safe_image 0.3.0 → 0.5.0

data/lib/safe_image/path_safety.rb

@@ -37,10 +37,21 @@ module SafeImage
       reject_symlink_components!(path.dirname)
       if File.exist?(path.to_s)
         raise UnsafePathError, "output path is a symlink: #{path}" if File.lstat(path.to_s).symlink?
+        raise UnsafePathError, "output path is a directory: #{path}" if File.directory?(path.to_s)
       end
       path
     end
 
+    def ensure_distinct_file_paths!(input, output)
+      input = ensure_regular_file!(input)
+      output = ensure_safe_output_path!(output)
+      same_path = input.to_s == output.to_s
+      same_file = output.exist? && File.identical?(input.to_s, output.to_s)
+      raise UnsafePathError, "input and output must be different paths" if same_path || same_file
+
+      [input, output]
+    end
+
     def ensure_imagemagick_safe!(path)
       path = local_path(path)
       raise UnsafePathError, "path contains NUL" if path.include?("\0")

data/lib/safe_image/processor.rb

@@ -1,146 +1,183 @@
 # frozen_string_literal: true
 
-require "fileutils"
-require "pathname"
-require "tempfile"
-
 module SafeImage
   class Processor
-    SUPPORTED_INPUTS = %w[jpg jpeg png gif webp heic heif avif jxl].freeze
-    SUPPORTED_OUTPUTS = %w[jpg jpeg png gif webp avif jxl].freeze
+    SUPPORTED_INPUTS = Formats::NATIVE_INPUTS
+    SUPPORTED_OUTPUTS = Formats::NATIVE_OUTPUTS
     # Formats the post-processing optimizer tools understand; other outputs
     # skip the optimize pass instead of erroring.
-    OPTIMIZABLE_OUTPUTS = %w[jpg png].freeze
+    OPTIMIZABLE_OUTPUTS = Formats::OPTIMIZABLE_OUTPUTS
 
-    def initialize(max_pixels: nil, chroma_subsampling: :auto)
-      @max_pixels = max_pixels || SafeImage.config.max_pixels
+    def initialize(max_pixels: nil, chroma_subsampling: :auto, config: SafeImage.config)
+      @config = config
+      @max_pixels = max_pixels || config.max_pixels
       @chroma_subsampling = chroma_subsampling
     end
 
     def probe(path)
       input = safe_existing_file!(path)
-      info = Native.probe(input.to_s)
+      info = Native.probe(input.to_s, @max_pixels)
       validate_pixels!(info.fetch(:width), info.fetch(:height))
-      Result.new(
-        input: input.to_s,
-        output: nil,
+      Result.metadata(
+        input: input,
         input_format: info.fetch(:format),
-        output_format: nil,
         width: info.fetch(:width),
         height: info.fetch(:height),
-        filesize: File.size(input),
-        backend: "libvips-direct",
-        duration_ms: info.fetch(:duration_ms),
-        optimizer: nil
+        backend: :vips,
+        duration_ms: info.fetch(:duration_ms)
       )
     end
 
-    def thumbnail(input:, output:, width:, height:, format: nil, quality: 85, optimize: false, optimize_mode: :lossless)
-      input = safe_existing_file!(input)
-      output = safe_output_path!(output)
+    def thumbnail(
+      input:,
+      output:,
+      width:,
+      height:,
+      format: nil,
+      quality: QualityDefaults::JPEG,
+      optimize: false,
+      optimize_mode: :lossless
+    )
+      input, output, width, height, quality, out_format =
+        prepare_thumbnail_request(
+          input: input,
+          output: output,
+          width: width,
+          height: height,
+          format: format,
+          quality: quality
+        )
+      info =
+        thumbnail_info(input: input, output: output, width: width, height: height, quality: quality, format: out_format)
+      opt_info =
+        optimize_thumbnail_output(output, format: out_format, quality: quality, mode: optimize_mode) if optimize
+
+      thumbnail_result(input: input, output: output, info: info, optimizer: opt_info)
+    end
+
+    private
+
+    def prepare_thumbnail_request(input:, output:, width:, height:, format:, quality:)
+      input, output = PathSafety.ensure_distinct_file_paths!(input, output)
+      safe_existing_file!(input)
       width = Integer(width)
       height = Integer(height)
       quality = Integer(quality)
       raise ArgumentError, "width and height must be positive" if width <= 0 || height <= 0
       raise ArgumentError, "quality must be 1..100" unless (1..100).cover?(quality)
 
-      out_format = (format || output.extname.delete_prefix(".")).downcase
-      out_format = "jpg" if out_format == "jpeg"
-      unless SUPPORTED_OUTPUTS.include?(out_format)
+      out_format = Formats.normalize(format || output.extname.delete_prefix("."))
+      unless Formats.native_output?(out_format)
         raise UnsupportedFormatError, "unsupported output format: #{out_format.inspect}"
       end
 
       output.dirname.mkpath
-      backend = SafeImage.config.backend
-      info =
-        if out_format == "jpg" && use_jpegli_for_generated_jpeg?(backend)
-          jpegli_thumbnail(input: input, output: output, width: width, height: height, quality: quality, source_format: input.extname.delete_prefix(".").downcase)
-        else
-          case backend
-          when :vips
-            Native.thumbnail(input.to_s, output.to_s, width, height, out_format, quality, @max_pixels)
-          when :imagemagick
-            probe_info = ImageMagickBackend.probe(input.to_s)
-            validate_pixels!(probe_info.fetch(:width), probe_info.fetch(:height))
-            ImageMagickBackend.thumbnail(
-              input: input.to_s,
-              output: output.to_s,
-              width: width,
-              height: height,
-              format: out_format,
-              quality: quality
-            )
-          end
-        end
-
-      opt_info = nil
-      if optimize && OPTIMIZABLE_OUTPUTS.include?(out_format)
-        opt_info = Optimizer.optimize(output, mode: optimize_mode, strip_metadata: true, quality: out_format == "jpg" ? quality : nil, assume_upright: true)
+      [input, output, width, height, quality, out_format]
+    end
+
+    def thumbnail_info(input:, output:, width:, height:, quality:, format:)
+      if jpegli_thumbnail?(format)
+        info =
+          jpegli_thumbnail(
+            input: input,
+            output: output,
+            width: width,
+            height: height,
+            quality: quality,
+            source_format: input.extname.delete_prefix(".").downcase
+          )
+        return info
+      end
+
+      case @config.backend
+      when :vips
+        Native.thumbnail(input.to_s, output.to_s, width, height, format, quality, @max_pixels)
+      when :imagemagick
+        imagemagick_thumbnail(
+          input: input,
+          output: output,
+          width: width,
+          height: height,
+          quality: quality,
+          format: format
+        )
       end
+    end
 
-      Result.new(
+    def imagemagick_thumbnail(input:, output:, width:, height:, quality:, format:)
+      probe_info = ImageMagickBackend.probe(input.to_s)
+      validate_pixels!(probe_info.fetch(:width), probe_info.fetch(:height))
+      ImageMagickBackend.thumbnail(
         input: input.to_s,
         output: output.to_s,
+        width: width,
+        height: height,
+        format: format,
+        quality: quality
+      )
+    end
+
+    def optimize_thumbnail_output(output, format:, quality:, mode:)
+      if OPTIMIZABLE_OUTPUTS.include?(format)
+        optimize_output(
+          output,
+          mode: mode,
+          strip_metadata: true,
+          quality: format == "jpg" ? quality : nil,
+          assume_upright: true
+        )
+      end
+    end
+
+    def thumbnail_result(input:, output:, info:, optimizer:)
+      Result.build(
+        input: input,
+        output: output,
         input_format: info.fetch(:input_format),
         output_format: info.fetch(:output_format),
         width: info.fetch(:width),
         height: info.fetch(:height),
-        filesize: File.size(output),
-        backend: result_backend(info, backend),
+        backend: @config.backend,
+        encoder: info[:encoder],
         duration_ms: info.fetch(:duration_ms),
-        optimizer: opt_info&.fetch(:tools, nil)
+        optimizer: optimizer&.fetch(:tools, nil),
+        tier: info[:encoder] == "cjpegli" ? :cjpegli : :thumbnail
       )
     end
 
-    private
+    def optimize_output(output, **options)
+      StagedOutput.replace(output, suffix: ".safe-image#{output.extname}") do |tmp_path|
+        Optimizer.optimize(input: output, output: tmp_path, **options)
+      end
+    end
 
     # cjpegli is an output-quality tool, not a configuration choice: installed
     # means used. It encodes only pixels this gem already decoded, so it is
     # not part of the untrusted-input surface the backend choice controls.
-    def use_jpegli_for_generated_jpeg?(backend)
-      backend == :vips && JpegliBackend.available?
+    def jpegli_thumbnail?(format)
+      @config.backend == :vips && format == "jpg" && JpegliBackend.available?
     end
 
     def jpegli_thumbnail(input:, output:, width:, height:, quality:, source_format:)
-      output.dirname.mkpath
-      Tempfile.create([output.basename(".*").to_s, ".safe-image.png"], output.dirname.to_s) do |tmp|
-        tmp_path = Pathname.new(tmp.path)
-        tmp.close
-        Native.thumbnail(input.to_s, tmp_path.to_s, width, height, "png", 100, @max_pixels)
-        JpegliBackend.encode(
-          input: tmp_path,
-          output: output,
-          quality: quality,
-          chroma_subsampling: JpegliBackend.validate_chroma_subsampling!(@chroma_subsampling, input_format: normalized_source_format(source_format)),
-          input_format: normalized_source_format(source_format)
-        )
-      ensure
-        FileUtils.rm_f(tmp_path) if defined?(tmp_path) && tmp_path
-      end
+      JpegliBackend.encode_generated_jpeg(
+        output: output,
+        quality: quality,
+        chroma_subsampling: @chroma_subsampling,
+        input_format: normalized_source_format(source_format)
+      ) { |tmp_path| Native.thumbnail(input.to_s, tmp_path.to_s, width, height, "png", 100, @max_pixels) }
     end
 
     def normalized_source_format(format)
-      format = format.to_s.downcase
-      format == "jpeg" ? "jpg" : format
-    end
-
-    def result_backend(info, backend)
-      base = backend == :vips ? "libvips-direct" : "imagemagick"
-      info[:encoder] == "cjpegli" ? "#{base}+cjpegli" : base
+      Formats.normalize(format)
     end
 
     def safe_existing_file!(path)
       path = PathSafety.ensure_regular_file!(path)
-      ext = path.extname.delete_prefix(".").downcase
-      ext = "jpg" if ext == "jpeg"
-      raise UnsupportedFormatError, "unsupported input format: #{ext.inspect}" unless SUPPORTED_INPUTS.include?(ext)
+      ext = Formats.extension(path)
+      raise UnsupportedFormatError, "unsupported input format: #{ext.inspect}" unless Formats.native_input?(ext)
       path
     end
 
-    def safe_output_path!(path)
-      PathSafety.ensure_safe_output_path!(path)
-    end
-
     def validate_pixels!(width, height)
       return unless @max_pixels
       pixels = Integer(width) * Integer(height)

data/lib/safe_image/quality_defaults.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module SafeImage
+  # Named quality defaults shared by the Ruby paths and mirrored by the native
+  # helper's DEFAULT_*_QUALITY macros. Keep these values documented in one place
+  # so new operations do not grow ad hoc JPEG quality choices.
+  module QualityDefaults
+    # Public transform default: historical safe_image behaviour and cjpegli's
+    # default quality for generated JPEGs.
+    JPEG = 85
+
+    # Native convert uses ImageMagick's usual default for inputs without embedded
+    # quality tables instead of libvips' lower Q75 default.
+    NATIVE_CONVERT_JPEG = 92
+
+    # fix_orientation only reaches this lossy tier when the lossless jpegtran
+    # path is unavailable or rejected; keep quality high to minimize generation
+    # loss while still validating a sane caller override.
+    FIX_ORIENTATION_REENCODE_JPEG = 95
+  end
+
+  private_constant :QualityDefaults
+end