safe_image 0.3.0 → 0.4.0

data/lib/safe_image/svg_metadata.rb

@@ -12,20 +12,6 @@ module SafeImage
     MAX_SVG_ATTRIBUTES = 50_000
     MAX_SVG_DIMENSION = 100_000
     MAX_SVG_PIXELS = 100_000_000
-    # Upper bound on the render tree the document instantiates. The caps above
-    # bound the *source* document, but several allowlisted features replicate
-    # referenced content at render time, so a small source can cost a consumer
-    # (browser/rasterizer) orders of magnitude more work:
-    #   * <use href="#id"> deep-copies its target subtree — a chain of doubling
-    #     groups fans a few dozen nodes into billions ("use bomb"), and a cyclic
-    #     reference expands forever.
-    #   * a <marker> is drawn once per vertex of every path/line/polyline/polygon
-    #     that references it, so (vertex count) x (marker subtree size) draws — a
-    #     dense `d` (~200k vertices fit in 1 MB) times a non-trivial marker is a
-    #     linear-but-huge "draw bomb" no node/byte/element cap can see.
-    # SvgSanitizer charges both against this single budget over the sanitized
-    # tree (renderer-free static accounting) and rejects when it is exceeded.
-    MAX_SVG_RENDER_UNITS = 1_000_000
 
     LENGTH_PATTERN = /\A\s*([+]?(?:\d+(?:\.\d+)?|\.\d+))(?:px)?\s*\z/i.freeze
     VIEWBOX_SPLIT = /[\s,]+/.freeze
@@ -38,15 +24,15 @@ module SafeImage
     NON_UTF8_BOMS = [
       "\xFF\xFE\x00\x00".b, # UTF-32 LE
       "\x00\x00\xFE\xFF".b, # UTF-32 BE
-      "\xFF\xFE".b,         # UTF-16 LE
-      "\xFE\xFF".b          # UTF-16 BE
+      "\xFF\xFE".b, # UTF-16 LE
+      "\xFE\xFF".b # UTF-16 BE
     ].freeze
 
     UTF8_BOM = "\xEF\xBB\xBF".b.freeze
     # Declared encodings we accept: UTF-8/ASCII plus the single-byte,
     # ASCII-transparent legacy charsets (ISO-8859-*, Windows-125x). Their bytes
     # below 0x80 decode to identical ASCII, so the byte scans below see the same
-    # markup any decoder (REXML or a browser) does; and being single-byte, no
+    # markup any XML decoder or browser does; and being single-byte, no
     # lead byte can swallow a following quote the way Shift-JIS, GBK, or Big5
     # can. Multi-byte (Shift-JIS, GBK, EUC-*, ISO-2022-*), transforming (UTF-7:
     # "+ADw-" decodes to "<"), and NUL-interleaved (UTF-16/32) encodings are
@@ -54,9 +40,8 @@ module SafeImage
     # markup the parser acts on. The shape match alone is not airtight:
     # "utf8" or "windows-1259" fit the pattern yet name no real encoding, so a
     # name must also resolve via Encoding.find to pass — lookalikes fail
-    # closed here instead of leaking REXML's bare ArgumentError to the caller.
-    SAFE_DECLARED_ENCODING =
-      /\A(?:utf-?8|us-ascii|ascii|iso-?8859-?\d{1,2}|(?:windows|cp)-?125\d)\z/i.freeze
+    # closed here instead of leaking a parser encoding error to the caller.
+    SAFE_DECLARED_ENCODING = /\A(?:utf-?8|us-ascii|ascii|iso-?8859-?\d{1,2}|(?:windows|cp)-?125\d)\z/i.freeze
     # ASCII-only so it matches the binary buffer; the optional BOM is stripped
     # before matching rather than embedded here (which would make this UTF-8).
     XML_DECL_ENCODING = /\A\s*<\?xml\b[^>]*?\bencoding\s*=\s*["']([^"']+)["']/i.freeze
@@ -177,10 +162,20 @@ module SafeImage
 
     def validate_dimensions!(width, height, max_pixels: nil)
       raise InvalidImageError, "SVG dimensions are missing or invalid" unless width&.positive? && height&.positive?
-      raise LimitError, "SVG dimensions exceed #{MAX_SVG_DIMENSION}px" if width > MAX_SVG_DIMENSION || height > MAX_SVG_DIMENSION
+      if width > MAX_SVG_DIMENSION || height > MAX_SVG_DIMENSION
+        raise LimitError, "SVG dimensions exceed #{MAX_SVG_DIMENSION}px"
+      end
 
       pixels = width * height
-      limit = max_pixels || MAX_SVG_PIXELS
+      limit =
+        if max_pixels.nil?
+          MAX_SVG_PIXELS
+        else
+          value = Integer(max_pixels)
+          raise ArgumentError, "max_pixels must be positive" if value <= 0
+
+          value
+        end
       raise LimitError, "SVG has #{pixels.to_i} pixels, exceeds #{limit}" if pixels > limit
 
       [width.ceil, height.ceil]
@@ -196,7 +191,7 @@ module SafeImage
     # SAX does NOT raise on malformed XML even with recovery disabled — it
     # reports through the error callback and keeps going — so well-formedness is
     # enforced by recording any reported error and rejecting after the parse.
-    # This reproduces the old REXML pull-parser's reject set (unclosed/mismatched
+    # This preserves the old pull-parser's reject set (unclosed/mismatched
     # tags, trailing junk) and is strictly stricter on multiple root elements,
     # which is a safe direction for a gate.
     def scan_svg!(xml)
@@ -224,8 +219,8 @@ module SafeImage
     end
 
     # Loaded on first SVG use, not at file load: keeping the XML library off the
-    # hot path of every non-SVG operation (and every sandbox worker boot) where
-    # it would otherwise be paid for nothing.
+    # hot path of every non-SVG operation where it would otherwise be paid for
+    # nothing.
     def require_nokogiri
       require "nokogiri"
     end
@@ -238,51 +233,61 @@ module SafeImage
     # parse aborts promptly rather than scanning to the end (verified: rejection
     # time grows far slower than input size).
     def cap_scanner_class
-      @cap_scanner_class ||= Class.new(Nokogiri::XML::SAX::Document) do
-        attr_reader :root_name, :root_attributes, :parse_error
-
-        def initialize
-          super
-          @depth = -1
-          @elements = 0
-          @attributes = 0
-          @root_name = nil
-          @root_attributes = nil
-          @parse_error = nil
-        end
-
-        # attrs: array of Nokogiri::XML::SAX::Parser::Attribute (localname/value),
-        # NOT including namespace declarations; `ns` carries the xmlns decls. Both
-        # count toward the attribute cap so the bound cannot be sidestepped by
-        # spraying namespace declarations.
-        def start_element_namespace(name, attrs = [], _prefix = nil, _uri = nil, ns = [])
-          @depth += 1
-          raise LimitError, "SVG nesting exceeds #{MAX_SVG_DEPTH}" if @depth > MAX_SVG_DEPTH
-
-          @elements += 1
-          raise LimitError, "SVG has too many elements" if @elements > MAX_SVG_ELEMENTS
-
-          @attributes += attrs.length + ns.length
-          raise LimitError, "SVG has too many attributes" if @attributes > MAX_SVG_ATTRIBUTES
-
-          return unless @root_name.nil?
-
-          @root_name = name
-          @root_attributes = attrs.each_with_object({}) { |attr, hash| hash[attr.localname] = attr.value }
-        end
-
-        def end_element_namespace(_name, _prefix = nil, _uri = nil)
-          @depth -= 1
+      @cap_scanner_class ||=
+        Class.new(Nokogiri::XML::SAX::Document) do
+          attr_reader :root_name, :root_attributes, :parse_error
+
+          def initialize
+            super
+            @depth = -1
+            @elements = 0
+            @attributes = 0
+            @root_name = nil
+            @root_attributes = nil
+            @parse_error = nil
+          end
+
+          # attrs: array of Nokogiri::XML::SAX::Parser::Attribute (localname/value),
+          # NOT including namespace declarations; `ns` carries the xmlns decls. Both
+          # count toward the attribute cap so the bound cannot be sidestepped by
+          # spraying namespace declarations.
+          def start_element_namespace(name, attrs = [], _prefix = nil, _uri = nil, ns = [])
+            @depth += 1
+            raise LimitError, "SVG nesting exceeds #{MAX_SVG_DEPTH}" if @depth > MAX_SVG_DEPTH
+
+            @elements += 1
+            raise LimitError, "SVG has too many elements" if @elements > MAX_SVG_ELEMENTS
+
+            @attributes += attrs.length + ns.length
+            raise LimitError, "SVG has too many attributes" if @attributes > MAX_SVG_ATTRIBUTES
+
+            return unless @root_name.nil?
+
+            @root_name = name
+            @root_attributes =
+              attrs.each_with_object({}) do |attr, hash|
+                # Dimensions are security-relevant: only the actual no-namespace
+                # root attributes a browser will use may feed the pixel cap. A
+                # namespaced e:width/e:height must not shadow width/height here.
+                next unless attr.prefix.to_s.empty? && attr.uri.to_s.empty?
+
+                hash[attr.localname] = attr.value
+              end
+          end
+
+          def end_element_namespace(_name, _prefix = nil, _uri = nil)
+            @depth -= 1
+          end
+
+          # libxml2 reports well-formedness violations here rather than raising;
+          # record the first so scan_svg! can reject on it.
+          def error(message)
+            @parse_error ||= message.to_s.strip
+          end
+
+          def warning(_message)
+          end
         end
-
-        # libxml2 reports well-formedness violations here rather than raising;
-        # record the first so scan_svg! can reject on it.
-        def error(message)
-          @parse_error ||= message.to_s.strip
-        end
-
-        def warning(_message); end
-      end
     end
   end
 end

data/lib/safe_image/transform_operations.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module SafeImage
+  # Inline implementations for image-producing operations.
+  class TransformOperations < OperationSet
+    def thumbnail(
+      input:,
+      output:,
+      width:,
+      height:,
+      format: nil,
+      quality: QualityDefaults::JPEG,
+      max_pixels: nil,
+      optimize: false,
+      optimize_mode: :lossless,
+      chroma_subsampling: :auto
+    )
+      Processor.new(
+        max_pixels: resolved_max_pixels(max_pixels),
+        chroma_subsampling: chroma_subsampling,
+        config: config
+      ).thumbnail(
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        format: format,
+        quality: quality,
+        optimize: optimize,
+        optimize_mode: optimize_mode
+      )
+    end
+
+    def optimize(input:, output:, mode: :lossless, strip_metadata: true, quality: nil, strict: true)
+      Optimizer.optimize(
+        input: input,
+        output: output,
+        mode: mode,
+        strip_metadata: strip_metadata,
+        quality: quality,
+        strict: strict
+      )
+    end
+
+    def resize(
+      input:,
+      output:,
+      width:,
+      height:,
+      quality: nil,
+      optimize: true,
+      max_pixels: nil,
+      chroma_subsampling: :auto
+    )
+      backend.resize(
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        quality: quality,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def crop(input:, output:, width:, height:, quality: nil, optimize: true, max_pixels: nil, chroma_subsampling: :auto)
+      backend.crop(
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        quality: quality,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def downsize(
+      input:,
+      output:,
+      dimensions:,
+      optimize: true,
+      max_pixels: nil,
+      quality: QualityDefaults::JPEG,
+      chroma_subsampling: :auto
+    )
+      backend.downsize(
+        input: input,
+        output: output,
+        dimensions: dimensions,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        quality: quality,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def convert(input:, output:, format:, quality: nil, optimize: true, max_pixels: nil, chroma_subsampling: :auto)
+      backend.convert(
+        input: input,
+        output: output,
+        format: format,
+        quality: quality,
+        optimize: optimize,
+        max_pixels: max_pixels,
+        chroma_subsampling: chroma_subsampling
+      )
+    end
+
+    def fix_orientation(input:, output:, max_pixels: nil, quality: nil)
+      backend.fix_orientation(input: input, output: output, max_pixels: max_pixels, quality: quality)
+    end
+
+    def convert_favicon_to_png(input:, output:, optimize: true, max_pixels: nil)
+      backend.convert_favicon_to_png(input: input, output: output, optimize: optimize, max_pixels: max_pixels)
+    end
+
+    def letter_avatar(output:, size:, background_rgb:, letter:, pointsize: 280, font: "DejaVu-Sans")
+      backend.letter_avatar(
+        output: output,
+        size: size,
+        background_rgb: background_rgb,
+        letter: letter,
+        pointsize: pointsize,
+        font: font
+      )
+    end
+
+    private
+
+    def backend
+      OperationBackends.for(config)
+    end
+  end
+
+  private_constant :TransformOperations
+end

data/lib/safe_image/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SafeImage
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/lib/safe_image/vips_backend.rb

@@ -6,18 +6,26 @@ module SafeImage
 
     DIMENSIONS_RE = /\A(?:(?<percent>\d+(?:\.\d+)?)%|(?<w>\d*)x(?<h>\d*)(?<only_down>>)?|(?<pixels>\d+)@)\z/
 
-    def crop_north(input:, output:, width:, height:, format:, quality: 85, max_pixels: nil)
-      Native.crop_north(input.to_s, output.to_s, Integer(width), Integer(height), format.to_s, Integer(quality), max_pixels)
+    def crop_north(input:, output:, width:, height:, format:, quality: QualityDefaults::JPEG, max_pixels: nil)
+      Native.crop_north(
+        input.to_s,
+        output.to_s,
+        Integer(width),
+        Integer(height),
+        format.to_s,
+        Integer(quality),
+        max_pixels
+      )
     end
 
-    def downsize(input:, output:, dimensions:, format:, quality: 85, max_pixels: nil)
+    def downsize(input:, output:, dimensions:, format:, quality: QualityDefaults::JPEG, max_pixels: nil)
       probe = SafeImage.probe(input, max_pixels: max_pixels)
       scale = scale_for(probe.width, probe.height, dimensions)
       # Never upscale, but always re-encode through the native saver — even on a
       # no-op scale of 1.0 — so the output is metadata-stripped rather than a
       # verbatim copy of the untrusted input bytes.
       scale = [scale, 1.0].min
-      Native.resize(input.to_s, output.to_s, scale, normalized_format(format), Integer(quality), max_pixels)
+      Native.resize(input.to_s, output.to_s, scale, Formats.normalize(format), Integer(quality), max_pixels)
     end
 
     def dominant_color(input, max_pixels: nil)
@@ -77,18 +85,11 @@ module SafeImage
       }
     end
 
-    def normalized_format(format)
-      format = format.to_s.downcase
-      format == "jpeg" ? "jpg" : format
-    end
-
     def scale_for(width, height, dimensions)
       dimensions = dimensions.to_s
       match = DIMENSIONS_RE.match(dimensions) or raise ArgumentError, "unsupported dimensions: #{dimensions.inspect}"
 
-      if match[:percent]
-        return Float(match[:percent]) / 100.0
-      end
+      return Float(match[:percent]) / 100.0 if match[:percent]
 
       if match[:pixels]
         target_pixels = Float(match[:pixels])