safe_image 0.2.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e078245fa2e4fb0707b0d477ad0c4b41f31423905ed0dc84f964cd648a5a032f
-  data.tar.gz: 9155876c2761ac9c6afb2b4da4a97af8b6b7e035ffee553c72dacda6166c1048
+  metadata.gz: 1f73bfd1e95c6fbb93ad43254cbff0b2d14cf1d667b5af58daf3e7f2311e3240
+  data.tar.gz: 598bc5111672e82b922bfc134c168488ad9348b2b85cf5d6f3ac6d12c959ddfc
 SHA512:
-  metadata.gz: 2f98d64d3b9665a156c27cbcef898cd148e6b559c73c03ba757b1147d2e47f1733d5a6e0ebc7d5c038cb989f874d67747175cd1d094cdf9677f98550cfe635be
-  data.tar.gz: ae1008885bf83da844145369cd929edd12c0af238fd0d975e2c078ef95b4d7cc301f1fed2da5cdd815d520591938acc144a2bd79d4bd2573336a2c9eb1078e5b
+  metadata.gz: d3dd059f65b1f5d5ad43290aaf3e654817eca8d5127f90717cbf91739c31b92c9674c5fcc73c5b61a5b2be724c5b8053e298a35f6063cd880959a3ccfb9916c8
+  data.tar.gz: 5eeb7da08494d4e76f6ba5e9aa6479b083c8e1cd8f40fa7779537c00884a0e5cb068714b6fbf6ece00fc82fcdc39919c458c2fadcc4740b1348786a88871fb7a

data/CHANGELOG.md

@@ -5,6 +5,211 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.0 - 2026-06-18]
+
+### Removed (breaking)
+
+- Removed `SafeImage.sanitize_svg!` and the internal SVG/CSS sanitizer
+  implementation. Safe Image still supports bounded SVG metadata probing for
+  local and remote `.svg` files, but applications that need to clean or inline
+  user-supplied SVG content must use a dedicated sanitizer outside this gem.
+- Removed the compatibility/in-place file-writing APIs. `resize`, `crop`,
+  `downsize`, `convert`, `fix_orientation`, `convert_favicon_to_png`, and
+  `optimize` now require explicit, distinct `input:` and `output:` paths;
+  `optimize_image!` and `convert_to_jpeg` are gone.
+
+## [0.3.0 - 2026-06-12]
+
+### Changed (breaking)
+
+- **`sanitize_svg!` now requires `id_namespace:`.** The argument forces a
+  deliberate choice of where the output may be used, removing the footgun of a
+  silently-wrong default. Pass `:standalone` for output served only as an
+  external `<img>`/CSS-url/file, or a stable per-document String to make it safe
+  to inline (see below). Omitting it (or passing `nil`/`""`) raises
+  `ArgumentError`. Callers must update: `sanitize_svg!(path)` →
+  `sanitize_svg!(path, id_namespace: :standalone)`.
+
+### Added
+
+- **`sanitize_svg!` can produce output safe to inline into an HTML DOM.** Pass
+  `id_namespace:` a stable per-document value (e.g. the upload sha) and the
+  sanitizer prefixes every `id` and every reference to it (`href`/`xlink:href`
+  fragments, `url(#…)` in attributes and CSS, ARIA IDREF attributes like
+  `aria-labelledby`/`aria-controls`, and every `class` token plus the matching
+  `.class` selectors) with the namespace, and scopes every `<style>` selector
+  under a `<ns>-scope` class added to the root `<svg>`. Namespacing classes stops
+  an inlined SVG from invoking the host page's framework CSS (a bare
+  `class="modal fixed"` overlay vector). `var()`/`env()`/`attr()` in presentation
+  attributes are rejected outright — they resolve against the host page.
+  Inlined into a page, the preserved `<style>` can no longer reach the host
+  cascade (`*{visibility:hidden}`, `#header{display:none}`) and ids cannot
+  clobber host ids — including references written `URL(#x)`, `url('#x')`, or
+  `url("#x")`, which are namespaced like the unquoted form. In this mode the root
+  `<svg>`'s `overflow` is also dropped so it clips to its declared viewport (a
+  tiny viewport with `overflow:visible` and oversized content would otherwise
+  paint a full-page overlay). With `id_namespace: :standalone` the output is the
+  document-safe form (no namespacing). The namespace must be a valid ident (a
+  letter followed by letters/digits/`_`/`-`); malformed tokens are rejected
+  rather than coerced, so two distinct values can never collapse to one. The
+  transform is idempotent per namespace. `style=""` attributes are
+  element-scoped and inline-safe either way.
+- **`<style>` elements now fail closed on any at-rule.** Previously an at-rule
+  block followed by a valid rule (`@font-face{…}.ok{…}`) could keep the trailing
+  rule; a stylesheet containing `@` anywhere is now rejected whole, matching the
+  documented guarantee.
+- **The SVG sanitizer keeps a safe CSS subset instead of stripping all CSS.**
+  `style` attributes (as written by Inkscape) and `<style>` elements (as
+  written by Illustrator) now survive sanitisation when they parse against a
+  constructed allowlist grammar: properties mirroring the allowed
+  presentation attributes, type/class/id selectors, numeric/keyword/color
+  values, and `url(#fragment)` references only. Output is reassembled from
+  validated tokens — CSS escapes, quotes/strings, at-rules, comments, and
+  unknown properties, functions, or selectors drop the declaration, rule, or
+  whole stylesheet rather than being interpreted. A single at-rule or nested
+  block fails the whole `<style>` element closed. `!important` and modern
+  `rgb()/hsl()` slash-alpha (`rgb(R G B / A)`) are preserved; both are parsed
+  structurally and re-emitted, and admitting `/` for the alpha keeps CSS
+  comments impossible because `*` remains excluded from the value charset.
+- **The presentation-attribute allowlist covers common editor output.** Added
+  the safe, widely-emitted SVG presentation properties (and their CSS twins):
+  `stroke-dasharray`/`stroke-dashoffset`, `vector-effect`, `marker`/`marker-*`
+  (with the `<marker>` element and its geometry attributes), `color`,
+  `display`/`visibility`/`overflow`, `paint-order`/`mix-blend-mode`/`isolation`,
+  the `*-rendering` hints, and the longhand text properties (`font-style`,
+  `font-variant`, `font-stretch`, `text-decoration`, `letter-spacing`,
+  `word-spacing`, `dominant-baseline`, `baseline-shift`, `writing-mode`,
+  `direction`). The only additions carrying a URL — `marker*` — are constrained
+  to `url(#fragment)` like the existing paint and clip/mask references. Filters
+  remain out of scope.
+
+### Changed
+
+- **Sandboxed operations are served by a pool of resident zygote workers —
+  warm Landlock overhead drops from ~100ms to ~3–8ms per operation, with
+  near-linear concurrency.** Previously every sandboxed call exec'd a fresh
+  Ruby that re-paid interpreter boot, rubygems, the gem's requires, and
+  libvips init. A zygote boots that once, then forks a child per operation;
+  the child applies rlimits, its per-operation Landlock policy (filesystem
+  allowlist, all TCP denied on ABI ≥ 4, abstract-unix-socket/signal scopes on
+  ABI ≥ 6), and — when the installed `landlock` gem exposes
+  `seccomp_deny_network!` — the helper's deny-all-network seccomp filter
+  (blocking sockets of every family), *before* touching untrusted input, and
+  exits after the operation. Workers are pooled so N threads run N sandboxed
+  operations at once (the single zygote would serialise them): the pool grows
+  on demand to `SAFE_IMAGE_ZYGOTE_WORKERS` (default 8) and offered concurrency
+  past the cap blocks until a worker frees, bounding concurrent libvips
+  memory. An idle worker exits after `Zygote::IDLE_SECONDS` (300, overridable
+  via `SAFE_IMAGE_ZYGOTE_IDLE_SECONDS`; idling holds ~16MB private memory and
+  no CPU), exits immediately when its parent process does, and `configure!`
+  always retires the pool, so no stale process outlives its parent or a
+  reconfigure. Forking is sound because the zygote never runs operations
+  itself: libvips is initialised but quiescent (zero native threads) at every
+  fork — verified empirically. Outputs are byte-identical to both the exec
+  worker and unsandboxed operation. `SAFE_IMAGE_ZYGOTE=0` falls back to the
+  exec-per-operation worker. Pool correctness under concurrent reconfigure,
+  worker death, and fork is enforced by a per-worker generation token (a
+  worker checked out when `configure!` lands is retired on return, never
+  reused under stale config), channel-health (not process-liveness) reuse
+  decisions (a worker whose pipe broke is discarded, never re-pooled), a
+  `PR_SET_PDEATHSIG` so an operation child dies with its zygote, and
+  parent-side tmp-root cleanup that survives a SIGKILLed worker — all
+  exercised by a multithreaded chaos stress test (reconfigure + worker kills)
+  asserting no wrong output, no process/fd/tmpdir leak, and no deadlock.
+
+- **External tools run with `MALLOC_ARENA_MAX=2`.** Multithreaded optimizer
+  tools (oxipng's rayon pool, ImageMagick's OpenMP) otherwise have glibc
+  reserve a 64MB malloc arena per thread; combined with the sandbox's
+  `RLIMIT_AS` memory cap, that *address-space* reservation spuriously fails
+  the tool under concurrency even though real memory use is tiny. Bounding the
+  arena count is the standard mitigation and is free for these compute-bound
+  tools. Found by stress-testing concurrent sandboxed `convert`.
+
+- **rexml loads on first SVG use instead of at `require "safe_image"`.**
+  rexml costs ~27ms to parse and only the SVG paths need it, so every boot of
+  the gem — and in particular every Landlock sandbox worker, which is a fresh
+  Ruby process per operation — was paying it on operations that never touch
+  SVG. Measured per-op sandbox cost drops from ~102ms to ~85ms on the vips
+  backend and ~75ms to ~58ms on the imagemagick backend.
+
+- **Remote fetches reject bad responses from the headers alone.** The
+  `Content-Type` allowlist and content-type/extension agreement checks now run
+  before any body bytes are read (previously the body was downloaded first and
+  rejected afterwards), and the first bytes of the body must be compatible
+  with the claimed format's magic bytes — an obviously mislabeled body is
+  dropped after the first chunk instead of being downloaded to `max_bytes`.
+- **Remote metadata helpers download only what the answer needs.**
+  `remote_size`, `remote_type`, `remote_info` and `remote_animated?` now probe
+  the partially-downloaded file at growing thresholds (64KB, 256KB, ...) and
+  abort the transfer once the answer is final, instead of always downloading
+  up to `max_bytes`. Early answers are only trusted when more data cannot
+  change them: "not animated" still requires the complete file (truncated
+  animations undercount frames), SVG metadata still downloads the whole
+  document so the SVG size cap keeps its meaning, and any prefix probe
+  failure falls back to the full download with unchanged validation and
+  error behaviour. `fetch_remote` and `remote_dominant_color` still download
+  the complete body.
+
+### Fixed
+
+- **Lossy PNG optimisation no longer fails when pngquant declines to
+  quantise.** pngquant signals "quantised result not used" through exit
+  status 98 (`--skip-if-larger`) and 99 (`--quality` not met) — for example
+  on low-bit-depth grayscale PNGs its RGBA-palette output cannot beat —
+  and `optimize(mode: :lossy)` raised `CommandError` instead of keeping the
+  original and continuing to oxipng. Found by running 10 random Wikimedia
+  Commons images through the optimizer.
+
+- **`optimize` no longer ships sideways JPEGs.** With `strip_metadata: true`
+  (the default), stripping deleted the EXIF orientation tag without applying
+  the rotation, so an oriented camera photo came out rendered 90/180° wrong.
+  `optimize` now bakes the rotation into the pixels first via jpegtran's
+  lossless transforms: `-perfect` when the dimensions are MCU-aligned, else
+  `-trim`, which drops the partial edge blocks (under one MCU, at most 15px)
+  instead of hiding a lossy re-encode. The result hash gains `rotated_from:`
+  and `trimmed:` so the trim is reported, never silent — image_optim's jhead
+  worker (Discourse's `FileHelper.optimize_image!`) does the same transform
+  but trims silently. Without jpegtran an oriented JPEG raises in strict mode
+  and is left untouched otherwise; reading the tag goes through the configured
+  backend, so `optimize` now also enforces the pixel cap before touching an
+  oriented JPEG. Internal callers optimising output the gem just encoded skip
+  the check (`assume_upright:`).
+
+- **JPEGs with an EXIF orientation no longer fail on the libvips path once
+  they outgrow the sequential readahead window (~512px — every real camera
+  photo).** `resize`, `crop`, `convert`/`convert_to_jpeg` and the
+  `fix_orientation` re-encode tier loaded input with `access: sequential` and
+  then autorotated, and the rotation's out-of-order row reads raised
+  `VipsJpeg: out of order read`. Oriented images are now reloaded with random
+  access before autorotation; upright images keep the streaming sequential
+  load, and the pixel cap still runs before any decode.
+
+### Security
+
+- **Presentation-attribute `url()` references fail closed unless they are a
+  canonical same-document fragment.** A single validation/rewrite grammar now
+  governs both the keep decision and the namespace rewrite, so external URLs,
+  mismatched quotes, and unterminated forms (`url(#id`, `url(http://evil`) are
+  dropped rather than kept on browser parse-error leniency — and no bare,
+  un-namespaced reference can survive in inline (`id_namespace:` String) output.
+- **Attribute values containing CSS escapes are rejected outright.**
+  Browsers feed SVG presentation attributes through their CSS value parsers,
+  where an escape can re-form a token after the sanitizer's pattern checks
+  (`ur\6c(...)` is `url(...)`). No allowlisted attribute legitimately
+  contains a backslash, so any attribute value with one is now dropped.
+- **SVG parsing rejects encodings the byte-level guards cannot see through.**
+  The DOCTYPE/processing-instruction guards are ASCII byte scans; a UTF-16
+  document interleaves NUL bytes between the ASCII characters, so a
+  `<!DOCTYPE` (and an entity payload behind it) could slip past them while
+  REXML still decoded and honoured it. SVG documents must now be UTF-8 (BOM
+  allowed) or declare a single-byte ASCII-transparent charset (US-ASCII,
+  ISO-8859-*, Windows-125x): UTF-16/32 BOMs, embedded NUL bytes, and declared
+  multi-byte or transforming encodings (Shift_JIS, GBK, EUC-*, ISO-2022-*,
+  UTF-7) raise `InvalidImageError`. Declared names that fit the allowed shape
+  but resolve to no real encoding (e.g. `utf8`, `windows-1259`) also fail
+  closed as `InvalidImageError` instead of surfacing REXML's bare
+  `ArgumentError`.
+
 ## [0.2.0] - 2026-06-10
 
 The host's whole image-processing posture is now decided in one place, once,
@@ -91,18 +296,15 @@ between backends.
 - Graceful operation without libvips: the new `SafeImage::VipsUnavailableError`
   (a subclass of `UnsupportedFormatError`) makes `backend: :auto` route through
   ImageMagick on hosts without the library, while explicit `backend: :vips`
-  calls fail closed. `SafeImage::VipsGlue.available?` reports the state.
+  calls fail closed. `SafeImage::Native.available?` reports the state.
 - `docker/run.sh`: containerised validation against Debian bookworm's packaged
-  libvips 8.14 with no toolchain installed.
+  libvips 8.14 and native-helper build/install.
 
 ### Changed
 
-- **The compiled C extension is gone.** libvips is now bound at runtime
-  through a minimal Fiddle binding (`SafeImage::VipsGlue`) that exposes only
-  the operations the gem invokes. Nothing compiles at gem install time; the
-  only gem dependencies are `fiddle` and `rexml`. Minimum libvips is 8.13
-  (Debian bookworm's 8.14 package is tested); `SAFE_IMAGE_LIBVIPS` overrides
-  the library name.
+- **The compiled C helper owns libvips execution.** libvips is initialized in
+  the bundled helper process, which exposes only the operations the gem invokes.
+  Minimum libvips is 8.13 (Debian bookworm's 8.14 package is tested).
 - All transform defaults are now native-first: `resize`, `crop`, `downsize`,
   `convert` and `thumbnail` default to `backend: :auto` (previously
   ImageMagick for the first three and `:vips` fail-closed for `thumbnail`).
@@ -144,8 +346,8 @@ between backends.
   untrusted-operation block: JPEG XL is part of the supported input surface,
   and inputs still pass extension routing, pixel caps and (optionally) the
   Landlock sandbox.
-- The Fiddle binding doubles as an operation allowlist, and a leak-loop test
-  guards GObject reference handling.
+- The native helper doubles as an operation allowlist, and a leak-loop test
+  guards helper request handling.
 
 ## [0.1.0] - 2026-06-09