image_vise 0.0.21 → 0.0.22

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 6a79d07f95e9fcf0800a432a49420da6d856ee52
-  data.tar.gz: 5bd849b46ac06048071bbad834e9bf2a396f902e
+  metadata.gz: fd846193c9dfec3d6a6489d87a2145eeb602a02c
+  data.tar.gz: 5d0cf54a6245a0c345517e9a5eca524f0621d6f0
 SHA512:
-  metadata.gz: 8ab89461f69e6efb15e776f73dfcd1fc85346b8744cce1d0b9b2df28bd44cb75f0a23bb12e6be61394609cbe60354d64ad04b4124c941f1ac26770e5c5f5d684
-  data.tar.gz: 24fd679469621e2c2e03c039e22185fde97e931bc2883a9c3dc8c5733e376363fa78c4ce21ed970559b6173efc492a821e7a266079ab7666bd359bb43c1ac7c2
+  metadata.gz: 7e818b5aa0a04154d248f94a29d95e923ca995cc009115004f86cbfb636136b5f88c9b94b9da568a623832bb1bc230b0cd35688bd67410e8237f512f75c912ba
+  data.tar.gz: c0a1e0fb980a1f2b92a5b337d4ccf9051ffc0d52358a14cc6e9ab7a46e28f1c32c35354621a54de2f1c1e780a7d843ce33ff6659acd4428c8b96d0959994dba0

data/image_vise.gemspec

@@ -2,11 +2,11 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: image_vise 0.0.21 ruby lib
+# stub: image_vise 0.0.22 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "image_vise"
-  s.version = "0.0.21"
+  s.version = "0.0.22"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]

data/lib/image_vise/image_request.rb

@@ -25,8 +25,9 @@ class ImageVise::ImageRequest < Ks.strict(:src_url, :pipeline)
 
     src_url = URI.parse(src_url)
     if src_url.scheme == 'file'
+      file_path = URI.decode(src_url.path)
       raise URLError, "#{src_url} not permitted since filesystem access is disabled" if allowed_filesystem_patterns.empty?
-      raise URLError, "#{src_url} is not on the path whitelist" unless allowed_path?(allowed_filesystem_patterns, src_url.path)
+      raise URLError, "#{src_url} is not on the path whitelist" unless allowed_path?(allowed_filesystem_patterns, file_path)
     elsif src_url.scheme != 'file'
       raise URLError, "#{src_url} is not permitted as source" unless permitted_source_hosts.include?(src_url.host)
     end
@@ -55,7 +56,7 @@ class ImageVise::ImageRequest < Ks.strict(:src_url, :pipeline)
   private
 
   def self.allowed_path?(filesystem_glob_patterns, path_to_check)
-    expanded_path = File.expand_path(path_to_check)
+    expanded_path = File.realpath(File.expand_path(path_to_check))
     filesystem_glob_patterns.any? {|pattern| File.fnmatch?(pattern, expanded_path) }
   end
 

data/lib/image_vise/render_engine.rb

@@ -234,7 +234,8 @@ class ImageVise::RenderEngine
 
   def copy_path_into_tempfile(path_on_filesystem)
     tf = binary_tempfile
-    File.open(path_on_filesystem, 'rb') do |f|
+    real_path_on_filesystem = File.realpath(File.expand_path(path_on_filesystem))
+    File.open(real_path_on_filesystem, 'rb') do |f|
       IO.copy_stream(f, tf)
     end
     tf.rewind; tf

data/lib/image_vise.rb

@@ -8,7 +8,7 @@ require 'base64'
 require 'rack'
 
 class ImageVise
-  VERSION = '0.0.21'
+  VERSION = '0.0.22'
   S_MUTEX = Mutex.new
   private_constant :S_MUTEX
   

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: image_vise
 version: !ruby/object:Gem::Version
-  version: 0.0.21
+  version: 0.0.22
 platform: ruby
 authors:
 - Julik Tarkhanov