::Version
-  version: 0.11.0
+  version: 0.11.1
 platform: ruby
 authors:
 - Jonas Nicklas
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-29 00:00:00.000000000 Z
+date: 2016-05-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -66,6 +66,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '1.16'
+- !ruby/object:Gem::Dependency
+  name: mimemagic
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.0
 - !ruby/object:Gem::Dependency
   name: pg
   requirement: !ruby/object:Gem::Requirement
@@ -332,7 +346,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: carrierwave
-rubygems_version: 2.4.3
+rubygems_version: 2.4.5.1
 signing_key: 
 specification_version: 3
 summary: Ruby file upload library