safe_image 0.3.0 → 0.5.0

data/lib/safe_image/remote.rb

@@ -7,10 +7,9 @@ require "time"
 require "tmpdir"
 require "uri"
 # net/http and resolv are required lazily inside the methods that fetch, not at
-# load time: requiring them pulls in resolv, which (Ruby 3.4+) reads
-# /etc/resolv.conf eagerly. The Landlock-sandboxed worker loads this file but
-# never performs remote fetches, and on hosts where /etc/resolv.conf is a
-# symlink into /run the sandbox denies that read and the worker dies at boot.
+# load time: remote fetches need network access, while sandboxed image-processing
+# child helpers/tools deliberately do not get it. Keep networking libraries off
+# the load path until a caller uses the remote API.
 
 module SafeImage
   module Remote
@@ -27,8 +26,16 @@ module SafeImage
     SAFE_CROSS_ORIGIN_REDIRECT_HEADERS = %w[accept accept-encoding user-agent].freeze
     SAFE_INITIAL_REQUEST_HEADERS = SAFE_CROSS_ORIGIN_REDIRECT_HEADERS
     FORBIDDEN_REQUEST_HEADERS = %w[
-      host connection keep-alive proxy-authenticate proxy-authorization
-      proxy-connection te trailer transfer-encoding upgrade
+      host
+      connection
+      keep-alive
+      proxy-authenticate
+      proxy-authorization
+      proxy-connection
+      te
+      trailer
+      transfer-encoding
+      upgrade
     ].freeze
 
     CONTENT_TYPE_EXTENSIONS = {
@@ -69,11 +76,13 @@ module SafeImage
       ".jxl" => [[[0, "\xFF\x0A".b]], [[0, "\x00\x00\x00\x0CJXL \r\n\x87\n".b]]]
     }.freeze
 
+    # 12 bytes covers the longest fixed magic this gate uses today (container JXL)
+    # while still rejecting mismatches before meaningful body download.
     SIGNATURE_HEAD_BYTES = 12
 
-    # The metadata helpers probe the partially-downloaded file at these
-    # growing byte thresholds and abort the transfer once the answer is
-    # stable, instead of always downloading up to max_bytes.
+    # The metadata helpers probe the partially-downloaded file at these growing
+    # byte thresholds: 64KiB catches normal headers, x4 reaches pathological but
+    # valid marker chains without too many decoder attempts.
     PREFIX_PROBE_INITIAL_BYTES = 64 * 1024
     PREFIX_PROBE_GROWTH_FACTOR = 4
 
@@ -87,44 +96,44 @@ module SafeImage
     # truncated file can report for an animated one).
     CONTINUE_DOWNLOAD = Object.new.freeze
 
-    BLOCKED_IP_RANGES = [
-      # IPv4 special-use / non-public ranges. Default remote fetching is for
-      # public Internet images only; callers probing trusted internal URLs must
-      # opt in with allow_private: true.
-      "0.0.0.0/8",          # current network
-      "10.0.0.0/8",         # RFC1918 private-use
-      "100.64.0.0/10",      # RFC6598 carrier-grade NAT
-      "127.0.0.0/8",        # loopback
-      "169.254.0.0/16",     # RFC3927 link-local
-      "172.16.0.0/12",      # RFC1918 private-use
-      "192.0.0.0/24",       # IETF protocol assignments
-      "192.0.2.0/24",       # TEST-NET-1
-      "192.31.196.0/24",    # AS112-v4
-      "192.52.193.0/24",    # AMT
-      "192.168.0.0/16",     # RFC1918 private-use
-      "192.175.48.0/24",    # direct delegation AS112 service
-      "198.18.0.0/15",      # benchmark testing
-      "198.51.100.0/24",    # TEST-NET-2
-      "203.0.113.0/24",     # TEST-NET-3
-      "224.0.0.0/4",        # multicast
-      "240.0.0.0/4",        # reserved / future-use
-      "255.255.255.255/32", # limited broadcast
-
-      # IPv6 special-use / non-public ranges.
-      "::/128",             # unspecified
-      "::1/128",            # loopback
-      "::/96",              # deprecated IPv4-compatible IPv6
-      "::ffff:0:0/96",      # IPv4-mapped IPv6
-      "64:ff9b::/96",       # well-known NAT64 prefix
-      "64:ff9b:1::/48",     # local-use NAT64 prefix
-      "100::/64",           # discard-only prefix
-      "2001::/23",          # IETF protocol assignments, incl. Teredo/benchmarking
-      "2001:db8::/32",      # documentation
-      "2002::/16",          # 6to4
-      "fc00::/7",           # unique local address
-      "fe80::/10",          # link-local unicast
-      "ff00::/8"            # multicast
-    ].map { |range| IPAddr.new(range) }.freeze
+    BLOCKED_IP_RANGES =
+      [
+        # IPv4 special-use / non-public ranges. Default remote fetching is for
+        # public Internet images only; callers probing trusted internal URLs must
+        # opt in with allow_private: true.
+        "0.0.0.0/8", # current network
+        "10.0.0.0/8", # RFC1918 private-use
+        "100.64.0.0/10", # RFC6598 carrier-grade NAT
+        "127.0.0.0/8", # loopback
+        "169.254.0.0/16", # RFC3927 link-local
+        "172.16.0.0/12", # RFC1918 private-use
+        "192.0.0.0/24", # IETF protocol assignments
+        "192.0.2.0/24", # TEST-NET-1
+        "192.31.196.0/24", # AS112-v4
+        "192.52.193.0/24", # AMT
+        "192.168.0.0/16", # RFC1918 private-use
+        "192.175.48.0/24", # direct delegation AS112 service
+        "198.18.0.0/15", # benchmark testing
+        "198.51.100.0/24", # TEST-NET-2
+        "203.0.113.0/24", # TEST-NET-3
+        "224.0.0.0/4", # multicast
+        "240.0.0.0/4", # reserved / future-use
+        "255.255.255.255/32", # limited broadcast
+        # IPv6 special-use / non-public ranges.
+        "::/128", # unspecified
+        "::1/128", # loopback
+        "::/96", # deprecated IPv4-compatible IPv6
+        "::ffff:0:0/96", # IPv4-mapped IPv6
+        "64:ff9b::/96", # well-known NAT64 prefix
+        "64:ff9b:1::/48", # local-use NAT64 prefix
+        "100::/64", # discard-only prefix
+        "2001::/23", # IETF protocol assignments, incl. Teredo/benchmarking
+        "2001:db8::/32", # documentation
+        "2002::/16", # 6to4
+        "fc00::/7", # unique local address
+        "fe80::/10", # link-local unicast
+        "ff00::/8" # multicast
+      ].map { |range| IPAddr.new(range) }.freeze
 
     def fetch(
       url,
@@ -140,20 +149,21 @@ module SafeImage
       uri = parse_uri(url)
       started_at = monotonic_time
 
-      Tempfile.create(["safe-image-remote", ".bin"], binmode: true) do |file|
-        response = request(
-          uri,
-          io: file,
-          max_bytes: max_bytes,
-          max_redirects: max_redirects,
-          open_timeout: open_timeout,
-          read_timeout: read_timeout,
-          total_timeout: total_timeout,
-          started_at: started_at,
-          allow_private: allow_private,
-          allowed_ports: allowed_ports,
-          headers: headers
-        )
+      Tempfile.create(%w[safe-image-remote .bin], binmode: true) do |file|
+        response =
+          request(
+            uri,
+            io: file,
+            max_bytes: max_bytes,
+            max_redirects: max_redirects,
+            open_timeout: open_timeout,
+            read_timeout: read_timeout,
+            total_timeout: total_timeout,
+            started_at: started_at,
+            allow_private: allow_private,
+            allowed_ports: allowed_ports,
+            headers: headers
+          )
         file.flush
 
         ext = response.fetch(:ext)
@@ -174,8 +184,31 @@ module SafeImage
       end
     end
 
-    def info(url, max_bytes: DEFAULT_MAX_BYTES, max_redirects: DEFAULT_MAX_REDIRECTS, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT, total_timeout: DEFAULT_TOTAL_TIMEOUT, allow_private: false, allowed_ports: DEFAULT_ALLOWED_PORTS, headers: {}, max_pixels: nil, animated: false, orientation: false)
-      metadata_fetch(url, max_bytes: max_bytes, max_redirects: max_redirects, open_timeout: open_timeout, read_timeout: read_timeout, total_timeout: total_timeout, allow_private: allow_private, allowed_ports: allowed_ports, headers: headers) do |path, eof|
+    def info(
+      url,
+      max_bytes: DEFAULT_MAX_BYTES,
+      max_redirects: DEFAULT_MAX_REDIRECTS,
+      open_timeout: DEFAULT_OPEN_TIMEOUT,
+      read_timeout: DEFAULT_READ_TIMEOUT,
+      total_timeout: DEFAULT_TOTAL_TIMEOUT,
+      allow_private: false,
+      allowed_ports: DEFAULT_ALLOWED_PORTS,
+      headers: {},
+      max_pixels: nil,
+      animated: false,
+      orientation: false
+    )
+      metadata_fetch(
+        url,
+        max_bytes: max_bytes,
+        max_redirects: max_redirects,
+        open_timeout: open_timeout,
+        read_timeout: read_timeout,
+        total_timeout: total_timeout,
+        allow_private: allow_private,
+        allowed_ports: allowed_ports,
+        headers: headers
+      ) do |path, eof|
         result = SafeImage.info(path, max_pixels: max_pixels, animated: animated, orientation: orientation)
         # A truncated file can undercount frames but never overcount, so
         # "animated" is final as soon as it is true; "not animated" is only
@@ -198,8 +231,29 @@ module SafeImage
       info(url, **kwargs).type
     end
 
-    def animated?(url, max_bytes: DEFAULT_MAX_BYTES, max_redirects: DEFAULT_MAX_REDIRECTS, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT, total_timeout: DEFAULT_TOTAL_TIMEOUT, allow_private: false, allowed_ports: DEFAULT_ALLOWED_PORTS, headers: {}, max_pixels: nil)
-      metadata_fetch(url, max_bytes: max_bytes, max_redirects: max_redirects, open_timeout: open_timeout, read_timeout: read_timeout, total_timeout: total_timeout, allow_private: allow_private, allowed_ports: allowed_ports, headers: headers) do |path, eof|
+    def animated?(
+      url,
+      max_bytes: DEFAULT_MAX_BYTES,
+      max_redirects: DEFAULT_MAX_REDIRECTS,
+      open_timeout: DEFAULT_OPEN_TIMEOUT,
+      read_timeout: DEFAULT_READ_TIMEOUT,
+      total_timeout: DEFAULT_TOTAL_TIMEOUT,
+      allow_private: false,
+      allowed_ports: DEFAULT_ALLOWED_PORTS,
+      headers: {},
+      max_pixels: nil
+    )
+      metadata_fetch(
+        url,
+        max_bytes: max_bytes,
+        max_redirects: max_redirects,
+        open_timeout: open_timeout,
+        read_timeout: read_timeout,
+        total_timeout: total_timeout,
+        allow_private: allow_private,
+        allowed_ports: allowed_ports,
+        headers: headers
+      ) do |path, eof|
         answer = SafeImage.animated?(path, max_pixels: max_pixels)
         next CONTINUE_DOWNLOAD if !eof && answer != true
 
@@ -207,10 +261,29 @@ module SafeImage
       end
     end
 
-    def dominant_color(url, max_bytes: DEFAULT_MAX_BYTES, max_redirects: DEFAULT_MAX_REDIRECTS, open_timeout: DEFAULT_OPEN_TIMEOUT, read_timeout: DEFAULT_READ_TIMEOUT, total_timeout: DEFAULT_TOTAL_TIMEOUT, allow_private: false, allowed_ports: DEFAULT_ALLOWED_PORTS, headers: {}, max_pixels: nil)
-      fetch(url, max_bytes: max_bytes, max_redirects: max_redirects, open_timeout: open_timeout, read_timeout: read_timeout, total_timeout: total_timeout, allow_private: allow_private, allowed_ports: allowed_ports, headers: headers) do |path|
-        SafeImage.dominant_color(path, max_pixels: max_pixels)
-      end
+    def dominant_color(
+      url,
+      max_bytes: DEFAULT_MAX_BYTES,
+      max_redirects: DEFAULT_MAX_REDIRECTS,
+      open_timeout: DEFAULT_OPEN_TIMEOUT,
+      read_timeout: DEFAULT_READ_TIMEOUT,
+      total_timeout: DEFAULT_TOTAL_TIMEOUT,
+      allow_private: false,
+      allowed_ports: DEFAULT_ALLOWED_PORTS,
+      headers: {},
+      max_pixels: nil
+    )
+      fetch(
+        url,
+        max_bytes: max_bytes,
+        max_redirects: max_redirects,
+        open_timeout: open_timeout,
+        read_timeout: read_timeout,
+        total_timeout: total_timeout,
+        allow_private: allow_private,
+        allowed_ports: allowed_ports,
+        headers: headers
+      ) { |path| SafeImage.dominant_color(path, max_pixels: max_pixels) }
     end
 
     # Single-GET download that re-attempts the local metadata probe as bytes
@@ -225,55 +298,67 @@ module SafeImage
     # behaviour of the full-download path (validate_downloaded_image! plus an
     # un-rescued final probe). A file that never early-exits is handled
     # byte-for-byte like Remote.fetch handles it.
-    def metadata_fetch(url, max_bytes:, max_redirects:, open_timeout:, read_timeout:, total_timeout:, allow_private:, allowed_ports:, headers:, &compute)
+    def metadata_fetch(
+      url,
+      max_bytes:,
+      max_redirects:,
+      open_timeout:,
+      read_timeout:,
+      total_timeout:,
+      allow_private:,
+      allowed_ports:,
+      headers:,
+      &compute
+    )
       uri = parse_uri(url)
       started_at = monotonic_time
 
-      Tempfile.create(["safe-image-remote", ".bin"], binmode: true) do |file|
+      Tempfile.create(%w[safe-image-remote .bin], binmode: true) do |file|
         original_path = file.path
         path = original_path
         ext = nil
         next_probe_at = PREFIX_PROBE_INITIAL_BYTES
 
         begin
-          early = catch(:metadata_answer) do
-            request(
-              uri,
-              io: file,
-              max_bytes: max_bytes,
-              max_redirects: max_redirects,
-              open_timeout: open_timeout,
-              read_timeout: read_timeout,
-              total_timeout: total_timeout,
-              started_at: started_at,
-              allow_private: allow_private,
-              allowed_ports: allowed_ports,
-              headers: headers,
-              # The extension is known before the body: give the tempfile its
-              # final name up front so probes dispatch on the right loader.
-              on_headers: ->(response_ext) do
-                ext = response_ext
-                renamed = original_path.sub(/\.bin\z/, ext)
-                FileUtils.mv(original_path, renamed)
-                path = renamed
-              end,
-              on_progress: ->(bytes) do
-                next unless PREFIX_PROBE_EXTENSIONS.include?(ext)
-                next if bytes < next_probe_at
-
-                next_probe_at *= PREFIX_PROBE_GROWTH_FACTOR while bytes >= next_probe_at
-                file.flush
-                answer =
-                  begin
-                    compute.call(path, false)
-                  rescue StandardError
-                    CONTINUE_DOWNLOAD
-                  end
-                throw :metadata_answer, [answer] unless CONTINUE_DOWNLOAD.equal?(answer)
-              end
-            )
-            nil
-          end
+          early =
+            catch(:metadata_answer) do
+              request(
+                uri,
+                io: file,
+                max_bytes: max_bytes,
+                max_redirects: max_redirects,
+                open_timeout: open_timeout,
+                read_timeout: read_timeout,
+                total_timeout: total_timeout,
+                started_at: started_at,
+                allow_private: allow_private,
+                allowed_ports: allowed_ports,
+                headers: headers,
+                # The extension is known before the body: give the tempfile its
+                # final name up front so probes dispatch on the right loader.
+                on_headers: ->(response_ext) do
+                  ext = response_ext
+                  renamed = original_path.sub(/\.bin\z/, ext)
+                  FileUtils.mv(original_path, renamed)
+                  path = renamed
+                end,
+                on_progress: ->(bytes) do
+                  next if PREFIX_PROBE_EXTENSIONS.none? { |candidate| candidate == ext }
+                  next if bytes < next_probe_at
+
+                  next_probe_at *= PREFIX_PROBE_GROWTH_FACTOR while bytes >= next_probe_at
+                  file.flush
+                  answer =
+                    begin
+                      compute.call(path, false)
+                    rescue StandardError
+                      CONTINUE_DOWNLOAD
+                    end
+                  throw :metadata_answer, [answer] unless CONTINUE_DOWNLOAD.equal?(answer)
+                end
+              )
+              nil
+            end
 
           if early
             early.first
@@ -288,7 +373,21 @@ module SafeImage
       end
     end
 
-    def request(uri, io:, max_bytes:, max_redirects:, open_timeout:, read_timeout:, total_timeout:, started_at:, allow_private:, allowed_ports:, headers: {}, on_headers: nil, on_progress: nil)
+    def request(
+      uri,
+      io:,
+      max_bytes:,
+      max_redirects:,
+      open_timeout:,
+      read_timeout:,
+      total_timeout:,
+      started_at:,
+      allow_private:,
+      allowed_ports:,
+      headers: {},
+      on_headers: nil,
+      on_progress: nil
+    )
       require "net/http"
       raise ArgumentError, "too many redirects" if max_redirects < 0
       check_deadline!(started_at, total_timeout)
@@ -320,21 +419,23 @@ module SafeImage
           if uri.scheme == "https" && redirected.scheme == "http"
             raise UnsafePathError, "refusing HTTPS to HTTP redirect"
           end
-          return request(
-            redirected,
-            io: io,
-            max_bytes: max_bytes,
-            max_redirects: max_redirects - 1,
-            open_timeout: open_timeout,
-            read_timeout: read_timeout,
-            total_timeout: total_timeout,
-            started_at: started_at,
-            allow_private: allow_private,
-            allowed_ports: allowed_ports,
-            headers: redirect_headers(headers, from: uri, to: redirected),
-            on_headers: on_headers,
-            on_progress: on_progress
-          )
+          redirected_response =
+            request(
+              redirected,
+              io: io,
+              max_bytes: max_bytes,
+              max_redirects: max_redirects - 1,
+              open_timeout: open_timeout,
+              read_timeout: read_timeout,
+              total_timeout: total_timeout,
+              started_at: started_at,
+              allow_private: allow_private,
+              allowed_ports: allowed_ports,
+              headers: redirect_headers(headers, from: uri, to: redirected),
+              on_headers: on_headers,
+              on_progress: on_progress
+            )
+          return redirected_response
         when Net::HTTPSuccess
           content_length = response["content-length"].to_i
           raise LimitError, "remote image exceeds #{max_bytes} bytes" if content_length > max_bytes
@@ -379,12 +480,13 @@ module SafeImage
       candidates = SIGNATURES[ext]
       return unless candidates
 
-      compatible = candidates.any? do |candidate|
-        candidate.all? do |offset, bytes|
-          slice = head.byteslice(offset, bytes.bytesize).to_s
-          slice.empty? || slice == bytes.byteslice(0, slice.bytesize)
+      compatible =
+        candidates.any? do |candidate|
+          candidate.all? do |offset, bytes|
+            slice = head.byteslice(offset, bytes.bytesize).to_s
+            slice.empty? || slice == bytes.byteslice(0, slice.bytesize)
+          end
         end
-      end
       return if compatible
 
       raise InvalidImageError, "remote image first bytes do not match #{ext.delete_prefix(".")} signature"
@@ -392,7 +494,9 @@ module SafeImage
 
     def parse_uri(url)
       uri = URI.parse(url.to_s)
-      raise ArgumentError, "remote image URL must be http or https" unless %w[http https].include?(uri.scheme)
+      if %w[http https].none? { |scheme| scheme == uri.scheme }
+        raise ArgumentError, "remote image URL must be http or https"
+      end
       raise ArgumentError, "remote image URL must include a host" if uri.host.to_s.empty?
       uri
     rescue URI::InvalidURIError => e
@@ -413,9 +517,7 @@ module SafeImage
 
       addresses.each do |address|
         ip = IPAddr.new(address)
-        if blocked_ip?(ip)
-          raise UnsafePathError, "remote image host resolves to a non-public address"
-        end
+        raise UnsafePathError, "remote image host resolves to a non-public address" if blocked_ip?(ip)
       end
 
       # Pin the socket to a vetted address so validation and connection cannot
@@ -445,8 +547,7 @@ module SafeImage
     end
 
     def same_origin?(a, b)
-      a.scheme.to_s.downcase == b.scheme.to_s.downcase &&
-        a.host.to_s.downcase == b.host.to_s.downcase &&
+      a.scheme.to_s.downcase == b.scheme.to_s.downcase && a.host.to_s.downcase == b.host.to_s.downcase &&
         a.port == b.port
     end
 
@@ -461,14 +562,17 @@ module SafeImage
 
     def extension_for(uri, content_type)
       content_ext = CONTENT_TYPE_EXTENSIONS[content_type]
-      raise UnsupportedFormatError, "remote image has unsupported or missing content type: #{content_type.inspect}" unless content_ext
+      unless content_ext
+        raise UnsupportedFormatError, "remote image has unsupported or missing content type: #{content_type.inspect}"
+      end
 
       ext = File.extname(uri.path).downcase
       if EXTENSIONS.include?(ext)
         normalized_ext = ext == ".jpeg" ? ".jpg" : ext
         normalized_content_ext = content_ext == ".jpeg" ? ".jpg" : content_ext
         unless normalized_ext == normalized_content_ext
-          raise UnsupportedFormatError, "remote image extension #{ext.inspect} does not match content type #{content_type.inspect}"
+          raise UnsupportedFormatError,
+                "remote image extension #{ext.inspect} does not match content type #{content_type.inspect}"
         end
         return ext
       end
@@ -476,12 +580,12 @@ module SafeImage
       content_ext
     end
 
-    def validate_downloaded_image!(path, ext)
-      if ext == ".svg"
-        SvgMetadata.probe(path)
-      else
-        SafeImage.probe(path)
-      end
+    def validate_downloaded_image!(path, _ext)
+      # Always go back through the public local probe path so configured
+      # sandboxing and pixel limits apply uniformly. Remote.fetch itself needs
+      # network access; once bytes are on disk, validation must re-enter the
+      # normal image-processing boundary.
+      SafeImage.probe(path)
     end
   end
 end

data/lib/safe_image/result.rb

@@ -1,28 +1,76 @@
 # frozen_string_literal: true
 
 module SafeImage
-  Info = Data.define(
-    :path,
-    :type,
-    :width,
-    :height,
-    :size,
-    :animated,
-    :orientation
-  )
+  # Public metadata return value. Optional fields (`animated`, `orientation`) are
+  # nil unless the caller opts into the extra probes.
+  Info = Data.define(:path, :type, :width, :height, :size, :animated, :orientation)
 
-  Result = Data.define(
-    :input,
-    :output,
-    :input_format,
-    :output_format,
-    :width,
-    :height,
-    :filesize,
-    :backend,
-    :duration_ms,
-    :optimizer
-  ) do
-    def success? = true
-  end
+  # Public image-operation return value. `output`/`output_format` are nil for
+  # metadata-only probes; image-producing operations always include them. `tier`
+  # records the concrete execution tier (for example :native_encode,
+  # :jpegtran_lossless or :jpegtran_fallback_reencode) so non-fatal degradation
+  # is observable without parsing the backend label.
+  Result =
+    Data.define(
+      :input,
+      :output,
+      :input_format,
+      :output_format,
+      :width,
+      :height,
+      :filesize,
+      :backend,
+      :duration_ms,
+      :optimizer,
+      :tier
+    ) do
+      def self.build(
+        input:,
+        output: nil,
+        input_format:,
+        output_format: nil,
+        width:,
+        height:,
+        backend:,
+        duration_ms:,
+        filesize: nil,
+        optimizer: nil,
+        encoder: nil,
+        tier: nil
+      )
+        new(
+          input: input.to_s,
+          output: output&.to_s,
+          input_format: input_format,
+          output_format: output_format,
+          width: width,
+          height: height,
+          filesize: filesize || result_filesize(input, output),
+          backend: BackendLabel.build(backend, encoder: encoder),
+          duration_ms: duration_ms,
+          optimizer: optimizer,
+          tier: tier
+        )
+      end
+
+      def self.metadata(input:, input_format:, width:, height:, backend:, duration_ms:)
+        build(
+          input: input,
+          input_format: input_format,
+          width: width,
+          height: height,
+          filesize: File.size(input),
+          backend: backend,
+          duration_ms: duration_ms,
+          tier: :metadata
+        )
+      end
+
+      def self.result_filesize(input, output)
+        path = output || input
+        path ? File.size(path) : nil
+      end
+
+      def success? = true
+    end
 end