paperclip 4.0.0 → 4.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 748ce579f297e0d58f7ee6e72b2968341af560be
-  data.tar.gz: 47ed54affca1e4c7736eddcb33dfac09763d871d
+  metadata.gz: d56fec1091044497580e29573ce29fcf2f67ecc9
+  data.tar.gz: d54575168a2aa162c760bae6a3a0a8246db6566b
 SHA512:
-  metadata.gz: 1337da62c00c9b10e151b8a1efd10b611d92c0601c3471bab99b57acbdf7c532e9714ce271c1bc01dbbc499aa71938ba5865b15ff44f1f68d7c0e919e24d00b8
-  data.tar.gz: e8fe2a23b8bc5fbbfc9e5ead740a42a6ff7ccb93c9cc452e10cd443b510560ac826d6ef1d3a6dcbefe5ce13bf4b8b7799fd7a6f290c26b27874ac166c89d501d
+  metadata.gz: debcaa74f90f8d01bab69a66b721e3b15bc1532584afb3be685259c4a7b565041362fe30df0fda7d747974c3e4195af3cf372bcbf7253e2f729c2cff8934eaf7
+  data.tar.gz: a80c28c4168be7c12d20b11f2de4b077756f4b4bf46bbd005d53e142aa0e61f769a16f8872847853500b43256b6444071c824dde06d475f2823c17f1402c2536

data/.travis.yml

@@ -7,7 +7,7 @@ rvm:
   - 2.1.0
 
 install:
-  - "bundle install"
+  - "travis_retry bundle install"
 
 before_script: "sudo ntpdate -ub ntp.ubuntu.com pool.ntp.org; true"
 script: "bundle exec rake clean test cucumber"

data/NEWS

@@ -1,10 +1,18 @@
+New in 4.1.0:
+
+* Improvement: Add :content_type_mappings to correct for missing spoof types
+* Improvement: Credit Egor Homakov with discovering the content_type spoof bug
+* Improvement: Memoize calls to identify in the thumbnail processor
+* Improvement: Make MIME type optional for Data URIs.
+* Improvement: Add default format for styles
+
 New in 4.0.0:
 
 * Security: Attachments are checked to make sure they're not pulling a fast one.
 * Security: It is now *enforced* that every attachment has a file/mime validation.
 * Bug Fix: Removed a call to IOAdapter#close that was causing issues.
 * Improvement: Added bullets to the 3.5.3 list of changes. Very important.
-* Improcement: Updated the copyright to 2014
+* Improvement: Updated the copyright to 2014
 
 New in 3.5.3:
 

data/README.md

@@ -307,6 +307,10 @@ inferred content_type, regardless of the actual contents of the file.
 Security Validations
 ====================
 
+Thanks to a report from [Egor Homakov](http://homakov.blogspot.com/) we have
+taken steps to prevent people from spoofing Content-Types and getting data
+you weren't expecting onto your server.
+
 NOTE: Starting at version 4.0.0, all attachments are *required* to include a
 content_type validation, a file_name validation, or to explicitly state that
 they're not going to have either. *Paperclip will raise an error* if you do not
@@ -329,12 +333,12 @@ with your filesystem.
 
 NOTE: Also starting at version 4.0.0, Paperclip has another validation that
 cannot be turned off. This validation will prevent content type spoofing. That
-is, uploading, say, a PHP document as part of the EXIF tags of a well-formed
-JPEG. This check is limited to the media type (the first part of the MIME type,
-so, 'text' in 'text/plain'). This will prevent HTML documents from being
-uploaded as JPEGs, but will not prevent GIFs from being uploaded with a .jpg
-extension. This validation will only add validation errors to the form. It will
-not cause Errors to be raised.
+is, uploading a PHP document (for example) as part of the EXIF tags of a
+well-formed JPEG. This check is limited to the media type (the first part of the
+MIME type, so, 'text' in 'text/plain'). This will prevent HTML documents from
+being uploaded as JPEGs, but will not prevent GIFs from being uploaded with a
+.jpg extension. This validation will only add validation errors to the form. It
+will not cause Errors to be raised.
 
 Defaults
 --------

data/lib/paperclip.rb

@@ -77,12 +77,13 @@ module Paperclip
   #   nil, which uses the first executable found in the user's search path.
   def self.options
     @options ||= {
-      :whiny             => true,
+      :whiny => true,
       :image_magick_path => nil,
-      :command_path      => nil,
-      :log               => true,
-      :log_command       => true,
-      :swallow_stderr    => true
+      :command_path => nil,
+      :log => true,
+      :log_command => true,
+      :swallow_stderr => true,
+      :content_type_mappings => {}
     }
   end
 

data/lib/paperclip/io_adapters/data_uri_adapter.rb

@@ -1,7 +1,7 @@
 module Paperclip
   class DataUriAdapter < StringioAdapter
 
-    REGEXP = /\Adata:([-\w]+\/[-\w\+]+);base64,(.*)/m
+    REGEXP = /\Adata:([-\w]+\/[-\w\+]+)?;base64,(.*)/m
 
     def initialize(target_uri)
       super(extract_target(target_uri))

data/lib/paperclip/media_type_spoof_detector.rb

@@ -10,19 +10,44 @@ module Paperclip
     end
 
     def spoofed?
-      if ! @name.blank?
-        ! supplied_file_media_type.include?(calculated_media_type)
+      if @name.present? && media_type_mismatch? && mapping_override_mismatch?
+        Paperclip.log("Content Type Spoof: Filename #{File.basename(@name)} (#{supplied_file_content_types}), content type discovered from file command: #{calculated_content_type}. See documentation to allow this combination.")
+        true
       end
     end
 
     private
 
-    def supplied_file_media_type
-      MIME::Types.type_for(@name).collect(&:media_type)
+    def media_type_mismatch?
+      ! supplied_file_media_types.include?(calculated_media_type)
+    end
+
+    def mapping_override_mismatch?
+      mapped_content_type != calculated_content_type
+    end
+
+    def supplied_file_media_types
+      @supplied_file_media_types ||= MIME::Types.type_for(@name).collect(&:media_type)
     end
 
     def calculated_media_type
-      type_from_file_command.split("/").first
+      @calculated_media_type ||= calculated_content_type.split("/").first
+    end
+
+    def supplied_file_content_types
+      @supplied_file_content_types ||= MIME::Types.type_for(@name).collect(&:content_type)
+    end
+
+    def calculated_content_type
+      @calculated_content_type ||= type_from_file_command.chomp
+    end
+
+    def mapped_content_type
+      Paperclip.options[:content_type_mappings][filename_extension]
+    end
+
+    def filename_extension
+      File.extname(@name.to_s.downcase).sub(/^\./, '').to_sym
     end
 
     def type_from_file_command

data/lib/paperclip/style.rb

@@ -29,7 +29,7 @@ module Paperclip
         @geometry, @format = [definition, nil].flatten[0..1]
         @other_args = {}
       end
-      @format  = nil if @format.blank?
+      @format = default_format if @format.blank?
     end
 
     # retrieves from the attachment the processors defined in the has_attached_file call
@@ -99,5 +99,11 @@ module Paperclip
       end
     end
 
+    # defaults to default format (nil by default)
+    def default_format
+      base = attachment.options[:default_format]
+      base.respond_to?(:call) ? base.call(attachment, name) : base
+    end
+
   end
 end

data/lib/paperclip/thumbnail.rb

@@ -109,7 +109,10 @@ module Paperclip
 
     # Return true if ImageMagick's +identify+ returns an animated format
     def identified_as_animated?
-      ANIMATED_FORMATS.include? identify("-format %m :file", :file => "#{@file.path}[0]").to_s.downcase.strip
+      if @identified_as_animated.nil?
+        @identified_as_animated = ANIMATED_FORMATS.include? identify("-format %m :file", :file => "#{@file.path}[0]").to_s.downcase.strip
+      end
+      @identified_as_animated
     rescue Cocaine::ExitStatusError => e
       raise Paperclip::Error, "There was an error running `identify` for #{@basename}" if @whiny
     rescue Cocaine::CommandNotFoundError => e

data/lib/paperclip/version.rb

@@ -1,3 +1,3 @@
 module Paperclip
-  VERSION = "4.0.0" unless defined? Paperclip::VERSION
+  VERSION = "4.1.0" unless defined? Paperclip::VERSION
 end

data/test/io_adapters/data_uri_adapter_test.rb

@@ -8,6 +8,11 @@ class DataUriAdapterTest < Test::Unit::TestCase
     end
   end
 
+  should 'allow a missing mime-type' do
+    adapter = Paperclip.io_adapters.for("data:;base64,#{original_base64_content}")
+    assert_equal Paperclip::DataUriAdapter, adapter.class
+  end
+
   context "a new instance" do
     setup do
       @contents = "data:image/png;base64,#{original_base64_content}"

data/test/media_type_spoof_detector_test.rb

@@ -25,4 +25,17 @@ class MediaTypeSpoofDetectorTest < Test::Unit::TestCase
     adapter = Paperclip.io_adapters.for(File.new(fixture_file("5k.png")))
     assert ! Paperclip::MediaTypeSpoofDetector.using(adapter, adapter.original_filename).spoofed?
   end
+
+  should 'not reject when the extension => content_type is in :content_type_mappings' do
+    begin
+      Paperclip.options[:content_type_mappings] = { pem: "text/plain" }
+      file = Tempfile.open(["test", ".PEM"])
+      file.puts "Certificate!"
+      file.close
+      adapter = Paperclip.io_adapters.for(File.new(file.path));
+      assert ! Paperclip::MediaTypeSpoofDetector.using(adapter, adapter.original_filename).spoofed?
+    ensure
+      Paperclip.options[:content_type_mappings] = {}
+    end
+  end
 end

data/test/style_test.rb

@@ -210,4 +210,42 @@ class StyleTest < Test::Unit::TestCase
       assert_equal "-do_extra_stuff", @attachment.styles[:large].processor_options[:source_file_options]
     end
   end
+
+  context "A style rule supplied with default format" do
+     setup do
+       @attachment = attachment :default_format => :png,
+                                :styles => {
+                                  :asstring => "300x300#",
+                                  :aslist => ["300x300#", :jpg],
+                                  :ashash => {
+                                    :geometry => "300x300#",
+                                    :convert_options => "-do_stuff"
+                                  }
+                                }
+     end
+
+     should "have the right number of styles" do
+       assert_kind_of Hash, @attachment.styles
+       assert_equal 3, @attachment.styles.size
+     end
+
+     should "have styles as Style objects" do
+       [:aslist, :ashash, :aslist].each do |s|
+         assert_kind_of Paperclip::Style, @attachment.styles[s]
+       end
+     end
+
+     should "have the right geometries" do
+       [:aslist, :ashash, :aslist].each do |s|
+         assert_equal @attachment.styles[s].geometry, "300x300#"
+       end
+     end
+
+     should "have the right formats" do
+       assert_equal @attachment.styles[:aslist].format,    :jpg
+       assert_equal @attachment.styles[:ashash].format,    :png
+       assert_equal @attachment.styles[:asstring].format,  :png
+     end
+
+   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paperclip
 version: !ruby/object:Gem::Version
-  version: 4.0.0
+  version: 4.1.0
 platform: ruby
 authors:
 - Jon Yurek
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-01-31 00:00:00.000000000 Z
+date: 2014-02-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel