image_processing 2.0.1 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f6cae039a37f249067e4632b2d84cbaf4f285617c4d6c22bc4837f128723bb95
-  data.tar.gz: 2364539ecb3d5b21479fe9247d8410639db8b781ff624a2f0b8f622aceed310d
+  metadata.gz: 073bdcd7bc5e6fbb52b92f70de43d3b700316620dd23ec75b9aeac18bd5375b3
+  data.tar.gz: 1678df6fd73afc2230fafd9c3f84b2d5174351819ef0f3961ed5206f2c6ae53b
 SHA512:
-  metadata.gz: 5336e937d811c9189e0a8744dcd14256b0285cdb10484d357c19a48915806d66d59a230314b2c07edf9fa4afafe6f2037ed6952da32a38413d0b01c484ce53dc
-  data.tar.gz: 5d3aa4160dfd22763a19d82730d4d7debfe776e0cf93cc87572299ad2ec316bfb322b0f965901d46a1055c8c6140a6d2e9c8fb5a03a5756eb59f6089c737a7c9
+  metadata.gz: e41739ac97beb0cb48cd97be766578cac1c14b4fd86fea0dd7401b835ecfbd2c018485d12ea0cb6d3c6cfcf0d4e0355d5c011770dd7f0c74aec26e7499cb306f
+  data.tar.gz: 7618aa5091de6ddc2a01a189e548e508d862535ad8a7f4e400845c8696fcace78081f33efc343fa220ed04d13a0a71106a7e7c10141c107764270640ad30a0a6

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 2.0.3 (2026-06-08)
+
+* Prevent remote code execution when operation names come from user input, closing bypasses through the `#operation` meta-builder, `#method_missing`, and nested `#send` calls (reported by @szymonsec)
+
+* [minimagick] Prevent remote code execution through unsafe public methods (e.g. `#instance_eval`, `#send`) passed as loader/saver option names
+
+## 2.0.2 (2026-06-03)
+
+* Raise `LoadError` instead of `ImageProcessing::Error` when soft dependencies are missing (@bdewater-thatch)
+
 ## 2.0.1 (2026-05-22)
 
 * [minimagick] Prevent remote shell execution when passing loader/saver options from user input

data/image_processing.gemspec

@@ -23,5 +23,4 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "minitest", "~> 5.8"
   spec.add_development_dependency "minitest-hooks", ">= 1.4.2"
   spec.add_development_dependency "minispec-metadata"
-  spec.add_development_dependency "dhash-vips" unless RUBY_ENGINE == "jruby"
 end

data/lib/image_processing/chainable.rb

@@ -86,25 +86,24 @@ module ImageProcessing
     private
 
     # This prevents calling unsafe Ruby core methods such as `Kernel#system`,
-    # which would allow for remote shell execution.
+    # which would allow for remote shell execution. The processor enforces the
+    # same guard when operations are dispatched, which also covers paths that
+    # bypass this early check (e.g. the #operation meta-builder).
+    #
+    # Bang names are rejected here because they are Chainable's execution
+    # shortcut (see #method_missing), not operations to chain.
     def invalid_operation?(name)
-      return true if name.end_with?("!")
-
-      owner = method(name).owner
-      [BasicObject, Kernel, Object, Module].include?(owner)
-    rescue NameError
-      false
+      name.end_with?("!") || ImageProcessing.unsafe_method?(self, name)
     end
 
     # Assume that any unknown method names an operation supported by the
     # processor. Add a bang ("!") if you want processing to be performed.
-    def method_missing(name, *args, &block)
-      return super if name.to_s.end_with?("?")
-      return public_send(name.to_s.chomp("!"), *args, &block).call if name.to_s.end_with?("!")
+    def method_missing(name, ...)
+      return super if name.end_with?("?")
+      return public_send(name.to_s.chomp("!"), ...).call if name.end_with?("!")
 
-      operation(name, *args, &block)
+      operation(name, ...)
     end
-    ruby2_keywords(:method_missing) if respond_to?(:ruby2_keywords, true)
 
     # Empty options which the builder starts with.
     DEFAULT_OPTIONS = {

data/lib/image_processing/mini_magick.rb

@@ -2,7 +2,7 @@ require "image_processing"
 begin
   require "mini_magick"
 rescue LoadError
-  fail ImageProcessing::Error, "ImageProcessing::MiniMagick requires the mini_magick gem. Please add `gem \"mini_magick\", \"~> 5.0\"` to your Gemfile."
+  raise LoadError, "ImageProcessing::MiniMagick requires the mini_magick gem. Please add `gem \"mini_magick\", \"~> 5.0\"` to your Gemfile."
 end
 
 module ImageProcessing
@@ -225,6 +225,13 @@ module ImageProcessing
         # Applies options from the provided hash.
         def apply_options(magick, define: {}, **options)
           options.each do |option, value|
+            # Loader/saver option names may come from user input, so guard
+            # against dispatching to unsafe Ruby core methods (e.g. #send,
+            # #instance_eval) that public_send does not block on its own.
+            if ImageProcessing.unsafe_method?(magick, option)
+              raise Error, "#{option.inspect} is not a valid option"
+            end
+
             case value
             when true, nil then magick.public_send(option)
             when false     then magick.public_send(option).+

data/lib/image_processing/processor.rb

@@ -53,6 +53,15 @@ module ImageProcessing
     # operation directly on the accumulator object. This provides a common
     # umbrella above defined macros and direct operations.
     def apply_operation(name, *args, &block)
+      # Chainable performs the same check when operations are built, but that
+      # guard only sees the outer builder method name, so it can be routed
+      # around via the #operation meta-builder, #method_missing, or a nested
+      # #send. This is the single point every operation is finally dispatched
+      # through, so enforcing the guard here closes all of those paths.
+      if ImageProcessing.unsafe_method?(self, name)
+        fail Error, "#{name.inspect} is not a valid operation"
+      end
+
       receiver = respond_to?(name) ? self : @accumulator
 
       if args.last.is_a?(Hash)

data/lib/image_processing/version.rb

@@ -1,3 +1,3 @@
 module ImageProcessing
-  VERSION = "2.0.1"
+  VERSION = "2.0.3"
 end

data/lib/image_processing/vips.rb

@@ -2,7 +2,7 @@ require "image_processing"
 begin
   require "vips"
 rescue LoadError
-  fail ImageProcessing::Error, "ImageProcessing::Vips requires the ruby-vips gem. Please add `gem \"ruby-vips\", \"~> 2.0\"` to your Gemfile."
+  raise LoadError, "ImageProcessing::Vips requires the ruby-vips gem. Please add `gem \"ruby-vips\", \"~> 2.0\"` to your Gemfile."
 end
 
 Vips.block_untrusted(true) if Vips.respond_to?(:block_untrusted) && !ENV["VIPS_BLOCK_UNTRUSTED"]

data/lib/image_processing.rb

@@ -7,6 +7,25 @@ require "image_processing/version"
 module ImageProcessing
   Error = Class.new(StandardError)
 
+  # Method owners considered unsafe to dispatch to when a method name comes
+  # from user input, because they expose Ruby's metaprogramming and shell
+  # primitives (e.g. Kernel#send, Kernel#eval, BasicObject#instance_eval,
+  # Kernel#system). Any name whose implementation is inherited from one of
+  # these should never be treated as an image operation or a loader/saver
+  # option.
+  UNSAFE_METHOD_OWNERS = [BasicObject, Kernel, Object, Module].freeze
+
+  # Whether calling +name+ on +receiver+ would dispatch to an unsafe Ruby core
+  # method rather than a genuine operation. Used as a single, shared guard at
+  # every place where a user-provided name is dispatched via +public_send+.
+  def self.unsafe_method?(receiver, name)
+    UNSAFE_METHOD_OWNERS.include?(receiver.method(name.to_s).owner)
+  rescue NameError
+    # An unknown name is not a Ruby core method, so it is safe to forward to
+    # the receiver (which will reject it if it is not a real operation).
+    false
+  end
+
   autoload :MiniMagick, "image_processing/mini_magick"
   autoload :Vips, "image_processing/vips"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: image_processing
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.3
 platform: ruby
 authors:
 - Janko Marohnić
@@ -65,20 +65,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-- !ruby/object:Gem::Dependency
-  name: dhash-vips
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 description: High-level wrapper for processing images for the web with ImageMagick
   or libvips.
 email:
@@ -119,7 +105,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.13
 specification_version: 4
 summary: High-level wrapper for processing images for the web with ImageMagick or
   libvips.