rack-secure-upload 0.1.1 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: b036f4ac41ac68592044502068e7988049f23991
-  data.tar.gz: 840e4c8358d2dbb268f0487076b43de84a4bf32a
+  metadata.gz: b4b1eeae9fa091e56c7c3c2779f4528be8293df0
+  data.tar.gz: f132b4749d2b2c70723a33fb3a5d53e9581a0b09
 SHA512:
-  metadata.gz: 514c477f9022a3df886c57568bb8a737f98a7fd93f71b4c9cf922a7b9d8f2050e32de72795f1abcdf2b22477c9f27c9f794a4dbf00ad6eae6b8bc1ee3ced0d24
-  data.tar.gz: f71b8efc4bfa183ea50b97e48d72f86489464f20fa56a4e49b751a27a2a7b799086a78e826a71731136bc3cb75cd60c46b69a63c05978b03a313a16d809602d1
+  metadata.gz: 8ef3981f9f1b939c21b5a4a27bff38b680bfa45b15034249e31e5cd54af48164c041b324d069731a9a1542afce754c7f548b2c5a54897b1cfc9d1045240ed1ff
+  data.tar.gz: 0d5e0f6fddd51c324497ad14ab0394b9d7e95b6350ab5adbb72948c14d9d177c7a9e212e49d488013b61f939efe54d51bb95fb17dedf3a1bab9eea12cd3d728e

data/README.md

@@ -34,6 +34,23 @@ module MyApp
 end
 ```
 
+## Options
+
+You can add some options like below.
+
+```ruby
+use Rack::SecureUpload::Middleware, :fsecure, {foo: :bar}
+```
+
+### fallback
+
+- `proc { |env, params, path| }`
+  - use return value of proc
+- `:raise`
+  - raise `Rack::SecureUpload::InsecureFileError` |
+- else
+  - return `406`
+
 ## AntiVirus Softwares
 
 ### Avast

data/lib/rack/secure_upload/middleware.rb

@@ -9,30 +9,29 @@ module Rack
 
       def initialize(app, scanners, options = {})
         @app = app
-        @options = options
         @scanners = [scanners].flatten.map { |scanner| scanner.is_a?(Symbol) ? Rack::SecureUpload::Scanner.const_get(camelize(scanner.to_s)).new : scanner }
         @scanners.each do |scanner|
           scanner.setup
         end
+        @options = options
       end
 
       def call(env)
         params = Rack::Multipart.parse_multipart(env)
 
         if params && !params.empty?
-          begin
-            traverse(params) do |value|
-              next unless [Tempfile, File].any?{ |klass| value.is_a?(klass) }
-              scan value.path
-            end
-          rescue InsecureFileError => e
-            fallback = @options[:fallback]
-            if fallback.respond_to?(:call)
-              return fallback.call(env, params, e)
-            elsif fallback.to_s == 'raise'
-              raise
-            else
-              return [406, {'content-type' => 'text/plain; charset=UTF-8'}, ['Insecure File(s) are found!']]
+          traverse(params) do |value|
+            next unless [Tempfile, File].any?{ |klass| value.is_a?(klass) }
+
+            unless scan value.path
+              fallback = @options[:fallback]
+              if fallback.respond_to?(:call)
+                return fallback.call(env, params, value.path)
+              elsif fallback.to_s == 'raise'
+                raise InsecureFileError, "The uploaded file \"#{value.path}\" is insecure!"
+              else
+                return [406, {'content-type' => 'text/plain; charset=UTF-8'}, ['Insecure File(s) are found!']]
+              end
             end
           end
         end
@@ -43,13 +42,12 @@ module Rack
       private
 
       def scan(path)
-        secure = @scanners.any? do |scanner|
+        @scanners.any? do |scanner|
           unless res = scanner.scan(path)
             Rack::SecureUpload.logger.warn "#{scanner} found an insecure file: #{path}"
           end
           res
         end
-        raise InsecureFileError, "The uploaded file \"#{path}\" is insecure!" unless secure
       end
     end
   end

data/lib/rack/secure_upload/version.rb

@@ -1,5 +1,5 @@
 module Rack
   module SecureUpload
-    VERSION = "0.1.1"
+    VERSION = "0.1.2"
   end
 end

data/spec/rack/secure_upload/middleware_spec.rb

@@ -38,9 +38,9 @@ describe Rack::SecureUpload::Middleware do
       let(:options) { {fallback: fallback} }
 
       it "calls fallback" do
-        expect(fallback).to receive(:call)
+        expect(fallback).to receive(:call).and_return('yay')
         allow(scanner).to receive(:scan).and_return(false)
-        subject.call(env)
+        expect(subject.call(env)).to eq('yay')
       end
     end
     context "fallback is raise" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-secure-upload
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.2
 platform: ruby
 authors:
 - Daisuke Taniwaki