railspress-engine 1.4.2 → 1.4.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 31c5fcfdceafda233cf359ad98c33f48ea0275bff7f2b03231ec8c677da4b386
-  data.tar.gz: 82630b73922aec435c33001b58502c7e269dbfe0a1e11d9f48426efea2790bda
+  metadata.gz: 48860d966cd3cdc8832ba51098ea94bf8b7264608105231af1b7871d4576d1c8
+  data.tar.gz: e4e9e1631fa9127c0c221e08c081e5280e85a7f7f7f3716814033f722aac921b
 SHA512:
-  metadata.gz: 842759409eb11ee54e5ff0195461c2e652d73769b853e3f083592ab59d67f79a5cf4612fb92be2ab15a4d0cca59105edcda6c06912bafc30b4c63052261a0269
-  data.tar.gz: be4b34483192cd1254c4f7bd58495a4de38ef7a40893ef58b664af2cf8ac20c98f23ab4adf50c87237c590ed8dfddfcd73e1ae4e14a9933ff38202c2eb199468
+  metadata.gz: 0523661e660f0d5490b95282ed786669282ea2edfe29a84397fafd10c22e1c599d383a9a40c4b3e2c1e9efa4476a82e24a5236a231c44d27041355986a100803
+  data.tar.gz: 699ae2eba634ef60e19f7c18b8f98bbd3470c61dcaa750eeff7d6ece5a07436bd33ab19e37740540f93f3621c3961bb3066abcb650717d1658cbc8b24232a97d

data/README.md

@@ -157,6 +157,16 @@ end
 
 See [CONFIGURING.md](docs/CONFIGURING.md) for more authentication patterns including Devise integration.
 
+## Import Security
+
+RailsPress stores imported files inside engine-owned temporary directories.
+
+ZIP image references cannot escape their extraction directory.
+
+Remote header images accept public HTTP and HTTPS destinations. Private and redirected destinations are rejected.
+
+Configure request and worker limits for additional availability protection.
+
 ## Quick Start
 
 Access the admin at `/railspress/admin`. From there you can manage posts, entities, and blocks.

data/app/controllers/railspress/admin/imports_controller.rb

@@ -1,6 +1,8 @@
 module Railspress
   module Admin
     class ImportsController < BaseController
+      SUPPORTED_IMPORT_EXTENSIONS = %w[.md .markdown .txt .zip].freeze
+
       before_action :validate_import_type, only: [ :show ]
 
       def show
@@ -53,11 +55,18 @@ module Railspress
         FileUtils.mkdir_p(upload_dir)
 
         uploaded_files.map do |file|
-          path = upload_dir.join(file.original_filename)
+          path = upload_dir.join(stored_upload_name(file))
           File.open(path, "wb") { |f| f.write(file.read) }
           path.to_s
         end
       end
+
+      def stored_upload_name(file)
+        extension = File.extname(file.original_filename.to_s).downcase
+        extension = "" unless SUPPORTED_IMPORT_EXTENSIONS.include?(extension)
+
+        "#{SecureRandom.hex(16)}#{extension}"
+      end
     end
   end
 end

data/app/controllers/railspress/admin/posts_controller.rb

@@ -9,15 +9,15 @@ module Railspress
         @direction = params[:direction].presence || "desc"
 
         @posts = Post.includes(:category, :tags)
-                     .search(params[:q])
+                     .rp_search(params[:q])
                      .by_category(params[:category_id])
                      .by_status(params[:status])
                      .sorted_by(@sort, @direction)
 
         @total_count = @posts.count
         @page = [ params[:page].to_i, 1 ].max
-        @total_pages = (@total_count.to_f / Post::PER_PAGE).ceil
-        @posts = @posts.page(@page)
+        @total_pages = (@total_count.to_f / Post.rp_per_page_count).ceil
+        @posts = @posts.rp_page(@page)
 
         @categories = Category.ordered
       end

data/app/controllers/railspress/api/v1/posts_controller.rb

@@ -102,8 +102,8 @@ module Railspress
         end
 
         def per_page
-          requested = params.fetch(:per, Railspress::Post.per_page_count).to_i
-          requested = Railspress::Post.per_page_count if requested <= 0
+          requested = params.fetch(:per, Railspress::Post.rp_per_page_count).to_i
+          requested = Railspress::Post.rp_per_page_count if requested <= 0
           [ requested, 100 ].min
         end
 

data/app/jobs/railspress/import_posts_job.rb

@@ -30,12 +30,15 @@ module Railspress
     end
 
     def cleanup_uploaded_files(file_paths)
-      tmp_dir = Rails.root.join("tmp").to_s
+      tmp_dir = File.realpath(Rails.root.join("tmp"))
 
       file_paths.each do |path|
-        # Only cleanup files in the tmp directory to avoid deleting source files
-        next unless path.start_with?(tmp_dir)
-        FileUtils.rm_f(path) if File.exist?(path)
+        next unless File.exist?(path)
+
+        resolved_path = File.realpath(path)
+        next unless resolved_path.start_with?("#{tmp_dir}#{File::SEPARATOR}")
+
+        FileUtils.rm_f(resolved_path)
       end
     rescue => e
       Rails.logger.warn "Failed to cleanup uploaded import files: #{e.message}"

data/app/models/railspress/post.rb

@@ -74,14 +74,22 @@ module Railspress
     before_save :set_published_at
     before_save :set_reading_time, if: -> { reading_time.blank? && content.present? }
 
-    # Generic scopes (ordered, recent) and pagination (page) provided by Entity concern
+    # Generic scopes (ordered, recent) and pagination (rp_page) provided by Entity concern
     # Post-specific scopes below:
     scope :published, -> { where(status: :published).where(published_at: ..Time.current) }
     scope :drafts, -> { where(status: :draft) }
     scope :scheduled, -> { where(status: :published).where("published_at > ?", Time.current) }
     scope :live, -> { published }  # Alias for semantic clarity
     scope :by_author, ->(author) { where(author_id: author.id) }
-    scope :search, ->(query) { where("title ILIKE ?", "%#{query}%") if query.present? }
+    scope :rp_search, ->(query) {
+      query.present? ? where(arel_table[:title].matches("%#{query}%", nil, false)) : all
+    }
+    unless respond_to?(:search)
+      scope :search, ->(query) {
+        Railspress.deprecator.warn("search is deprecated and will be removed in RailsPress 2.0; use rp_search instead")
+        rp_search(query)
+      }
+    end
     scope :by_category, ->(category_id) { where(category_id: category_id) if category_id.present? }
     scope :by_status, ->(status) {
       case status.to_s

data/app/models/railspress/post_import_processor.rb

@@ -1,8 +1,9 @@
 require "yaml"
 require "zip"
-require "open-uri"
 require "fileutils"
 require "redcarpet"
+require "ssrf_filter"
+require "stringio"
 
 module Railspress
   class PostImportProcessor
@@ -211,29 +212,20 @@ module Railspress
       filename = File.basename(uri.path)
       filename = "header_image#{File.extname(uri.path)}" if filename.blank?
 
-      downloaded = URI.open(url)
+      response = SsrfFilter.get(url, max_redirects: 0)
+      response.value
       post.header_image.attach(
-        io: downloaded,
+        io: StringIO.new(response.body),
         filename: filename,
-        content_type: downloaded.content_type
+        content_type: response.content_type
       )
-    rescue OpenURI::HTTPError, URI::InvalidURIError => e
+    rescue SsrfFilter::Error, URI::InvalidURIError, Net::HTTPError => e
       Rails.logger.warn "Failed to download header image from #{url}: #{e.message}"
     end
 
     def attach_image_from_zip(post, relative_path, source_path, base_dir)
-      # Resolve relative path from the markdown file's directory or from base_dir
-      source_dir = File.dirname(source_path)
-
-      # Try relative to the markdown file first
-      image_path = File.expand_path(relative_path, source_dir)
-
-      # If not found, try relative to base_dir
-      unless File.exist?(image_path)
-        image_path = File.expand_path(relative_path, base_dir)
-      end
-
-      return unless File.exist?(image_path)
+      image_path = imported_image_path(relative_path, source_path, base_dir)
+      return unless image_path
 
       ext = File.extname(image_path).downcase
       return unless IMAGE_EXTENSIONS.include?(ext)
@@ -253,6 +245,23 @@ module Railspress
       )
     end
 
+    def imported_image_path(relative_path, source_path, base_dir)
+      import_root = File.realpath(base_dir)
+      source_dir = File.dirname(source_path)
+
+      [ source_dir, import_root ].each do |directory|
+        candidate = File.expand_path(relative_path.to_s, directory)
+        next unless File.file?(candidate)
+
+        resolved_candidate = File.realpath(candidate)
+        return resolved_candidate if resolved_candidate.start_with?("#{import_root}#{File::SEPARATOR}")
+      end
+
+      nil
+    rescue Errno::EACCES, Errno::ENOENT
+      nil
+    end
+
     def extract_title_from_body(body)
       # Look for first H1: # Title
       if match = body.match(/^#\s+(.+)$/)

data/lib/railspress/engine.rb

@@ -2,6 +2,10 @@ module Railspress
   class Engine < ::Rails::Engine
     isolate_namespace Railspress
 
+    initializer "railspress.deprecator" do |app|
+      app.deprecators[:railspress] = Railspress.deprecator
+    end
+
     # Register engine assets with the asset pipeline (Propshaft)
     initializer "railspress.assets" do |app|
       if app.config.respond_to?(:assets)

data/lib/railspress/entity.rb

@@ -149,6 +149,22 @@ module Railspress
       # Default scopes available to all entities
       scope :ordered, -> { order(created_at: :desc) }
       scope :recent, -> { ordered.limit(10) }
+
+      unless respond_to?(:page)
+        scope :page, ->(page_number) {
+          Railspress.deprecator.warn("page is deprecated and will be removed in RailsPress 2.0; use rp_page instead")
+          rp_page(page_number)
+        }
+      end
+
+      unless respond_to?(:per_page_count)
+        define_singleton_method(:per_page_count) do
+          Railspress.deprecator.warn(
+            "per_page_count is deprecated and will be removed in RailsPress 2.0; use rp_per_page_count instead"
+          )
+          rp_per_page_count
+        end
+      end
     end
 
     # Default pagination - can be overridden in model
@@ -156,13 +172,13 @@ module Railspress
 
     class_methods do
       # Simple pagination for index views
-      def page(page_number)
+      def rp_page(page_number)
         page_number = [ page_number.to_i, 1 ].max
-        offset((page_number - 1) * per_page_count).limit(per_page_count)
+        offset((page_number - 1) * rp_per_page_count).limit(rp_per_page_count)
       end
 
       # Allow models to override PER_PAGE
-      def per_page_count
+      def rp_per_page_count
         const_defined?(:PER_PAGE, false) ? const_get(:PER_PAGE) : Railspress::Entity::PER_PAGE
       end
 

data/lib/railspress/version.rb

@@ -1,3 +1,3 @@
 module Railspress
-  VERSION = "1.4.2"
+  VERSION = "1.4.4"
 end

data/lib/railspress.rb

@@ -1,4 +1,5 @@
 require "railspress/version"
+require "active_support/deprecation"
 require "railspress/cms_helper"
 require "railspress/engine"
 require "railspress/entity"
@@ -195,6 +196,10 @@ module Railspress
   end
 
   class << self
+    def deprecator
+      @deprecator ||= ActiveSupport::Deprecation.new("2.0", "RailsPress")
+    end
+
     def configuration
       @configuration ||= Configuration.new
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: railspress-engine
 version: !ruby/object:Gem::Version
-  version: 1.4.2
+  version: 1.4.4
 platform: ruby
 authors:
 - Avi Flombaum
@@ -85,6 +85,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '3.6'
+- !ruby/object:Gem::Dependency
+  name: ssrf_filter
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.5'
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
@@ -372,7 +386,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.14
+rubygems_version: 4.0.18
 specification_version: 4
 summary: A mountable blog + CMS engine for Rails 8+
 test_files: []