kt-paperclip 8.0.0 → 8.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 57acb40c010d089179840fb06116bb36527035ce5e6ddaa25531d2d24067456f
-  data.tar.gz: f49b37dbd63550be17c59b47ce930981dae6f7d88461cf90721925051e579efa
+  metadata.gz: 71b12469bab65eb2861d1170c154ecf1a08f6a0591806096f3d49f598f4ec115
+  data.tar.gz: 12efe7db20633834994b3b1836cc697ff21dbf1bd37851346d1bd5e0961aa045
 SHA512:
-  metadata.gz: f92b7453a259e25763375ba727dc262910ec647e54017182befa98e0330e6ac5890cd76ab27476a3be6725de35aeb8b85f73db463ad75007370d0076ed3220bb
-  data.tar.gz: dae535db1d37087c4505aaa0db691c2e300377755c9345ef412a28dfde1bf55f64f169d6f438d0285672db9bc8681629708c1c366e719cfcb2773d89f6ad5906
+  metadata.gz: 6db416b89eaa01127e3b8eb7ac7615a19d840a236ea114be4814675d61765fa53f25e25b351b5d9438badf06ab3a20ec036565a418f47dbbcd97563d96e0f91f
+  data.tar.gz: 8aa390b628e9926d17c9de71e0dfe861fe2197762fff916064e1b61bd18fda5e3d2f6eda291d4e208e36ecb2fa3fc98ca366e5a28c479f7dde00b02736be2765

data/README.md

@@ -90,7 +90,7 @@ Requirements
 
 ### Ruby and Rails
 
-Paperclip now requires Ruby version **>= 2.3** and Rails version **>= 4.2**
+Paperclip now requires Ruby version **>= 2.7** and Rails version **>= 5.2**
 (only if you're going to use Paperclip with Ruby on Rails).
 
 ### ImageMagick Image Processor
@@ -139,7 +139,7 @@ Paperclip is distributed as a gem, which is how it should be used in your app.
 Include the gem in your Gemfile:
 
 ```ruby
-gem "kt-paperclip", "~> 6.4", ">= 6.4.1"
+gem "kt-paperclip", "~> 8.0"
 ```
 
 Or, if you want to get the latest, you can get master from the main paperclip repository:
@@ -375,8 +375,10 @@ validates_attachment :avatar,
   content_type: ["image/jpeg", "image/gif", "image/png"]
 ```
 
-`Paperclip::ContentTypeDetector` will attempt to match a file's extension to an
-inferred content_type, regardless of the actual contents of the file.
+`Paperclip::ContentTypeDetector` uses the file's extension as a hint when the contents alone are
+ambiguous, so the stored `content_type` is not by itself proof of what a file contains. The check
+that ignores the filename entirely is `validates_media_type_spoof_detection` (see Security
+Validations below); use it alongside your `content_type` validation.
 
 ### Duplicate error messages
 
@@ -444,17 +446,26 @@ being uploaded as JPEGs, but will not prevent GIFs from being uploaded with a
 `.jpg` extension. This validation will only add validation errors to the form. It
 will not cause errors to be raised.
 
+The type is detected from the file's contents only, using magic-number detection plus the Unix
+`file` utility. The filename is never consulted. Where `file` is unavailable the check falls back
+to magic-number detection alone, which cannot identify text-based formats; content it cannot
+identify at all is accepted rather than rejected.
+
 This can sometimes cause false validation errors in applications that use custom
 file extensions. In these cases you may wish to add your custom extension to the
 list of content type mappings by creating `config/initializers/paperclip.rb`:
 
 ```ruby
-# Allow ".foo" as an extension for files with the MIME type "text/plain".
+# Allow ".foo" as an extension for files whose contents are detected as "text/plain".
 Paperclip.options[:content_type_mappings] = {
   foo: %w(text/plain)
 }
 ```
 
+The value is the type the *contents* detect as (what `file -b --mime` reports), not the type you
+would like the extension to mean. Text-based formats such as SVG and CSV are the usual reason to
+need one.
+
 ---
 
 Defaults

data/lib/paperclip/media_type_spoof_detector.rb

@@ -42,12 +42,27 @@ module Paperclip
     end
 
     def calculated_type_mismatch?
-      supplied_media_type.present? &&
-        !calculated_content_type.include?(supplied_media_type)
+      return false if supplied_media_type.blank?
+      # Fast path: the magic number already supports the supplied type, no shell out needed.
+      return false if supplied_type_consistent_with?(type_from_magic)
+      # The bytes told us nothing at all, so there is nothing to contradict the supplied type.
+      return false if calculated_content_types.empty?
+
+      !supplied_type_consistent_with?(type_from_file_command)
+    end
+
+    # The supplied type is supported by the bytes if it shares their media type, or if it is a
+    # specialization of what the bytes resolved to: image/svg+xml is a child of application/xml,
+    # which is all the magic number of an SVG with an XML declaration can tell us.
+    def supplied_type_consistent_with?(type)
+      return false if type.blank?
+
+      type.include?(supplied_media_type) ||
+        !!Marcel::Magic.child?(supplied_content_type, type)
     end
 
     def mapping_override_mismatch?
-      !Array(mapped_content_type).include?(calculated_content_type)
+      (Array(mapped_content_type) & calculated_content_types).empty?
     end
 
     def supplied_content_type
@@ -66,12 +81,35 @@ module Paperclip
       @media_types_from_name ||= content_types_from_name.collect(&:media_type)
     end
 
+    # Every type the file's *contents* resolve to. The filename is deliberately never consulted
+    # here -- trusting it is what let a renamed file pass this check (kreeti/kt-paperclip#173).
+    def calculated_content_types
+      @calculated_content_types ||=
+        # Both sources return nil, never a blank string, when they come up empty.
+        [type_from_magic, type_from_file_command].compact.uniq
+    end
+
     def calculated_content_type
-      @calculated_content_type ||= ContentTypeDetector.new(@file.path).detect("")
+      @calculated_content_type ||= calculated_content_types.first.to_s
     end
 
-    def calculated_media_type
-      @calculated_media_type ||= calculated_content_type.split("/").first
+    # Note the absence of a `name:` argument. Marcel lets the filename decide when the bytes carry
+    # no magic number of their own, which is exactly what spoof detection must not allow.
+    def type_from_magic
+      return @type_from_magic if defined?(@type_from_magic)
+
+      type = Marcel::MimeType.for(Pathname.new(@file.path))
+      # Marcel::MimeType returns 'application/octet-stream' if it can't find a valid type.
+      @type_from_magic = type == ContentTypeDetector::SENSIBLE_DEFAULT ? nil : type
+    rescue Errno::ENOENT => e
+      Paperclip.log("Error while determining content type: #{e}")
+      @type_from_magic = nil
+    end
+
+    def type_from_file_command
+      return @type_from_file_command if defined?(@type_from_file_command)
+
+      @type_from_file_command = Commands::UnixFile.detect_content_type(@file.path)
     end
 
     def mapped_content_type

data/lib/paperclip/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Paperclip
-  VERSION = "8.0.0" unless defined?(Paperclip::VERSION)
+  VERSION = "8.0.1" unless defined?(Paperclip::VERSION)
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kt-paperclip
 version: !ruby/object:Gem::Version
-  version: 8.0.0
+  version: 8.0.1
 platform: ruby
 authors:
 - Surendra Singhi
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-30 00:00:00.000000000 Z
+date: 2026-10-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel