safe_image 0.3.0 → 0.5.0

data/lib/safe_image.rb

@@ -3,22 +3,40 @@
 require_relative "safe_image/version"
 
 module SafeImage
-  class Error < StandardError; end
+  class Error < StandardError
+    attr_reader :original_error_class, :stderr_tail
+
+    def initialize(message = nil, original_error_class: nil, stderr_tail: nil)
+      super(message)
+      @original_error_class = original_error_class
+      @stderr_tail = stderr_tail
+    end
+  end
 
   # Raised when any operation is attempted before SafeImage.configure!.
-  class NotConfiguredError < Error; end
+  class NotConfiguredError < Error
+  end
+
+  class UnsupportedFormatError < Error
+  end
 
-  class UnsupportedFormatError < Error; end
+  # Raised when the native libvips helper cannot initialize or execute.
+  # configure!(backend: :vips) surfaces this at boot; operations never fall back
+  # to ImageMagick.
+  class VipsUnavailableError < UnsupportedFormatError
+  end
+
+  class UnsafePathError < Error
+  end
 
-  # Raised when libvips cannot be loaded at runtime. configure!(backend: :vips)
-  # surfaces this at boot; operations never fall back to ImageMagick.
-  class VipsUnavailableError < UnsupportedFormatError; end
-  class UnsafePathError < Error; end
-  class InvalidImageError < Error; end
-  class LimitError < Error; end
+  class InvalidImageError < Error
+  end
+
+  class LimitError < Error
+  end
 
   # Default decompression-bomb ceiling when configure! is not given an explicit
-  # max_pixels. Mirrored in the native binding (SAFE_IMAGE_DEFAULT_MAX_PIXELS)
+  # max_pixels. Mirrored in the native helper (SAFE_IMAGE_DEFAULT_MAX_PIXELS)
   # and aligned with the 128MP area limit on the ImageMagick path. Per-call
   # max_pixels: overrides the configured value.
   DEFAULT_MAX_PIXELS = 128 * 1024 * 1024
@@ -33,40 +51,49 @@ end
 
 require_relative "safe_image/native"
 require_relative "safe_image/result"
+require_relative "safe_image/quality_defaults"
 require_relative "safe_image/runner"
-require_relative "safe_image/sandbox"
-require_relative "safe_image/zygote"
 require_relative "safe_image/path_safety"
+require_relative "safe_image/formats"
+require_relative "safe_image/backend_label"
+require_relative "safe_image/operation_set"
+require_relative "safe_image/staged_output"
+require_relative "safe_image/sandbox"
+require_relative "safe_image/native_helper"
 require_relative "safe_image/optimizer"
 require_relative "safe_image/svg_metadata"
-require_relative "safe_image/svg_css"
-require_relative "safe_image/svg_sanitizer"
 require_relative "safe_image/remote"
 require_relative "safe_image/ico"
 require_relative "safe_image/image_magick_backend"
 require_relative "safe_image/jpegli_backend"
 require_relative "safe_image/vips_backend"
 require_relative "safe_image/processor"
-require_relative "safe_image/discourse_compat"
+require_relative "safe_image/operation_backends"
+require_relative "safe_image/metadata_operations"
+require_relative "safe_image/transform_operations"
+require_relative "safe_image/api/metadata"
+require_relative "safe_image/api/transform"
 
 module SafeImage
+  private_constant :API
+
   module_function
 
   @config = nil
 
   # Decides, in one place, everything that varies by host: which backend
-  # decodes untrusted bytes, whether operations run inside the Landlock
-  # sandbox, and the default decompression-bomb ceiling. Must be called before
-  # any operation; calling it again replaces the configuration.
+  # decodes untrusted bytes, whether child helpers/tools run under Landlock,
+  # and the default decompression-bomb ceiling. Must be called before any
+  # operation; calling it again replaces the configuration.
   #
   # Validation is eager so a misconfigured host fails at boot rather than on
   # the first request.
   def configure!(backend:, landlock:, max_pixels: DEFAULT_MAX_PIXELS)
     backend = backend.to_sym
-    unless BACKENDS.include?(backend)
+    if BACKENDS.none? { |candidate| candidate == backend }
       raise ArgumentError, "unknown backend: #{backend.inspect} (expected :vips or :imagemagick)"
     end
-    unless [true, false].include?(landlock)
+    unless [true, false].any? { |candidate| candidate == landlock }
       raise ArgumentError, "landlock must be true or false, got: #{landlock.inspect}"
     end
     max_pixels = Integer(max_pixels)
@@ -75,9 +102,9 @@ module SafeImage
     case backend
     when :vips
       begin
-        VipsGlue.init!
-      rescue VipsUnavailableError => e
-        raise Error, "backend: :vips requested but libvips is unavailable: #{e.message}"
+        NativeHelper.verify!
+      rescue Error => e
+        raise Error, "backend: :vips requested but the native libvips helper is unavailable: #{e.message}"
       end
     when :imagemagick
       unless Runner.available?("magick") || Runner.available?("convert")
@@ -87,305 +114,34 @@ module SafeImage
     if landlock && !Sandbox.available?
       raise Error, "landlock: true requested but the Landlock sandbox is unavailable on this host"
     end
-
-    # The zygote bakes the backend and max_pixels in at boot; a reconfigure
-    # must not serve from a stale one.
-    Zygote.shutdown!
+    NativeHelper.ensure_available! if landlock && backend == :vips
 
     @config = Config.new(backend: backend, landlock: landlock, max_pixels: max_pixels)
   end
 
   def config
-    @config || raise(NotConfiguredError, "call SafeImage.configure!(backend: :vips | :imagemagick, landlock: true | false) before using SafeImage")
+    @config ||
+      raise(
+        NotConfiguredError,
+        "call SafeImage.configure!(backend: :vips | :imagemagick, landlock: true | false) before using SafeImage"
+      )
   end
 
   def configured? = !@config.nil?
 
   def sandbox_available? = Sandbox.available?
 
-  # Internal: whether operations must route through the sandbox worker. False
-  # before configure! (so configure!'s own availability probes can run
-  # commands) and inside worker children (so sandboxed operations never nest).
+  # Internal: whether child commands/helpers must run under Landlock. False
+  # before configure! so configure!'s own availability probes can run.
   def sandbox?
-    !!@config&.landlock && ENV["SAFE_IMAGE_SANDBOX_CHILD"] != "1"
+    !!@config&.landlock
   end
 
   # Internal: per-call max_pixels overrides the configured default.
-  def resolved_max_pixels(max_pixels)
+  def resolved_max_pixels(max_pixels, config: self.config)
     max_pixels.nil? ? config.max_pixels : max_pixels
   end
 
-  def maybe_sandbox(operation, args: [], kwargs: {})
-    config
-    return yield unless sandbox?
-
-    Sandbox.public_call!(operation, args: args, kwargs: kwargs)
-  end
-
-  def probe(path, max_pixels: nil)
-    maybe_sandbox(:probe, args: [path], kwargs: { max_pixels: max_pixels }) do
-      path = PathSafety.local_path(path)
-      max_pixels = resolved_max_pixels(max_pixels)
-
-      case File.extname(path).downcase
-      when ".svg"
-        info = SvgMetadata.probe(path, max_pixels: max_pixels)
-        Result.new(
-          input: File.expand_path(path),
-          output: nil,
-          input_format: "svg",
-          output_format: nil,
-          width: info.fetch(:width),
-          height: info.fetch(:height),
-          filesize: File.size(path),
-          backend: "svg-metadata",
-          duration_ms: info.fetch(:duration_ms),
-          optimizer: nil
-        )
-      when ".ico"
-        # Pure-Ruby directory parse; reports the largest entry's dimensions.
-        info = Ico.probe(path, max_pixels: max_pixels)
-        Result.new(
-          input: File.expand_path(path),
-          output: nil,
-          input_format: "ico",
-          output_format: nil,
-          width: info.fetch(:width),
-          height: info.fetch(:height),
-          filesize: File.size(path),
-          backend: "ico-metadata",
-          duration_ms: info.fetch(:duration_ms),
-          optimizer: nil
-        )
-      else
-        case config.backend
-        when :vips
-          Processor.new(max_pixels: max_pixels).probe(path)
-        when :imagemagick
-          info = ImageMagickBackend.probe(path, max_pixels: max_pixels)
-          Result.new(
-            input: File.expand_path(path),
-            output: nil,
-            input_format: info.fetch(:input_format),
-            output_format: nil,
-            width: info.fetch(:width),
-            height: info.fetch(:height),
-            filesize: File.size(path),
-            backend: "imagemagick",
-            duration_ms: info.fetch(:duration_ms),
-            optimizer: nil
-          )
-        end
-      end
-    end
-  end
-
-  def type(path, max_pixels: nil)
-    maybe_sandbox(:type, args: [path], kwargs: { max_pixels: max_pixels }) do
-      fastimage_type(probe(path, max_pixels: max_pixels).input_format)
-    end
-  end
-
-  def size(path, max_pixels: nil)
-    maybe_sandbox(:size, args: [path], kwargs: { max_pixels: max_pixels }) do
-      result = probe(path, max_pixels: max_pixels)
-      [result.width, result.height]
-    end
-  end
-
-  def dimensions(path, max_pixels: nil)
-    size(path, max_pixels: max_pixels)
-  end
-
-  def info(path, max_pixels: nil, animated: false, orientation: false)
-    maybe_sandbox(:info, args: [path], kwargs: { max_pixels: max_pixels, animated: animated, orientation: orientation }) do
-      result = probe(path, max_pixels: max_pixels)
-      type = fastimage_type(result.input_format)
-      Info.new(
-        path: result.input,
-        type: type,
-        width: result.width,
-        height: result.height,
-        size: [result.width, result.height],
-        animated: animated ? animated?(path, max_pixels: max_pixels) : nil,
-        orientation: orientation ? orientation(path, max_pixels: max_pixels) : nil
-      )
-    end
-  end
-
-  def orientation(path, max_pixels: nil)
-    maybe_sandbox(:orientation, args: [path], kwargs: { max_pixels: max_pixels }) do
-      case File.extname(PathSafety.local_path(path)).downcase
-      when ".svg", ".ico"
-        # No EXIF orientation in either format; upright by definition.
-        1
-      else
-        max_pixels = resolved_max_pixels(max_pixels)
-        case config.backend
-        when :vips
-          # Header-only native read.
-          VipsBackend.orientation(path, max_pixels: max_pixels)
-        when :imagemagick
-          # Probe first: rejects undecodable files and enforces the pixel cap.
-          ImageMagickBackend.probe(path, max_pixels: max_pixels)
-          ImageMagickBackend.orientation(path)
-        end
-      end
-    end
-  end
-
-  def dominant_color(path, max_pixels: nil)
-    maybe_sandbox(:dominant_color, args: [path], kwargs: { max_pixels: max_pixels }) do
-      max_pixels = resolved_max_pixels(max_pixels)
-      case config.backend
-      when :vips
-        if File.extname(PathSafety.local_path(path)).downcase == ".ico"
-          # Pure-Ruby ICO decode; vips only averages the decoded pixels.
-          Ico.dominant_color(path, max_pixels: max_pixels)
-        else
-          VipsBackend.dominant_color(path, max_pixels: max_pixels)
-        end
-      when :imagemagick
-        imagemagick_dominant_color(path, max_pixels: max_pixels)
-      end
-    end
-  end
-
-  def imagemagick_dominant_color(path, max_pixels:)
-    # Probe first: rejects undecodable files and enforces the pixel cap
-    # before ImageMagick fully decodes the image to average it.
-    probe(path, max_pixels: max_pixels)
-    ImageMagickBackend.dominant_color(path)
-  end
-
-  def fastimage_type(format)
-    format.to_s == "jpg" ? :jpeg : format.to_s.to_sym
-  end
-
-  def remote_info(url, **kwargs)
-    config
-    Remote.info(url, **kwargs)
-  end
-
-  def remote_size(url, **kwargs)
-    config
-    Remote.size(url, **kwargs)
-  end
-
-  def remote_dimensions(url, **kwargs)
-    remote_size(url, **kwargs)
-  end
-
-  def remote_type(url, **kwargs)
-    config
-    Remote.type(url, **kwargs)
-  end
-
-  def remote_animated?(url, **kwargs)
-    config
-    Remote.animated?(url, **kwargs)
-  end
-
-  def remote_dominant_color(url, **kwargs)
-    config
-    Remote.dominant_color(url, **kwargs)
-  end
-
-  def fetch_remote(url, **kwargs, &block)
-    config
-    Remote.fetch(url, **kwargs, &block)
-  end
-
-  def thumbnail(input:, output:, width:, height:, format: nil, quality: 85, max_pixels: nil, optimize: false, optimize_mode: :lossless, chroma_subsampling: :auto)
-    maybe_sandbox(
-      :thumbnail,
-      kwargs: {
-        input: input,
-        output: output,
-        width: width,
-        height: height,
-        format: format,
-        quality: quality,
-        max_pixels: max_pixels,
-        optimize: optimize,
-        optimize_mode: optimize_mode,
-        chroma_subsampling: chroma_subsampling
-      }
-    ) do
-      Processor.new(max_pixels: resolved_max_pixels(max_pixels), chroma_subsampling: chroma_subsampling).thumbnail(
-        input: input,
-        output: output,
-        width: width,
-        height: height,
-        format: format,
-        quality: quality,
-        optimize: optimize,
-        optimize_mode: optimize_mode
-      )
-    end
-  end
-
-  def optimize(path, mode: :lossless, strip_metadata: true, quality: nil, strict: true)
-    maybe_sandbox(:optimize, args: [path], kwargs: { mode: mode, strip_metadata: strip_metadata, quality: quality, strict: strict }) do
-      Optimizer.optimize(path, mode: mode, strip_metadata: strip_metadata, quality: quality, strict: strict)
-    end
-  end
-
-  def resize(*args, **kwargs)
-    maybe_sandbox(:resize, args: args, kwargs: kwargs) { DiscourseCompat.resize(*args, **kwargs) }
-  end
-
-  def crop(*args, **kwargs)
-    maybe_sandbox(:crop, args: args, kwargs: kwargs) { DiscourseCompat.crop(*args, **kwargs) }
-  end
-
-  def downsize(*args, **kwargs)
-    maybe_sandbox(:downsize, args: args, kwargs: kwargs) { DiscourseCompat.downsize(*args, **kwargs) }
-  end
-
-  def convert(*args, **kwargs)
-    maybe_sandbox(:convert, args: args, kwargs: kwargs) { DiscourseCompat.convert(*args, **kwargs) }
-  end
-
-  def convert_to_jpeg(*args, **kwargs)
-    maybe_sandbox(:convert_to_jpeg, args: args, kwargs: kwargs) { DiscourseCompat.convert_to_jpeg(*args, **kwargs) }
-  end
-
-  def fix_orientation(*args, **kwargs)
-    maybe_sandbox(:fix_orientation, args: args, kwargs: kwargs) { DiscourseCompat.fix_orientation(*args, **kwargs) }
-  end
-
-  def convert_favicon_to_png(*args, **kwargs)
-    maybe_sandbox(:convert_favicon_to_png, args: args, kwargs: kwargs) { DiscourseCompat.convert_favicon_to_png(*args, **kwargs) }
-  end
-
-  def frame_count(*args, **kwargs)
-    maybe_sandbox(:frame_count, args: args, kwargs: kwargs) { DiscourseCompat.frame_count(*args, **kwargs) }
-  end
-
-  def animated?(*args, **kwargs)
-    config
-    path = args.first
-    return false if path && File.extname(PathSafety.local_path(path)).downcase == ".svg"
-
-    maybe_sandbox(:animated?, args: args, kwargs: kwargs) { DiscourseCompat.animated?(*args, **kwargs) }
-  end
-
-  def letter_avatar(*args, **kwargs)
-    maybe_sandbox(:letter_avatar, args: args, kwargs: kwargs) { DiscourseCompat.letter_avatar(*args, **kwargs) }
-  end
-
-  def optimize_image!(*args, **kwargs)
-    maybe_sandbox(:optimize_image!, args: args, kwargs: kwargs) { DiscourseCompat.optimize_image!(*args, **kwargs) }
-  end
-
-  def sanitize_svg!(*args, **kwargs)
-    # Validate the required id_namespace in the parent (after the configured
-    # check) so omitting/malformed values raise ArgumentError consistently —
-    # otherwise, under the sandbox, the worker raises and it surfaces as a
-    # sandbox CommandError instead of the documented ArgumentError.
-    config
-    SvgSanitizer.resolve_namespace(kwargs.fetch(:id_namespace, SvgSanitizer::NAMESPACE_REQUIRED))
-    maybe_sandbox(:sanitize_svg!, args: args, kwargs: kwargs) { SvgSanitizer.sanitize!(*args, **kwargs) }
-  end
+  extend API::Metadata
+  extend API::Transform
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: safe_image
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Sam Saffron
@@ -10,20 +10,6 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: fiddle
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
@@ -39,112 +25,132 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.16'
 - !ruby/object:Gem::Dependency
-  name: rexml
+  name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.4'
+        version: '5.25'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.4'
+        version: '5.25'
 - !ruby/object:Gem::Dependency
-  name: minitest
+  name: rake
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.25'
+        version: '13.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.25'
+        version: '13.0'
 - !ruby/object:Gem::Dependency
-  name: rake
+  name: rubocop-discourse
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13.0'
+        version: '3.18'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '13.0'
+        version: '3.18'
 - !ruby/object:Gem::Dependency
-  name: rubocop-discourse
+  name: syntax_tree
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '6.3'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '3.18'
+        version: '6.3'
 - !ruby/object:Gem::Dependency
   name: landlock
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.3.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 0.3.0
 description: 'Safe Image is a small Ruby image-processing boundary for untrusted uploads:
-  direct libvips thumbnails/probing, hardened ImageMagick compatibility operations,
-  optimisation, SVG sanitising, and optional atomic Landlock sandbox execution.'
+  helper-contained libvips thumbnails/probing, hardened ImageMagick compatibility
+  operations, optimisation, SVG metadata probing, and optional atomic Landlock sandbox
+  execution.'
 email:
 - sam@discourse.org
 executables: []
-extensions: []
+extensions:
+- ext/safe_image_vips_helper/extconf.rb
 extra_rdoc_files: []
 files:
 - CHANGELOG.md
 - LICENSE
 - README.md
 - SECURITY.md
+- docs/architecture.md
+- ext/safe_image_vips_helper/extconf.rb
+- ext/safe_image_vips_helper/safe_image_vips_helper.c
 - lib/safe_image.rb
 - lib/safe_image/RT_sRGB.icm
-- lib/safe_image/discourse_compat.rb
+- lib/safe_image/api/metadata.rb
+- lib/safe_image/api/transform.rb
+- lib/safe_image/backend_label.rb
 - lib/safe_image/fonts/DEJAVU-LICENSE
 - lib/safe_image/fonts/DejaVuSans.ttf
+- lib/safe_image/formats.rb
 - lib/safe_image/ico.rb
 - lib/safe_image/image_magick_backend.rb
 - lib/safe_image/imagemagick_policy/policy.xml
 - lib/safe_image/jpegli_backend.rb
+- lib/safe_image/metadata_operations.rb
 - lib/safe_image/native.rb
+- lib/safe_image/native_helper.rb
+- lib/safe_image/operation_backends.rb
+- lib/safe_image/operation_backends/base.rb
+- lib/safe_image/operation_backends/image_magick.rb
+- lib/safe_image/operation_backends/vips.rb
+- lib/safe_image/operation_set.rb
 - lib/safe_image/optimizer.rb
 - lib/safe_image/path_safety.rb
 - lib/safe_image/processor.rb
+- lib/safe_image/quality_defaults.rb
 - lib/safe_image/remote.rb
 - lib/safe_image/result.rb
 - lib/safe_image/runner.rb
 - lib/safe_image/sandbox.rb
-- lib/safe_image/svg_css.rb
+- lib/safe_image/staged_output.rb
 - lib/safe_image/svg_metadata.rb
-- lib/safe_image/svg_sanitizer.rb
+- lib/safe_image/transform_operations.rb
 - lib/safe_image/version.rb
 - lib/safe_image/vips_backend.rb
-- lib/safe_image/vips_glue.rb
-- lib/safe_image/zygote.rb
 homepage: https://github.com/sam-saffron-jarvis/safe-image
 licenses:
 - MIT