malmal-rails 0.4.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 84adfebeeebe373dd5eacbb9ab94a94d7eb60ff3d388ef6f87016326013e83dd
+  data.tar.gz: 9645e507dc7332a7b9a0a85331ac32f04694dfe4650550d57f61e5d7195fa93a
+SHA512:
+  metadata.gz: 1474f3b5084175c8cd2a6db3ab9944e1e73fc0a836b4110f62b0debf4b3371240d755a501e43981c2661ae0e012a7b3f93b507fbce34f8f130328393efa5d36e
+  data.tar.gz: 5857cb2dda79c34cc144b7fd5d0088882457eaded7ec5b179a7ef2bf620e2158354a28e52ead7c59da00852dbbdd5729b755b82a336438b97335eaace6305008

data/LICENSE-APACHE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 nguyenthuan155632
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/LICENSE-MIT

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nguyenthuan155632
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,137 @@
+# malmal-rails
+
+Rails integration of the [malmal](https://github.com/nguyenthuan155632/malmal) upload
+scanner: an Active Storage validator, a scan of every stored blob, attachments rebuilt
+from what they draw, and one scanner for the application built from `config.malmal`.
+Rails 7.1 to 8.1, Ruby 3.2 or newer. The scanner itself is the
+[malmal](../malmal/README.md) gem, whose platform gems carry the library: no Rust needed.
+
+```bash
+bundle add malmal-rails
+bin/rails generate malmal:install     # writes config/initializers/malmal.rb
+```
+
+## Refusing an upload
+
+```ruby
+class Document < ApplicationRecord
+  has_one_attached :file
+  has_many_attached :pages
+  validates :file, malmal: true
+  validates :pages, malmal: { policy: :documents, types: %i[pdf] }
+end
+```
+
+The validator scans what is being attached, before it is uploaded: a file from a form,
+an `{io:, filename:}` hash, or a blob already stored (a direct upload, a signed id),
+which is read back up to the size limit. It uses the file name and the `Content-Type`
+the client gave. Attachments the record already has are not scanned again; every file of
+a `has_many_attached` is.
+
+A file that is not clean adds `:malmal_suspicious` or `:malmal_malicious` to the
+attribute, and one that could not be scanned `:malmal_error`. The details carry the
+finding codes and the file name:
+
+```ruby
+document.errors.details[:file]
+# => [{error: :malmal_malicious, filename: "photo.jpg", codes: ["type.executable"], count: 1}]
+document.errors.full_messages
+# => ["File could not be accepted: photo.jpg looks malicious"]
+```
+
+The messages are under `errors.messages.malmal_*` in `config/locales/en.yml`, to
+override or translate. The validator takes the scanning options (`policy`, `allow`,
+`types`, `max_memory`, `wait`, `pdf_passwords`), and `message:`; each set is built once
+into a scanner of its own. An unknown option raises when the model is loaded.
+
+## Rebuilding an attachment
+
+```ruby
+class User < ApplicationRecord
+  has_one_attached :avatar
+  sanitizes_attachment :avatar, types: %i[jpeg png webp]
+end
+```
+
+Before validation, the upload is replaced with a file written anew from its pixels, so
+nothing else from it is stored. The new file keeps the name of the upload, with the
+extension of its type, which is not always the type of the upload (a BMP becomes a PNG).
+A file that is not clean is refused as the validator does; one that cannot be rebuilt
+adds `:malmal_not_rebuilt`, or is kept as it was with `on_not_rebuilt: :keep`, which is
+best paired with the validator. The options are those of `Malmal::Scanner#sanitize`:
+`types`, `jpeg_quality`, `pdf_dpi`, `pdf_jpeg`, `pdf_text`, `pdf_vector_text`.
+
+## Stored blobs
+
+Direct uploads reach the storage service before any validation runs. With
+`config.malmal.scan_blobs` (on by default), every blob is scanned when Active Storage
+analyzes it, in the analyze job, and the result is kept in its metadata:
+
+```ruby
+blob.metadata["malmal"]  # => {"verdict" => "malicious", "codes" => ["type.executable"]}
+blob.malmal_clean?       # => false; nil before the scan
+```
+
+With `config.malmal.purge_unclean`, a blob that is not clean is purged, with its
+attachments.
+
+## Configuration
+
+```ruby
+# config/initializers/malmal.rb
+Rails.application.configure do
+  config.malmal.policy = :documents            # :default, :strict, :documents
+  config.malmal.allow = %w[pdf.xfa]
+  config.malmal.types = %i[jpeg png gif webp pdf]
+  config.malmal.limits = { max_size: 20.megabytes, scan_timeout: 10 }
+  config.malmal.max_memory = 256.megabytes
+  config.malmal.wait = 30
+  config.malmal.pdf_passwords = []
+  config.malmal.scan_blobs = true
+  config.malmal.purge_unclean = false
+  config.malmal.log_filenames = false
+end
+```
+
+`Malmal::Rails.scanner` is built from it on first use and shared by every thread. To
+scan with a running `malmald` instead, which gives the sandbox and `--hard-timeout`:
+
+```ruby
+config.malmal.client_url = "http://127.0.0.1:8080"
+config.malmal.client_token = ENV["MALMAL_TOKEN"]
+```
+
+The scanning options are then the daemon's flags, and a validator that sets its own
+raises `ArgumentError`.
+
+## Instrumentation
+
+Each scan is an `ActiveSupport::Notifications` event `scan.malmal`, and each rebuild
+`sanitize.malmal`; the payload has `filename`, `content_type`, and `report` or
+`sanitized`. A scan that is not clean is logged as a warning, with its codes, and with
+the file name only when `config.malmal.log_filenames` is on.
+
+```ruby
+ActiveSupport::Notifications.subscribe("scan.malmal") do |event|
+  StatsD.increment("uploads.#{event.payload[:report].verdict}")
+end
+```
+
+`Malmal::Rails.scan(io, filename:)` and `Malmal::Rails.sanitize` scan outside a model
+with the same scanner and events.
+
+## Development
+
+```bash
+cargo build --release -p malmal-ffi
+cd bindings/ruby/malmal-rails
+bundle install
+MALMAL_LIBRARY=../../../target/release/libmalmal_ffi.so bundle exec rake test
+BUNDLE_GEMFILE=gemfiles/rails_7_1.gemfile bundle install   # another Rails
+```
+
+[examples/rails](../../../examples/rails) is an application that uses all of it.
+
+## License
+
+MIT or Apache-2.0, at your option.

data/config/locales/en.yml

@@ -0,0 +1,7 @@
+en:
+  errors:
+    messages:
+      malmal_suspicious: "could not be accepted: %{filename} looks suspicious"
+      malmal_malicious: "could not be accepted: %{filename} looks malicious"
+      malmal_error: "could not be checked; try again"
+      malmal_not_rebuilt: "could not be accepted: %{filename} is not a file that can be rebuilt"

data/lib/generators/malmal/install/install_generator.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require "rails/generators/base"
+
+module Malmal
+  module Generators
+    # bin/rails generate malmal:install
+    class InstallGenerator < ::Rails::Generators::Base
+      source_root File.expand_path("templates", __dir__)
+      desc "Writes config/initializers/malmal.rb, where the scanner is configured."
+
+      def copy_initializer
+        template "malmal.rb", "config/initializers/malmal.rb"
+      end
+    end
+  end
+end

data/lib/generators/malmal/install/templates/malmal.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+# The scanner the application uses for every upload. See
+# https://github.com/nguyenthuan155632/malmal/tree/main/bindings/ruby/malmal-rails
+Rails.application.configure do
+  # :default, :strict, or :documents (XFA forms and attachments in PDFs do not
+  # count against a file; what they contain still does).
+  config.malmal.policy = :default
+
+  # Finding codes that do not count against a file (docs/findings.md).
+  # config.malmal.allow = %w[pdf.xfa]
+
+  # The file types accepted; every supported type when nil.
+  # config.malmal.types = %i[jpeg png gif webp pdf]
+
+  # The limits of one scan.
+  # config.malmal.limits = { max_size: 20.megabytes, scan_timeout: 10 }
+
+  # Answer within this many seconds even if a step of a scan never ends.
+  # config.malmal.wait = 30
+
+  # Scan with a running malmald instead of in this process.
+  # config.malmal.client_url = "http://127.0.0.1:8080"
+  # config.malmal.client_token = ENV["MALMAL_TOKEN"]
+
+  # Scan every stored blob when Active Storage analyzes it, and record the
+  # result in blob.metadata["malmal"].
+  config.malmal.scan_blobs = true
+
+  # Purge a stored blob that is not clean, with its attachments.
+  config.malmal.purge_unclean = false
+
+  # Log the names of files that are not clean.
+  config.malmal.log_filenames = false
+end

data/lib/malmal/rails/attachables.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Malmal
+  module Rails
+    # What is being attached to a record, read back from Active Storage's
+    # pending changes before anything is uploaded.
+    module Attachables
+      # One file being attached: its bytes come from +io+ (an upload not yet
+      # stored) or from +blob+ (one already stored, as after a direct upload).
+      Upload = Struct.new(:attachable, :blob, :filename, :content_type, :io, keyword_init: true) do
+        def stored?
+          io.nil?
+        end
+      end
+
+      module_function
+
+      # The uploads that +record+ is about to attach as +name+; none when
+      # nothing new is being attached.
+      def pending(record, name)
+        return [] unless record.respond_to?(:attachment_changes)
+
+        change = record.attachment_changes[name.to_s]
+        pairs = case change
+                when ::ActiveStorage::Attached::Changes::CreateOne
+                  [[change.attachable, change.blob]]
+                when ::ActiveStorage::Attached::Changes::CreateMany
+                  change.attachables.zip(change.blobs)
+                else
+                  []
+                end
+        pairs.filter_map { |attachable, blob| upload(attachable, blob) }
+      end
+
+      def upload(attachable, blob)
+        case attachable
+        when ::ActiveStorage::Blob, ::ActiveStorage::Attachment, String
+          return nil if already_attached?(blob)
+
+          Upload.new(attachable: attachable, blob: blob, filename: blob.filename.to_s,
+                     content_type: blob.content_type)
+        when Hash
+          options = attachable.symbolize_keys
+          Upload.new(attachable: attachable, blob: blob, io: options.fetch(:io),
+                     filename: options[:filename].to_s, content_type: options[:content_type])
+        else
+          io = attachable.respond_to?(:tempfile) ? attachable.tempfile : attachable
+          filename = attachable.respond_to?(:original_filename) ? attachable.original_filename : blob.filename.to_s
+          content_type = attachable.respond_to?(:content_type) ? attachable.content_type : blob.content_type
+          Upload.new(attachable: attachable, blob: blob, io: io, filename: filename.to_s, content_type: content_type)
+        end
+      end
+
+      # A blob the record already had is not scanned again on every save.
+      def already_attached?(blob)
+        blob.persisted? && blob.attachments.exists?
+      end
+
+      # The bytes of an upload, at most +limit+ of them.
+      def read(upload, limit)
+        return read_stored(upload.blob, limit) if upload.stored?
+
+        io = upload.io
+        io.rewind if io.respond_to?(:rewind)
+        bytes = io.read(limit) || +""
+        io.rewind if io.respond_to?(:rewind)
+        bytes.b
+      end
+
+      def read_stored(blob, limit)
+        return blob.download_chunk(0...limit).b if blob.byte_size.to_i > limit
+
+        blob.download.b
+      end
+    end
+  end
+end

data/lib/malmal/rails/blob_scan.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Malmal
+  module Rails
+    # Scans a stored blob when Active Storage analyzes it, which it does in a
+    # job after every upload, direct ones included, and records the result
+    # in its metadata:
+    #
+    #   blob.metadata["malmal"]  # => {"verdict" => "malicious", "codes" => ["type.executable"]}
+    #   blob.malmal_clean?       # => false
+    #
+    # With +config.malmal.purge_unclean+, a blob that is not clean is purged,
+    # with its attachments. Validations do not see direct uploads until the
+    # record is saved; this is what catches the ones that are never attached.
+    module BlobScan
+      module_function
+
+      def call(blob)
+        return unless Malmal::Rails.config.scan_blobs
+
+        report = Malmal::Rails.scan(read(blob), filename: blob.filename.to_s, content_type: blob.content_type)
+        record(blob, report.verdict.to_s, report.codes)
+        purge(blob) if !report.clean? && Malmal::Rails.config.purge_unclean
+      rescue Malmal::ScanError, Malmal::LoadError => e
+        Malmal::Rails.logger&.error("[malmal] blob #{blob.id} was not scanned: #{e.message}")
+        record(blob, "error", [])
+        purge(blob) if Malmal::Rails.config.purge_unclean
+      end
+
+      def read(blob)
+        Attachables.read_stored(blob, Malmal::Rails.read_limit)
+      end
+
+      def record(blob, verdict, codes)
+        result = { "verdict" => verdict, "codes" => codes, "version" => Malmal::VERSION }
+        blob.update!(metadata: blob.metadata.merge("malmal" => result))
+      end
+
+      def purge(blob)
+        Malmal::Rails.logger&.warn("[malmal] purging blob #{blob.id}, which is not clean")
+        attachments = blob.attachments.to_a
+        if attachments.empty?
+          blob.purge
+        else
+          attachments.each(&:purge)
+        end
+      end
+
+      # Included in ActiveStorage::Blob.
+      module Blob
+        def analyze
+          super
+          Malmal::Rails::BlobScan.call(self)
+        end
+
+        # Whether the last scan of this blob came back clean; nil if it has
+        # not been scanned.
+        def malmal_clean?
+          verdict = metadata.dig("malmal", "verdict")
+          verdict && verdict == "clean"
+        end
+      end
+    end
+  end
+end

data/lib/malmal/rails/railtie.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "rails/railtie"
+
+module Malmal
+  module Rails
+    # Sets up +config.malmal+, the validator, the scans of stored blobs and
+    # +sanitizes_attachment+.
+    class Railtie < ::Rails::Railtie
+      config.malmal = Malmal::Rails.config
+
+      initializer "malmal.config" do |app|
+        Malmal::Rails.config = app.config.malmal
+        Malmal::Rails.reset!
+      end
+
+      initializer "malmal.i18n" do
+        ActiveSupport.on_load(:i18n) do
+          I18n.load_path << File.expand_path("../../../config/locales/en.yml", __dir__)
+        end
+      end
+
+      initializer "malmal.active_record" do
+        ActiveSupport.on_load(:active_record) do
+          include Malmal::Rails::SanitizesAttachment
+        end
+      end
+
+      initializer "malmal.active_storage" do
+        ActiveSupport.on_load(:active_storage_blob) do
+          prepend Malmal::Rails::BlobScan::Blob
+        end
+      end
+
+      generators do
+        require_relative "../../generators/malmal/install/install_generator"
+      end
+    end
+  end
+end

data/lib/malmal/rails/sanitizes_attachment.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "active_support/concern"
+require "stringio"
+
+module Malmal
+  module Rails
+    # Replaces what is attached with a file written anew from what it draws,
+    # before the record is validated, so that nothing else from the upload
+    # is stored:
+    #
+    #   class User < ApplicationRecord
+    #     has_one_attached :avatar
+    #     sanitizes_attachment :avatar, types: %i[jpeg png webp]
+    #   end
+    #
+    # The new file keeps the name of the upload, with the extension of its
+    # type, which is not always the type of the upload (a BMP becomes a PNG).
+    # An upload that is not clean adds +:malmal_suspicious+ or
+    # +:malmal_malicious+ to the attribute; one that cannot be rebuilt adds
+    # +:malmal_not_rebuilt+, or is kept as it was with
+    # <tt>on_not_rebuilt: :keep</tt> (pair that with the validator). Other
+    # options are those of Malmal::Scanner#sanitize: +types+, +jpeg_quality+,
+    # +pdf_dpi+, +pdf_jpeg+, +pdf_text+, +pdf_vector_text+.
+    module SanitizesAttachment
+      extend ActiveSupport::Concern
+
+      ON_NOT_REBUILT = %i[reject keep].freeze
+
+      class_methods do
+        def sanitizes_attachment(*names, on_not_rebuilt: :reject, **options)
+          unless ON_NOT_REBUILT.include?(on_not_rebuilt)
+            raise ArgumentError, "on_not_rebuilt is :reject or :keep, not #{on_not_rebuilt.inspect}"
+          end
+
+          unknown = options.keys - Malmal::Scanner::SANITIZE_OPTIONS - [:jpeg_quality]
+          raise ArgumentError, "unknown option #{unknown.first.inspect}" unless unknown.empty?
+
+          names.each do |name|
+            before_validation { malmal_sanitize_attachment(name, on_not_rebuilt, options) }
+            validate { malmal_sanitize_errors(name) }
+          end
+        end
+      end
+
+      private
+
+      def malmal_sanitize_attachment(name, on_not_rebuilt, options)
+        uploads = Attachables.pending(self, name)
+        return if uploads.empty?
+
+        failures = (@malmal_sanitize_failures ||= {})[name.to_s] = []
+        rebuilt = uploads.map do |upload|
+          malmal_rebuild(upload, on_not_rebuilt, options, failures)
+        end
+        return unless failures.empty?
+
+        many = attachment_changes[name.to_s].is_a?(::ActiveStorage::Attached::Changes::CreateMany)
+        public_send(:"#{name}=", many ? keep_existing(name, rebuilt) : rebuilt.first)
+      end
+
+      def malmal_rebuild(upload, on_not_rebuilt, options, failures)
+        data = Attachables.read(upload, Malmal::Rails.read_limit)
+        sanitized = Malmal::Rails.sanitize(data, filename: upload.filename, content_type: upload.content_type,
+                                                 **options)
+        { io: StringIO.new(sanitized.data), filename: rebuilt_filename(upload.filename, sanitized),
+          content_type: sanitized.content_type }
+      rescue Malmal::Rejected => e
+        failures << [:"malmal_#{e.report.verdict}", upload, e.report.codes]
+        nil
+      rescue Malmal::NotRebuilt
+        failures << [:malmal_not_rebuilt, upload, []] if on_not_rebuilt == :reject
+        upload.attachable
+      rescue Malmal::ScanError, Malmal::LoadError => e
+        Malmal::Rails.logger&.error("[malmal] #{upload.filename.inspect} was not rebuilt: #{e.message}")
+        failures << [:malmal_error, upload, []]
+        nil
+      end
+
+      # A has_many_attached assignment replaces every attachment; the ones
+      # the record had are given back as they were.
+      def keep_existing(name, rebuilt)
+        change = attachment_changes[name.to_s]
+        pending = Attachables.pending(self, name).map(&:attachable)
+        queue = rebuilt.dup
+        change.attachables.map { |attachable| pending.include?(attachable) ? queue.shift : attachable }
+      end
+
+      def rebuilt_filename(filename, sanitized)
+        base = File.basename(filename.to_s, ".*")
+        base = "file" if base.empty?
+        "#{base}#{sanitized.extension}"
+      end
+
+      def malmal_sanitize_errors(name)
+        Array(@malmal_sanitize_failures&.delete(name.to_s)).each do |error, upload, codes|
+          errors.add(name, error, filename: upload.filename, codes: codes, count: codes.size)
+        end
+      end
+    end
+  end
+end

data/lib/malmal/rails/validator.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "active_model"
+
+module Malmal
+  module Rails
+    # Validates what is being attached to an Active Storage attachment:
+    #
+    #   class Document < ApplicationRecord
+    #     has_one_attached :file
+    #     validates :file, malmal: true
+    #     # or: validates :file, malmal: { policy: :documents, types: %i[pdf png jpeg] }
+    #   end
+    #
+    # Each new upload is scanned before it is stored, with the file name and
+    # Content-Type the client gave; a blob already stored (a direct upload,
+    # a signed id) is read back and scanned. Attachments the record already
+    # had are not scanned again. A file that is not clean adds an error to
+    # the attribute: +:malmal_suspicious+, +:malmal_malicious+, or
+    # +:malmal_error+ when it could not be scanned, with the finding codes in
+    # +errors.details+ (+codes:+) and the file name (+filename:+).
+    #
+    # Options: +policy+, +allow+, +types+, +max_memory+, +wait+ and
+    # +pdf_passwords+ build a scanner of their own from +config.malmal+ with
+    # those changes. +message+ replaces the error message, as with any
+    # validator.
+    class Validator < ::ActiveModel::EachValidator
+      def check_validity!
+        unknown = options.keys - SCANNER_OPTIONS - %i[message if unless on allow_nil allow_blank strict]
+        raise ArgumentError, "unknown malmal option #{unknown.first.inspect}" unless unknown.empty?
+      end
+
+      def validate_each(record, attribute, _value)
+        Attachables.pending(record, attribute).each do |upload|
+          check(record, attribute, upload)
+        end
+      end
+
+      private
+
+      def check(record, attribute, upload)
+        data = Attachables.read(upload, Malmal::Rails.read_limit)
+        report = Malmal::Rails.scan(data, filename: upload.filename, content_type: upload.content_type,
+                                          scanner: Malmal::Rails.scanner_for(options))
+        return if report.clean?
+
+        add(record, attribute, :"malmal_#{report.verdict}", upload, report.codes)
+      rescue Malmal::ScanError, Malmal::LoadError => e
+        Malmal::Rails.logger&.error("[malmal] #{upload.filename.inspect} was not scanned: #{e.message}")
+        add(record, attribute, :malmal_error, upload, [])
+      end
+
+      def add(record, attribute, error, upload, codes)
+        details = { filename: upload.filename, codes: codes, count: codes.size }
+        details[:message] = options[:message] if options[:message]
+        record.errors.add(attribute, error, **details)
+      end
+    end
+  end
+end
+
+# `validates :file, malmal: true` looks the validator up by this name.
+MalmalValidator = Malmal::Rails::Validator unless defined?(MalmalValidator)

data/lib/malmal/rails/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Malmal
+  module Rails
+    VERSION = Malmal::VERSION
+  end
+end

data/lib/malmal/rails.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require "malmal"
+require "active_support"
+require "active_support/core_ext/module/attribute_accessors"
+require "active_support/ordered_options"
+
+module Malmal
+  # Rails integration: one scanner for the application, built from
+  # +config.malmal+, an Active Storage validator, scans of stored blobs, and
+  # attachments rebuilt from what they draw.
+  module Rails
+    # The options +config.malmal+ starts with.
+    DEFAULTS = {
+      policy: :default,
+      allow: [],
+      types: nil,
+      limits: {},
+      max_memory: Malmal::Scanner::DEFAULT_MAX_MEMORY,
+      wait: nil,
+      pdf_passwords: [],
+      client_url: nil,
+      client_token: nil,
+      scan_blobs: true,
+      purge_unclean: false,
+      log_filenames: false
+    }.freeze
+
+    SCANNER_OPTIONS = %i[policy allow types max_memory wait pdf_passwords].freeze
+
+    LOCK = Mutex.new
+    private_constant :LOCK
+
+    class << self
+      # The options in use; in an application, +config.malmal+.
+      def config
+        @config ||= ActiveSupport::OrderedOptions.new.merge!(DEFAULTS.deep_dup)
+      end
+
+      attr_writer :config
+
+      # What scans for the application: a Malmal::Scanner, or a
+      # Malmal::Client when +client_url+ is set. Built on first use, then
+      # shared by every thread.
+      def scanner
+        @scanner || LOCK.synchronize { @scanner ||= build(config) }
+      end
+
+      # A scanner with +overrides+ of the scanning options of +config+, for a
+      # validator that asks for its own policy or types; built once for each
+      # set of overrides.
+      def scanner_for(overrides)
+        overrides = overrides.slice(*SCANNER_OPTIONS)
+        return scanner if overrides.empty?
+
+        if config.client_url
+          raise ArgumentError, "#{overrides.keys.join(", ")} cannot be set per validator when scanning with malmald; " \
+                               "start the daemon with them instead"
+        end
+        LOCK.synchronize do
+          @scanners ||= {}
+          @scanners[overrides] ||= build(config.merge(overrides))
+        end
+      end
+
+      # Forget the scanners built so far, so that the next scan builds them
+      # from the configuration again.
+      def reset!
+        LOCK.synchronize do
+          @scanner = nil
+          @scanners = nil
+        end
+      end
+
+      # Scan +data+ (a String or an IO) with +scanner+, and tell
+      # ActiveSupport::Notifications (+scan.malmal+) and the log about it.
+      def scan(data, filename: nil, content_type: nil, scanner: self.scanner)
+        payload = { filename: filename, content_type: content_type }
+        report = ActiveSupport::Notifications.instrument("scan.malmal", payload) do
+          payload[:report] = scanner.scan(data, filename: filename, content_type: content_type)
+        end
+        log(report, filename) unless report.clean?
+        report
+      end
+
+      # Rebuild +data+ with +scanner+; +sanitize.malmal+ is instrumented.
+      def sanitize(data, filename: nil, content_type: nil, scanner: self.scanner, **options)
+        payload = { filename: filename, content_type: content_type }
+        ActiveSupport::Notifications.instrument("sanitize.malmal", payload) do
+          payload[:sanitized] = scanner.sanitize(data, filename: filename, content_type: content_type, **options)
+        end
+      end
+
+      # The size limit of a scan and one byte past it: what is read of an
+      # upload, so that an oversized one is reported as such.
+      def read_limit
+        limits = (config.limits || {}).to_h.symbolize_keys
+        (limits[:max_size] || (64 << 20)) + 1
+      end
+
+      def logger
+        defined?(::Rails.logger) && ::Rails.logger ? ::Rails.logger : nil
+      end
+
+      private
+
+      def build(options)
+        return Malmal::Client.new(options[:client_url], token: options[:client_token]) if options[:client_url]
+
+        Malmal::Scanner.new(
+          policy: options[:policy] || :default,
+          allow: options[:allow] || [],
+          types: options[:types],
+          pdf_passwords: options[:pdf_passwords] || [],
+          max_memory: options[:max_memory],
+          wait: options[:wait],
+          **(options[:limits] || {}).to_h.symbolize_keys
+        )
+      end
+
+      def log(report, filename)
+        return unless logger
+
+        name = config.log_filenames && filename ? " #{filename.inspect}" : ""
+        logger.warn("[malmal] #{report.verdict} upload#{name}: #{report.codes.join(", ")}")
+      end
+    end
+  end
+end
+
+require_relative "rails/version"
+require_relative "rails/attachables"
+require_relative "rails/validator"
+require_relative "rails/blob_scan"
+require_relative "rails/sanitizes_attachment"
+require_relative "rails/railtie" if defined?(Rails::Railtie)

data/lib/malmal-rails.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require "malmal/rails"

metadata

@@ -0,0 +1,115 @@
+--- !ruby/object:Gem::Specification
+name: malmal-rails
+version: !ruby/object:Gem::Version
+  version: 0.4.0
+platform: ruby
+authors:
+- nguyenthuan155632
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: activestorage
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+- !ruby/object:Gem::Dependency
+  name: malmal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.4.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.4.0
+- !ruby/object:Gem::Dependency
+  name: railties
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '7.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '9'
+description: |
+  Rails integration for the malmal upload scanner: a validator for Active Storage
+  attachments, scans of stored blobs (direct uploads included) recorded in their
+  metadata, attachments rebuilt from what they draw, and config.malmal.
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE-APACHE
+- LICENSE-MIT
+- README.md
+- config/locales/en.yml
+- lib/generators/malmal/install/install_generator.rb
+- lib/generators/malmal/install/templates/malmal.rb
+- lib/malmal-rails.rb
+- lib/malmal/rails.rb
+- lib/malmal/rails/attachables.rb
+- lib/malmal/rails/blob_scan.rb
+- lib/malmal/rails/railtie.rb
+- lib/malmal/rails/sanitizes_attachment.rb
+- lib/malmal/rails/validator.rb
+- lib/malmal/rails/version.rb
+homepage: https://github.com/nguyenthuan155632/malmal
+licenses:
+- MIT
+- Apache-2.0
+metadata:
+  homepage_uri: https://github.com/nguyenthuan155632/malmal
+  source_code_uri: https://github.com/nguyenthuan155632/malmal/tree/main/bindings/ruby/malmal-rails
+  changelog_uri: https://github.com/nguyenthuan155632/malmal/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/nguyenthuan155632/malmal/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Scan and rebuild Active Storage uploads with malmal
+test_files: []