image_vise 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 8fd6c51aedf4fe76ee330a75a0a967da91397452
-  data.tar.gz: 7ce66027f5c46d4812591884efea60047ceefca7
+  metadata.gz: 493e78593a4399614a6db7dc12b6718941e4de04
+  data.tar.gz: 31e96d402674418e02c1a3bc9a88810889af16c8
 SHA512:
-  metadata.gz: f5ef54f0cd31ebde260bcb9f580dabf303e3bf10a9b451bea1eb0999a89cb71c3b8a55124bb86313fbaba4f5f25143250fabaf78318758f6426fb8c4a8a43a6c
-  data.tar.gz: ccd3a779a38de87d4f7e35c9d11cebeef2b8c748a3fbd5331716c749f1e7d4d223ace28bc352ba5b7447630b85330ee030fd229b3b0784b34f8e1ccdd257a214
+  metadata.gz: 7a14f2987b638ec2cead4ac87e269ad131fd1d1409834b5b0b0efddbd464a3e434e6a24bad127249b6173ccd655e2957fc23d48b4f5490564e4833c93dbb2181
+  data.tar.gz: 67d3fc0181b7935f24c9a48afb5ff90afc813e6abc5fc2e627c41c0c51f0f4dc45326ec300fab03114647d98e8950ca64f42ac3a4bf4b5640c6c127621030c9b

data/SECURITY.md

@@ -10,12 +10,12 @@ For checking HMAC values `Rack::Utils.secure_compare` constant-time comparison i
 
 ## Cache bypass protection for randomized query string params
 
-ImageVise forbids _any_ query string params except `sig` and `q`. This to prevent the same processing
-URL from being requested repeatedly with the same params but with a different query string param appended,
-like this:
+ImageVise defaults to using paths. If you have a way to forbid query strings on the fronting CDN
+or proxy server we suggest you to do so, to prevent randomized URLs from filling up your cache
+and extreme amounts of processing from happening.
 
-* `/thm?q=xYz&sig=abc&exploit=123`
-* `/thm?q=xYz&sig=abc&exploit=234`
+* `/image/<pipeline>/<sig>?&random=123`
+* `/image/<pipeline>/<sig>?&random=456`
 
 These URLs would in fact resolve to the same source image and pipeline, but would not be stored in an upstream
 CDN cache because the query string params contain extra data.
@@ -41,4 +41,4 @@ ImageVise does not set RMagick limits by itself. You should
 ## Processing time constraints
 
 If you are using forking, there will be a timeout used for how long the forked child process may run,
-which is the default timeout used in ExceptionalFork.
+which is the default timeout used in ExceptionalFork.

data/image_vise.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: image_vise 0.1.1 ruby lib
+# stub: image_vise 0.1.2 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "image_vise"
-  s.version = "0.1.1"
+  s.version = "0.1.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Julik Tarkhanov"]
-  s.date = "2016-10-22"
+  s.date = "2016-10-26"
   s.description = "Image processing via URLs"
   s.email = "me@julik.nl"
   s.extra_rdoc_files = [
@@ -61,6 +61,7 @@ Gem::Specification.new do |s|
     "spec/image_vise/srgb_spec.rb",
     "spec/image_vise/strip_metadata_spec.rb",
     "spec/image_vise_spec.rb",
+    "spec/layers-with-blending.psd",
     "spec/spec_helper.rb",
     "spec/test_server.rb",
     "spec/waterside_magic_hour.jpg",

data/lib/image_vise/render_engine.rb

@@ -289,9 +289,14 @@ class ImageVise::RenderEngine
   # @return [void]
   def apply_pipeline(source_file_path, pipeline, source_file_type, render_to_path)
     render_file_type = source_file_type
-    magick_image = Magick::Image.read(source_file_path)[0]
-    pipeline.apply!(magick_image)
     
+    # Load the first frame of the animated GIF _or_ the blended compatibility layer from Photoshop
+    image_list = Magick::Image.read(source_file_path)
+    magick_image = image_list.first
+
+    # Apply the pipeline
+    pipeline.apply!(magick_image)
+
     # If processing the image has created an alpha channel, use PNG always.
     # Otherwise, keep the original format for as far as the supported formats list goes.
     render_file_type = PNG_FILE_TYPE if magick_image.alpha?
@@ -300,7 +305,8 @@ class ImageVise::RenderEngine
     magick_image.format = render_file_type.ext
     magick_image.write(render_to_path)
   ensure
-    ImageVise.destroy(magick_image)
+    # destroy all the loaded images explicitly
+    (image_list || []).map {|img| ImageVise.destroy(img) }
   end
 
 end

data/lib/image_vise.rb

@@ -8,7 +8,7 @@ require 'base64'
 require 'rack'
 
 class ImageVise
-  VERSION = '0.1.1'
+  VERSION = '0.1.2'
   S_MUTEX = Mutex.new
   private_constant :S_MUTEX
   

data/spec/image_vise/render_engine_spec.rb

@@ -264,6 +264,27 @@ describe ImageVise::RenderEngine do
       expect(last_response.headers['Content-Type']).to eq('image/png')
     end
     
+    it 'destroys all the loaded PSD layers' do
+      uri = Addressable::URI.parse(public_url_psd_multilayer)
+      ImageVise.add_allowed_host!(uri.host)
+      ImageVise.add_secret_key!('l33tness')
+
+      p = ImageVise::Pipeline.new.geom(geometry_string: '220x220')
+      image_request = ImageVise::ImageRequest.new(src_url: uri.to_s, pipeline: p)
+
+      class << app
+        def source_file_type_permitted?(type); true; end
+        def raise_exceptions?; true; end
+      end
+
+      # For each layer loaded into the ImageList
+      expect(ImageVise).to receive(:destroy).and_call_original.exactly(5).times
+      
+      get image_request.to_path_params('l33tness')
+      
+      expect(last_response.status).to eq(200)
+    end
+    
     it 'outputs a converted TIFF file as a PNG' do
       uri = Addressable::URI.parse(public_url_tif)
       ImageVise.add_allowed_host!(uri.host)

data/spec/spec_helper.rb

@@ -84,6 +84,10 @@ RSpec.configure do | config |
     'http://localhost:9001/waterside_magic_hour.psd'
   end
 
+  def public_url_psd_multilayer
+    'http://localhost:9001/layers-with-blending.psd'
+  end
+
   def public_url_tif
     'http://localhost:9001/waterside_magic_hour_gray.tif'
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: image_vise
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Julik Tarkhanov
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-10-22 00:00:00.000000000 Z
+date: 2016-10-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: patron
@@ -304,6 +304,7 @@ files:
 - spec/image_vise/srgb_spec.rb
 - spec/image_vise/strip_metadata_spec.rb
 - spec/image_vise_spec.rb
+- spec/layers-with-blending.psd
 - spec/spec_helper.rb
 - spec/test_server.rb
 - spec/waterside_magic_hour.jpg