ratonvirus 0.1.2 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4ccf906781401ec2e9126acf96165d278b0dce5ecf2b10cfa71373490433d98
-  data.tar.gz: dc56500ae5839a3987c47e96d05ceb9e4627c412edd953d0dbf1fc2c02069c52
+  metadata.gz: cc7e931fe59e66c07af39b8468730cb9f4c23e7680bd1a6110c1598cab73e328
+  data.tar.gz: 3bd536062079bb898448a87688563ec82abca7d04b075731f7a5a2002a6ea901
 SHA512:
-  metadata.gz: 830a364f9355592158d7580c8755b576ea6a591951e48832ec6d83a308d5d5b0bdcaec3822d7dd47a5120eebc264c2037762202e0f53c42c3d10781d8c67f081
-  data.tar.gz: 68562672a90dafe0d4705378cc94549d2cf64858987a14901b73607da595b747e72f0d45c52a06f9b1595aba6ab3118998ee5e23901ff438f31bdf6aa399852f
+  metadata.gz: 81b5a5ebb0c057392a0923d6c1cd292044845423d8459d0eec21c02d261ab581b0e6aaae23457ea28453fe7221154f2619f24d2b1b8202ce74e469ea446913b6
+  data.tar.gz: 3dab899e7141a7bdac10bb2bf4bc3c003744f8923fb4375e26cc79dc82b8efbfb6809bf221fc600daa07be78b5c7403e7dca80db23022f4a1d9944a6b3512b41

data/CHANGELOG.md

@@ -1,3 +1,29 @@
+# v0.3.1
+
+Fixed:
+
+- Issue related to the EICAR test scanner. Related to [#16](https://github.com/mainio/ratonvirus/pull/16)
+
+# v0.3.0
+
+Changed:
+
+- Minimum Ruby version is now set to 2.5
+
+Fixed:
+
+- Issue related with scanning files with CarrierWave storage engine using remote storage engines such as Fog. Related
+  to [#9](https://github.com/mainio/ratonvirus/pull/9)
+
+# v0.2.0
+
+Support for Rails 6
+
+The ActiveStorage storage engine has been updated and partly rewritten due to changes in its API. The new API introduces
+a changes concept in the library which this update takes in to account. In the new API, the blobs will not get uploaded
+to the storage service before the validations have been successful, which led to rethinking how this storage engine
+works in Ratonvirus.
+
 # v0.1.2
 
 Fixed:
@@ -5,7 +31,6 @@ Fixed:
 - Backport: Issue related with scanning files with CarrierWave storage engine using remote storage engines such as Fog.
   Related to #9
 
-
 # v0.1.1
 
 Fixed:

data/README.md

@@ -3,7 +3,7 @@
 Rails antivirus made easy.
 Developed by [Mainio Tech](https://www.mainiotech.fi/).
 
-[![Build Status](https://travis-ci.com/mainio/ratonvirus.svg?branch=master)](https://travis-ci.com/mainio/ratonvirus)
+[![Build Status](https://github.com/mainio/ratonvirus/actions/workflows/ci_ratonvirus.yml/badge.svg)](https://github.com/mainio/ratonvirus/actions)
 [![codecov](https://codecov.io/gh/mainio/ratonvirus/branch/master/graph/badge.svg)](https://codecov.io/gh/mainio/ratonvirus)
 
 Ratonvirus allows your Rails application to rat on the viruses that your users

data/lib/ratonvirus/error.rb

@@ -4,6 +4,8 @@ module Ratonvirus
   class Error < StandardError; end
 
   class InvalidError < Error; end
+
   class NotDefinedError < Error; end
+
   class NotImplementedError < Error; end
 end

data/lib/ratonvirus/scanner/base.rb

@@ -11,8 +11,8 @@ module Ratonvirus
         end
       end
 
-      attr_reader :config
-      attr_reader :errors # Only available after `virus?` has been called.
+      # :errors - Only available after `virus?` has been called.
+      attr_reader :config, :errors
 
       def initialize(configuration = {})
         @config = default_config.merge!(configuration)

data/lib/ratonvirus/scanner/eicar.rb

@@ -8,7 +8,13 @@ module Ratonvirus
     class Eicar < Base
       # SHA256 digest of the EICAR test file for virus testing
       # See: https://en.wikipedia.org/wiki/EICAR_test_file
-      EICAR_SHA256 = "131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267"
+      #
+      # This includes both, the default hash and a hash with for the file saved
+      # with a newline at the end of it.
+      EICAR_SHA256 = %w(
+        275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
+        131f95c51cc819465fa1797f6ccacf9d494aaaff46fa3eac73ae63ffbdfd8267
+      ).freeze
 
       class << self
         def executable?
@@ -19,11 +25,11 @@ module Ratonvirus
       protected
 
       def run_scan(path)
-        if !File.file?(path)
-          errors << :antivirus_file_not_found
-        else
+        if File.file?(path)
           sha256 = Digest::SHA256.file path
-          errors << :antivirus_virus_detected if sha256 == EICAR_SHA256
+          errors << :antivirus_virus_detected if EICAR_SHA256.include?(sha256.to_s)
+        else
+          errors << :antivirus_file_not_found
         end
       rescue StandardError
         errors << :antivirus_client_error

data/lib/ratonvirus/storage/active_storage.rb

@@ -3,21 +3,11 @@
 module Ratonvirus
   module Storage
     class ActiveStorage < Base
-      def changed?(_record, _attribute)
-        # With Active Storage we assume the record is always changed because
-        # there is currently no way to know if the attribute has actually
-        # changed.
-        #
-        # Calling record.changed? will not also work because it is not marked
-        # as dirty in case the Active Storage attachment has changed.
-        #
-        # NOTE:
-        # This should be changed in the future as the `attachment_changes` was
-        # introduced to Rails by this commit:
-        # https://github.com/rails/rails/commit/e8682c5bf051517b0b265e446aa1a7eccfd47bf7
-        #
-        # However, it is still not available in Rails 5.2.x.
-        true
+      include Ratonvirus::Storage::Support::IoHandling
+
+      def changed?(record, attribute)
+        resource = record.public_send attribute
+        !resource.record.attachment_changes[resource.name].nil?
       end
 
       def accept?(resource)
@@ -25,72 +15,94 @@ module Ratonvirus
           resource.is_a?(::ActiveStorage::Attached::Many)
       end
 
-      def process(resource, &_block)
+      def process(resource, &block)
         return unless block_given?
         return if resource.nil?
-
         return unless resource.attached?
 
-        if resource.is_a?(::ActiveStorage::Attached::One)
-          yield processable(resource.attachment) if resource.attachment
-        elsif resource.is_a?(::ActiveStorage::Attached::Many)
-          resource.attachments.each do |attachment|
-            yield processable(attachment)
-          end
+        change = resource.record.attachment_changes[resource.name]
+
+        case change
+        when ::ActiveStorage::Attached::Changes::CreateOne
+          handle_create_one(change, &block)
+        when ::ActiveStorage::Attached::Changes::CreateMany
+          handle_create_many(change, &block)
         end
       end
 
       def asset_path(asset, &block)
         return unless block_given?
-        return if asset.nil?
-        return unless asset.blob
+        return unless asset.is_a?(Array)
 
-        blob_path asset.blob, &block
+        ext = asset[0].filename.extension_with_delimiter
+        case asset[1]
+        when ActionDispatch::Http::UploadedFile, Rack::Test::UploadedFile
+          # These files should be already locally stored but their permissions
+          # can prevent the virus scanner executable from accessing them.
+          # Therefore, a temporary file is created for them as well.
+          io_path(asset[1], ext, &block)
+        when Hash
+          io = asset[1].fetch(:io)
+          io_path(io, ext, &block) if io
+        when ::ActiveStorage::Blob
+          asset[1].open do |tempfile|
+            prepare_for_scanner tempfile.path
+            yield tempfile.path
+          end
+        end
       end
 
+      # This is actually only required for the dyncamic blob uploads but for
+      # consistency, it is handled for all the cases accordingly either by
+      # closing the tempfile of the upload which also removes the file when
+      # called with the bang method. For the IO references, the IO is closed
+      # which should trigger the file deletion by latest at the Rack or Ruby
+      # level during garbage collection. There is no guarantee that the file
+      # for which the IO was opened would be deleted beause the IO itself is
+      # not necessarily associated with an actual file.
       def asset_remove(asset)
-        asset.purge
+        return unless asset.is_a?(Array)
+
+        case asset[1]
+        when ActionDispatch::Http::UploadedFile, Rack::Test::UploadedFile
+          # This removes the temp file from the system.
+          asset[1].tempfile.close!
+        when Hash
+          # No guarantee all references for the file are deleted.
+          io = asset[1].fetch(:io)
+          io.close
+        when ::ActiveStorage::Blob
+          # This deletes the dynamically uploaded blobs that might not be
+          # associated with any record at this point. This ensures the blobs are
+          # not left "hanging" in the storage system and the database in case
+          # automatic file deletion is applied.
+          asset[1].purge
+        end
       end
 
       private
 
-      # This creates a local copy of the blob for the scanning process. A
-      # local copy is needed for processing because the actual blob may be
-      # stored at a remote storage service (such as Amazon S3), meaning it
-      # cannot be otherwise processed locally.
-      #
-      # NOTE:
-      # Later implementations of Active Storage have the blob.open method that
-      # provides similar functionality. However, Rails 5.2.x still does not
-      # include this functionality, so we need to take care of it ourselves.
-      #
-      # This was introduced in the following commit:
-      # https://github.com/rails/rails/commit/ee21b7c2eb64def8f00887a9fafbd77b85f464f1
-      #
-      # SEE:
-      # https://edgeguides.rubyonrails.org/active_storage_overview.html#downloading-files
-      def blob_path(blob)
-        tempfile = Tempfile.open(
-          ["Ratonvirus", blob.filename.extension_with_delimiter],
-          tempdir
-        )
-
-        begin
-          tempfile.binmode
-          blob.download { |chunk| tempfile.write(chunk) }
-          tempfile.flush
-          tempfile.rewind
-
-          yield tempfile.path
-        rescue StandardError
-            return
-        ensure
-          tempfile.close!
+      def handle_create_one(change, &block)
+        yield_processable_from(change, &block)
+      end
+
+      def handle_create_many(change, &block)
+        change.send(:subchanges).each do |subchange|
+          yield_processable_from(subchange, &block)
         end
       end
 
-      def tempdir
-        Dir.tmpdir
+      def yield_processable_from(change, &_block)
+        attachable = change.attachable
+        return unless attachable
+        return if attachable.is_a?(::ActiveStorage::Blob)
+
+        # If the attachable is a string, it is a reference to an already
+        # existing blob. This can happen e.g. when the file blob is uploaded
+        # dynamically before the form is submitted.
+        attachable = change.attachment.blob if attachable.is_a?(String)
+
+        yield processable([change.attachment, attachable])
       end
     end
   end

data/lib/ratonvirus/storage/carrierwave.rb

@@ -37,8 +37,11 @@ module Ratonvirus
 
       def asset_remove(asset)
         path = asset.file.path
+        delete_dir = asset.file.is_a?(::CarrierWave::SanitizedFile)
         asset.remove!
 
+        return unless delete_dir
+
         # Remove the temp cache dir if it exists
         dir = File.dirname(path)
         FileUtils.remove_dir(dir) if File.directory?(dir)

data/lib/ratonvirus/support/backend.rb

@@ -88,37 +88,37 @@ module Ratonvirus
       def define_backend(backend_type, backend_subclass)
         class_eval <<-CODE, __FILE__, __LINE__ + 1
           # Getter for #{backend_type}
-          def self.#{backend_type}
-            @#{backend_type} ||= create_#{backend_type}
-          end
+          def self.#{backend_type}                      # def self.foo
+            @#{backend_type} ||= create_#{backend_type} #   @foo ||= create_foo
+          end                                           # end
 
           # Setter for #{backend_type}
-          def self.#{backend_type}=(#{backend_type}_value)
-            set_backend(
-              :#{backend_type},
-              "#{backend_subclass}",
-              #{backend_type}_value
-            )
-          end
+          def self.#{backend_type}=(#{backend_type}_value) # def self.foo=(foo_value)
+            set_backend(                                   #   set_backend(
+              :#{backend_type},                            #     :foo
+              "#{backend_subclass}",                       #     "Foo"
+              #{backend_type}_value                        #     foo_value
+            )                                              #   )
+          end                                              # end
 
           # Destroys the currently active #{backend_type}.
           # The #{backend_type} is re-initialized when the getter is called.
-          def self.destroy_#{backend_type}
-            @#{backend_type} = nil
-          end
+          def self.destroy_#{backend_type} # def self.destroy_foo
+            @#{backend_type} = nil         #   @foo = nil
+          end                              # end
 
           # Creates a new backend instance
           # private
-          def self.create_#{backend_type}
-            if @#{backend_type}_defs.nil?
-              raise NotDefinedError.new("#{backend_subclass} not defined!")
-            end
-
-            @#{backend_type}_defs[:klass].new(
-              @#{backend_type}_defs[:config]
-            )
-          end
-          private_class_method :create_#{backend_type}
+          def self.create_#{backend_type}                                   # def self.create_foo
+            if @#{backend_type}_defs.nil?                                   #   if @foo_defs.nil?
+              raise NotDefinedError.new("#{backend_subclass} not defined!") #     raise NotDefinedError.new("Foo not defined")
+            end                                                             #   end
+                                                                            #
+            @#{backend_type}_defs[:klass].new(                              #   @foo_defs[:klass].new(
+              @#{backend_type}_defs[:config]                                #     @foo_defs[:config]
+            )                                                               #   )
+          end                                                               # end
+          private_class_method :create_#{backend_type}                      # private_class_method :create_foo
         CODE
       end
 
@@ -154,12 +154,13 @@ module Ratonvirus
           subtype = backend_value.class
           config = backend_value.config
         else
-          if backend_value.is_a?(Array)
+          case backend_value
+          when Array
             subtype = backend_value.shift
             config = backend_value.shift || {}
 
             raise InvalidError, "Invalid #{backend_type} type: #{subtype}" unless subtype.is_a?(Symbol)
-          elsif backend_value.is_a?(Symbol)
+          when Symbol
             subtype = backend_value
             config = {}
           else

data/lib/ratonvirus/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ratonvirus
-  VERSION = "0.1.2"
+  VERSION = "0.3.1"
 end

data/lib/tasks/ratonvirus.rake

@@ -3,19 +3,17 @@
 namespace :ratonvirus do
   desc "Tests if the antivirus scanner is available and properly configured"
   task test: :environment do
-    begin
-      if Ratonvirus.scanner.available?
-        puts "Ratonvirus correctly configured."
-      else
-        puts "Ratonvirus scanner is not available!"
-        puts ""
-        puts "Please refer to Ratonvirus documentation for proper configuration."
-      end
-    rescue StandardError
-      puts "Ratonvirus scanner is not configured."
+    if Ratonvirus.scanner.available?
+      puts "Ratonvirus correctly configured."
+    else
+      puts "Ratonvirus scanner is not available!"
       puts ""
       puts "Please refer to Ratonvirus documentation for proper configuration."
     end
+  rescue StandardError
+    puts "Ratonvirus scanner is not configured."
+    puts ""
+    puts "Please refer to Ratonvirus documentation for proper configuration."
   end
 
   desc "Scans the given file through the antivirus scanner"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ratonvirus
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.3.1
 platform: ruby
 authors:
 - Antti Hukkanen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-03-05 00:00:00.000000000 Z
+date: 2022-03-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '12.3'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -58,98 +58,98 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '4.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: simplecov
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.16.0
+        version: 0.18.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.16.0
+        version: 0.18.0
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: activestorage
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.0'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: carrierwave
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '2.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '2.1'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.64.0
+        version: 1.11.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.64.0
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.32'
+        version: 2.2.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.32'
+        version: 2.2.0
 description: Adds antivirus check capability for Rails applications.
 email:
 - antti.hukkanen@mainiotech.fi
@@ -193,7 +193,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="