safe_image 0.2.0 → 0.4.0

data/lib/safe_image/svg_metadata.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require "pathname"
-require "rexml/document"
-require "rexml/parsers/pullparser"
 
 module SafeImage
   module SvgMetadata
@@ -18,6 +16,36 @@ module SafeImage
     LENGTH_PATTERN = /\A\s*([+]?(?:\d+(?:\.\d+)?|\.\d+))(?:px)?\s*\z/i.freeze
     VIEWBOX_SPLIT = /[\s,]+/.freeze
 
+    # Byte-order marks for the multi-byte encodings whose ASCII characters our
+    # byte-level scans below cannot see through. XML mandates a BOM for UTF-16
+    # and UTF-32, so a document in one of these encodings either carries a BOM
+    # here or contains NUL bytes for its ASCII characters (caught separately).
+    # Order matters: the UTF-32 LE mark begins with the UTF-16 LE mark.
+    NON_UTF8_BOMS = [
+      "\xFF\xFE\x00\x00".b, # UTF-32 LE
+      "\x00\x00\xFE\xFF".b, # UTF-32 BE
+      "\xFF\xFE".b, # UTF-16 LE
+      "\xFE\xFF".b # UTF-16 BE
+    ].freeze
+
+    UTF8_BOM = "\xEF\xBB\xBF".b.freeze
+    # Declared encodings we accept: UTF-8/ASCII plus the single-byte,
+    # ASCII-transparent legacy charsets (ISO-8859-*, Windows-125x). Their bytes
+    # below 0x80 decode to identical ASCII, so the byte scans below see the same
+    # markup any XML decoder or browser does; and being single-byte, no
+    # lead byte can swallow a following quote the way Shift-JIS, GBK, or Big5
+    # can. Multi-byte (Shift-JIS, GBK, EUC-*, ISO-2022-*), transforming (UTF-7:
+    # "+ADw-" decodes to "<"), and NUL-interleaved (UTF-16/32) encodings are
+    # deliberately excluded — they let bytes our ASCII scans cannot see become
+    # markup the parser acts on. The shape match alone is not airtight:
+    # "utf8" or "windows-1259" fit the pattern yet name no real encoding, so a
+    # name must also resolve via Encoding.find to pass — lookalikes fail
+    # closed here instead of leaking a parser encoding error to the caller.
+    SAFE_DECLARED_ENCODING = /\A(?:utf-?8|us-ascii|ascii|iso-?8859-?\d{1,2}|(?:windows|cp)-?125\d)\z/i.freeze
+    # ASCII-only so it matches the binary buffer; the optional BOM is stripped
+    # before matching rather than embedded here (which would make this UTF-8).
+    XML_DECL_ENCODING = /\A\s*<\?xml\b[^>]*?\bencoding\s*=\s*["']([^"']+)["']/i.freeze
+
     def probe(path, max_pixels: nil, max_bytes: MAX_SVG_BYTES)
       started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       path = safe_svg_path(path)
@@ -34,6 +62,14 @@ module SafeImage
     def dimensions(path, max_pixels: nil, max_bytes: MAX_SVG_BYTES)
       xml = read_svg(path, max_bytes: max_bytes)
       _name, attributes = scan_svg!(xml)
+      dimensions_from_attributes(attributes, max_pixels: max_pixels)
+    end
+
+    # Computes and validates the document dimensions from the already-scanned
+    # root attributes, so a caller that has run scan_svg! does not re-read or
+    # re-scan the file. Same width/height-then-viewBox fallback and limits as
+    # dimensions above.
+    def dimensions_from_attributes(attributes, max_pixels: nil)
       width = parse_length(attributes["width"])
       height = parse_length(attributes["height"])
 
@@ -46,27 +82,12 @@ module SafeImage
       validate_dimensions!(width, height, max_pixels: max_pixels)
     end
 
-    # Builds the full REXML tree. Used only by the SVG sanitizer, which needs to
-    # walk and rewrite the document; metadata reads go through the DOM-free
-    # streaming path above. The streaming validation runs first so a document
-    # that breaches the structural caps is rejected before the tree is built.
-    def parse(path, max_bytes: MAX_SVG_BYTES)
-      xml = read_svg(path, max_bytes: max_bytes)
-      scan_svg!(xml)
-      doc = REXML::Document.new(xml)
-      raise InvalidImageError, "SVG root required" unless doc.root&.name == "svg"
-
-      doc
-    rescue REXML::ParseException => e
-      raise InvalidImageError, "invalid SVG: #{e.message}"
-    end
-
     def read_svg(path, max_bytes: MAX_SVG_BYTES)
       path = safe_svg_path(path)
       size = File.size(path)
       raise LimitError, "SVG exceeds #{max_bytes} bytes" if size > max_bytes
 
-      xml = File.binread(path, max_bytes + 1)
+      xml = File.binread(path, max_bytes + 1) || "".b
       raise LimitError, "SVG exceeds #{max_bytes} bytes" if xml.bytesize > max_bytes
       reject_unsafe_xml!(xml)
       xml
@@ -79,10 +100,41 @@ module SafeImage
     end
 
     def reject_unsafe_xml!(xml)
+      # The DOCTYPE/PI scans below are ASCII byte regexes; they only see what
+      # they expect when the bytes we scan decode to the same markup the XML
+      # parser sees. That holds for UTF-8 and single-byte ASCII-transparent
+      # charsets but not for UTF-16/32 or multi-byte/transforming encodings, so
+      # reject those first.
+      reject_unsafe_encoding!(xml)
       raise InvalidImageError, "doctype is not allowed in SVG" if xml.match?(/<!DOCTYPE/i)
       raise InvalidImageError, "XML processing instructions are not allowed in SVG" if xml.match?(/<\?(?!xml\s)/i)
     end
 
+    def reject_unsafe_encoding!(xml)
+      bytes = xml.b
+      # UTF-16/UTF-32 interleave NUL bytes between ASCII characters, hiding
+      # "<!DOCTYPE" from the ASCII scans while the XML parser still decodes and
+      # honours it. (NUL is invalid in XML 1.0 regardless, so this also rejects
+      # garbage.)
+      if NON_UTF8_BOMS.any? { |bom| bytes.start_with?(bom) } || bytes.include?("\x00".b)
+        raise InvalidImageError, "SVG must use a single-byte or UTF-8 encoding"
+      end
+
+      bytes = bytes.byteslice(UTF8_BOM.bytesize..) if bytes.start_with?(UTF8_BOM)
+      match = bytes.match(XML_DECL_ENCODING)
+      return unless match
+      return if match[1].match?(SAFE_DECLARED_ENCODING) && known_encoding?(match[1])
+
+      raise InvalidImageError, "unsupported SVG encoding: #{match[1]}"
+    end
+
+    def known_encoding?(name)
+      Encoding.find(name)
+      true
+    rescue ArgumentError
+      false
+    end
+
     def parse_length(value)
       value = value.to_s
       match = LENGTH_PATTERN.match(value)
@@ -110,53 +162,132 @@ module SafeImage
 
     def validate_dimensions!(width, height, max_pixels: nil)
       raise InvalidImageError, "SVG dimensions are missing or invalid" unless width&.positive? && height&.positive?
-      raise LimitError, "SVG dimensions exceed #{MAX_SVG_DIMENSION}px" if width > MAX_SVG_DIMENSION || height > MAX_SVG_DIMENSION
+      if width > MAX_SVG_DIMENSION || height > MAX_SVG_DIMENSION
+        raise LimitError, "SVG dimensions exceed #{MAX_SVG_DIMENSION}px"
+      end
 
       pixels = width * height
-      limit = max_pixels || MAX_SVG_PIXELS
+      limit =
+        if max_pixels.nil?
+          MAX_SVG_PIXELS
+        else
+          value = Integer(max_pixels)
+          raise ArgumentError, "max_pixels must be positive" if value <= 0
+
+          value
+        end
       raise LimitError, "SVG has #{pixels.to_i} pixels, exceeds #{limit}" if pixels > limit
 
       [width.ceil, height.ceil]
     end
 
-    # Streams the document with a pull parser, enforcing the structural caps as
-    # events arrive, so a hostile "millions of tiny elements" document is
-    # rejected at the cap without ever retaining the multi-million-object DOM
-    # that a parse-then-validate approach would build first. Returns the root
-    # element's name and its attributes hash.
+    # Streams the document with a SAX parser, enforcing the structural caps as
+    # events arrive (see cap_scanner_class), so a hostile "millions of tiny
+    # elements" document is rejected at the cap without ever retaining the
+    # multi-million-object DOM a parse-then-validate approach would build.
+    # Returns the root element's local name and a localname=>value hash of its
+    # attributes, matching the contract dimensions_from_attributes consumes.
+    #
+    # SAX does NOT raise on malformed XML even with recovery disabled — it
+    # reports through the error callback and keeps going — so well-formedness is
+    # enforced by recording any reported error and rejecting after the parse.
+    # This preserves the old pull-parser's reject set (unclosed/mismatched
+    # tags, trailing junk) and is strictly stricter on multiple root elements,
+    # which is a safe direction for a gate.
     def scan_svg!(xml)
-      parser = REXML::Parsers::PullParser.new(xml)
-      depth = -1
-      elements = 0
-      attributes = 0
-      root_name = nil
-      root_attributes = nil
-
-      while parser.has_next?
-        event = parser.pull
-        if event.start_element?
-          depth += 1
-          raise LimitError, "SVG nesting exceeds #{MAX_SVG_DEPTH}" if depth > MAX_SVG_DEPTH
-
-          elements += 1
-          raise LimitError, "SVG has too many elements" if elements > MAX_SVG_ELEMENTS
-
-          attributes += event[1].size
-          raise LimitError, "SVG has too many attributes" if attributes > MAX_SVG_ATTRIBUTES
-
-          if root_name.nil?
-            root_name = event[0]
-            root_attributes = event[1]
-          end
-        elsif event.end_element?
-          depth -= 1
-        end
+      require_nokogiri
+      handler = cap_scanner_class.new
+      parser = Nokogiri::XML::SAX::Parser.new(handler)
+      begin
+        # recovery: false — do not silently repair malformed markup. Errors still
+        # arrive via the error callback rather than as exceptions, so they are
+        # checked explicitly below.
+        parser.parse(xml) { |ctx| ctx.recovery = false }
+      rescue LimitError, InvalidImageError
+        raise # our own cap/validation rejections, surfaced from a callback
+      rescue StandardError => e
+        # Nokogiri rejects some inputs by raising rather than via the error
+        # callback (e.g. empty input -> "input string cannot be empty"). Keep
+        # untrusted-input failures inside our error hierarchy.
+        raise InvalidImageError, "invalid SVG: #{e.message}"
       end
 
-      raise InvalidImageError, "SVG root required" unless root_name == "svg"
-      [root_name, root_attributes]
-    rescue REXML::ParseException => e
-      raise InvalidImageError, "invalid SVG: #{e.message}"
+      raise InvalidImageError, "invalid SVG: #{handler.parse_error}" if handler.parse_error
+      raise InvalidImageError, "SVG root required" unless handler.root_name == "svg"
+
+      [handler.root_name, handler.root_attributes]
+    end
+
+    # Loaded on first SVG use, not at file load: keeping the XML library off the
+    # hot path of every non-SVG operation where it would otherwise be paid for
+    # nothing.
+    def require_nokogiri
+      require "nokogiri"
+    end
+
+    # The SAX cap-enforcement handler, built lazily and memoised the first time
+    # an SVG is scanned. It subclasses Nokogiri::XML::SAX::Document, so it cannot
+    # be declared at file-load time without forcing nokogiri to load eagerly and
+    # defeating the lazy require above. A breached cap raises LimitError straight
+    # out of a callback; libxml2 propagates it at the next event boundary, so the
+    # parse aborts promptly rather than scanning to the end (verified: rejection
+    # time grows far slower than input size).
+    def cap_scanner_class
+      @cap_scanner_class ||=
+        Class.new(Nokogiri::XML::SAX::Document) do
+          attr_reader :root_name, :root_attributes, :parse_error
+
+          def initialize
+            super
+            @depth = -1
+            @elements = 0
+            @attributes = 0
+            @root_name = nil
+            @root_attributes = nil
+            @parse_error = nil
+          end
+
+          # attrs: array of Nokogiri::XML::SAX::Parser::Attribute (localname/value),
+          # NOT including namespace declarations; `ns` carries the xmlns decls. Both
+          # count toward the attribute cap so the bound cannot be sidestepped by
+          # spraying namespace declarations.
+          def start_element_namespace(name, attrs = [], _prefix = nil, _uri = nil, ns = [])
+            @depth += 1
+            raise LimitError, "SVG nesting exceeds #{MAX_SVG_DEPTH}" if @depth > MAX_SVG_DEPTH
+
+            @elements += 1
+            raise LimitError, "SVG has too many elements" if @elements > MAX_SVG_ELEMENTS
+
+            @attributes += attrs.length + ns.length
+            raise LimitError, "SVG has too many attributes" if @attributes > MAX_SVG_ATTRIBUTES
+
+            return unless @root_name.nil?
+
+            @root_name = name
+            @root_attributes =
+              attrs.each_with_object({}) do |attr, hash|
+                # Dimensions are security-relevant: only the actual no-namespace
+                # root attributes a browser will use may feed the pixel cap. A
+                # namespaced e:width/e:height must not shadow width/height here.
+                next unless attr.prefix.to_s.empty? && attr.uri.to_s.empty?
+
+                hash[attr.localname] = attr.value
+              end
+          end
+
+          def end_element_namespace(_name, _prefix = nil, _uri = nil)
+            @depth -= 1
+          end
+
+          # libxml2 reports well-formedness violations here rather than raising;
+          # record the first so scan_svg! can reject on it.
+          def error(message)
+            @parse_error ||= message.to_s.strip
+          end
+
+          def warning(_message)
+          end
+        end
     end
   end
 end

data/lib/safe_image/transform_operations.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module SafeImage
+  # Inline implementations for image-producing operations.
+  class TransformOperations < OperationSet
+    def thumbnail(
+      input:,
+      output:,
+      width:,
+      height:,
+      format: nil,
+      quality: QualityDefaults::JPEG,
+      max_pixels: nil,
+      optimize: false,
+      optimize_mode: :lossless,
+      chroma_subsampling: :auto
+    )
+      Processor.new(
+        max_pixels: resolved_max_pixels(max_pixels),
+        chroma_subsampling: chroma_subsampling,
+        config: config
+      ).thumbnail(
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        format: format,
+        quality: quality,
+        optimize: optimize,
+        optimize_mode: optimize_mode
+      )
+    end
+
+    def optimize(input:, output:, mode: :lossless, strip_metadata: true, quality: nil, strict: true)
+      Optimizer.optimize(
+        input: input,
+        output: output,
+        mode: mode,
+        strip_metadata: strip_metadata,
+        quality: quality,
+        strict: strict
+      )
+    end
+
+    def resize(
+      input:,
+      output:,
+      width:,
+      height:,
+      quality: nil,
+      optimize: true,
+      max_pixels: nil,
+      chroma_subsampling: :auto
+    )
+      backend.resize(
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        quality: quality,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def crop(input:, output:, width:, height:, quality: nil, optimize: true, max_pixels: nil, chroma_subsampling: :auto)
+      backend.crop(
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        quality: quality,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def downsize(
+      input:,
+      output:,
+      dimensions:,
+      optimize: true,
+      max_pixels: nil,
+      quality: QualityDefaults::JPEG,
+      chroma_subsampling: :auto
+    )
+      backend.downsize(
+        input: input,
+        output: output,
+        dimensions: dimensions,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        quality: quality,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def convert(input:, output:, format:, quality: nil, optimize: true, max_pixels: nil, chroma_subsampling: :auto)
+      backend.convert(
+        input: input,
+        output: output,
+        format: format,
+        quality: quality,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def fix_orientation(input:, output:, max_pixels: nil, quality: nil)
+      backend.fix_orientation(input: input, output: output, max_pixels: max_pixels, quality: quality)
+    end
+
+    def convert_favicon_to_png(input:, output:, optimize: true, max_pixels: nil)
+      backend.convert_favicon_to_png(input: input, output: output, optimize: optimize, max_pixels: max_pixels)
+    end
+
+    def letter_avatar(output:, size:, background_rgb:, letter:, pointsize: 280, font: "DejaVu-Sans")
+      backend.letter_avatar(
+        output: output,
+        size: size,
+        background_rgb: background_rgb,
+        letter: letter,
+        pointsize: pointsize,
+        font: font
+      )
+    end
+
+    private
+
+    def backend
+      OperationBackends.for(config)
+    end
+  end
+
+  private_constant :TransformOperations
+end

data/lib/safe_image/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SafeImage
-  VERSION = "0.2.0"
+  VERSION = "0.4.0"
 end

data/lib/safe_image/vips_backend.rb

@@ -6,18 +6,26 @@ module SafeImage
 
     DIMENSIONS_RE = /\A(?:(?<percent>\d+(?:\.\d+)?)%|(?<w>\d*)x(?<h>\d*)(?<only_down>>)?|(?<pixels>\d+)@)\z/
 
-    def crop_north(input:, output:, width:, height:, format:, quality: 85, max_pixels: nil)
-      Native.crop_north(input.to_s, output.to_s, Integer(width), Integer(height), format.to_s, Integer(quality), max_pixels)
+    def crop_north(input:, output:, width:, height:, format:, quality: QualityDefaults::JPEG, max_pixels: nil)
+      Native.crop_north(
+        input.to_s,
+        output.to_s,
+        Integer(width),
+        Integer(height),
+        format.to_s,
+        Integer(quality),
+        max_pixels
+      )
     end
 
-    def downsize(input:, output:, dimensions:, format:, quality: 85, max_pixels: nil)
+    def downsize(input:, output:, dimensions:, format:, quality: QualityDefaults::JPEG, max_pixels: nil)
       probe = SafeImage.probe(input, max_pixels: max_pixels)
       scale = scale_for(probe.width, probe.height, dimensions)
       # Never upscale, but always re-encode through the native saver — even on a
       # no-op scale of 1.0 — so the output is metadata-stripped rather than a
       # verbatim copy of the untrusted input bytes.
       scale = [scale, 1.0].min
-      Native.resize(input.to_s, output.to_s, scale, normalized_format(format), Integer(quality), max_pixels)
+      Native.resize(input.to_s, output.to_s, scale, Formats.normalize(format), Integer(quality), max_pixels)
     end
 
     def dominant_color(input, max_pixels: nil)
@@ -77,18 +85,11 @@ module SafeImage
       }
     end
 
-    def normalized_format(format)
-      format = format.to_s.downcase
-      format == "jpeg" ? "jpg" : format
-    end
-
     def scale_for(width, height, dimensions)
       dimensions = dimensions.to_s
       match = DIMENSIONS_RE.match(dimensions) or raise ArgumentError, "unsupported dimensions: #{dimensions.inspect}"
 
-      if match[:percent]
-        return Float(match[:percent]) / 100.0
-      end
+      return Float(match[:percent]) / 100.0 if match[:percent]
 
       if match[:pixels]
         target_pixels = Float(match[:pixels])