paperclip 4.3.5 → 4.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 33906ec8f0fa8be6fd6df7df38d355a736cd574a
-  data.tar.gz: de38c7e728dcfc5e938115706b27ba716475b8f3
+  metadata.gz: ab7608623c35bf152d8a5277f17938d75e29062a
+  data.tar.gz: 9522d62f5f590d9022abc2a086c5b1c7387a4eb0
 SHA512:
-  metadata.gz: 55a6e285fe1f1a7a32f4e15e05f73119047b3bbcb5e7c3bda18ef49c008d2cb2db4c407bf23b7d1da363f16a509cda486dbbee0d4de52e225d2497118231cc95
-  data.tar.gz: 8d85e18f6f1438538e8116cd93166362954700f8e4b31896b045cb1966ded6861d669b53057995caaa127a0918baed6076e414cdeab006e90678c78e434e360c
+  metadata.gz: fc30de9ee1182acb5d59ec0f172b5b309b55032fce3b14f466545c3f86d5e4e29deef045673fbd585a5a7a2268ba0172a8a87103135cb5236ace5058ed78fdab
+  data.tar.gz: 6a37ffebe6bfd71e8f4c8937adf6a4cafdf31365acd305274a4b38c631ad4ade53a5aa4bc2b1584a0716a3c2a048ddea0212e42edbbe2392f5e69c496b27bad5

data/NEWS

@@ -1,7 +1,13 @@
+4.3.6 (3/13/2016):
+
+* Bug Fix: When a spoofed media type is detected, megabytes of mime-types info are added to logs. See https://cwe.mitre.org/data/definitions/779.html.
+
 4.3.5 (2/8/2016):
+
 * Bug Fix: Remove deprecation warnings for v5.0 for now. Will re-add once the version has landed.
 
 4.3.4 (2/2/2016):
+
 * Bug Fix: Fix incompatible change from v4.3.3.
 
 4.3.3 (1/29/2016):

data/lib/paperclip/media_type_spoof_detector.rb

@@ -12,7 +12,7 @@ module Paperclip
 
     def spoofed?
       if has_name? && has_extension? && media_type_mismatch? && mapping_override_mismatch?
-        Paperclip.log("Content Type Spoof: Filename #{File.basename(@name)} (#{supplied_content_type} from Headers, #{content_types_from_name} from Extension), content type discovered from file command: #{calculated_content_type}. See documentation to allow this combination.")
+        Paperclip.log("Content Type Spoof: Filename #{File.basename(@name)} (#{supplied_content_type} from Headers, #{content_types_from_name.map(&:to_s)} from Extension), content type discovered from file command: #{calculated_content_type}. See documentation to allow this combination.")
         true
       else
         false

data/lib/paperclip/version.rb

@@ -1,3 +1,3 @@
 module Paperclip
-  VERSION = "4.3.5" unless defined? Paperclip::VERSION
+  VERSION = "4.3.6" unless defined? Paperclip::VERSION
 end

data/spec/paperclip/media_type_spoof_detector_spec.rb

@@ -44,9 +44,18 @@ describe Paperclip::MediaTypeSpoofDetector do
     end
   end
 
-  it "rejects a file if named .html and is as HTML, but we're told JPG" do
-    file = File.open(fixture_file("empty.html"))
-    assert Paperclip::MediaTypeSpoofDetector.using(file, "empty.html", "image/jpg").spoofed?
+  context "file named .html and is as HTML, but we're told JPG" do
+    let(:file) { File.open(fixture_file("empty.html")) }
+    let(:spoofed?) { Paperclip::MediaTypeSpoofDetector.using(file, "empty.html", "image/jpg").spoofed? }
+
+    it "rejects the file" do
+      assert spoofed?
+    end
+
+    it "logs info about the detected spoof" do
+      Paperclip.expects(:log).with('Content Type Spoof: Filename empty.html (image/jpg from Headers, ["text/html"] from Extension), content type discovered from file command: text/html. See documentation to allow this combination.')
+      spoofed?
+    end
   end
 
   it "does not reject if content_type is empty but otherwise checks out" do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: paperclip
 version: !ruby/object:Gem::Version
-  version: 4.3.5
+  version: 4.3.6
 platform: ruby
 authors:
 - Jon Yurek
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-08 00:00:00.000000000 Z
+date: 2016-03-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -708,4 +708,3 @@ test_files:
 - spec/support/rails_helpers.rb
 - spec/support/test_data.rb
 - spec/support/version_helper.rb
-has_rdoc: