safe_image 0.3.0 → 0.5.0

data/lib/safe_image/native_helper.rb

@@ -0,0 +1,281 @@
+# frozen_string_literal: true
+
+require "json"
+require "rbconfig"
+require "tmpdir"
+
+module SafeImage
+  module NativeHelper
+    module_function
+
+    DEFAULT_HELPER = File.expand_path("safe_image_vips_helper", __dir__).freeze
+    HELPER = ENV.fetch("SAFE_IMAGE_VIPS_HELPER", DEFAULT_HELPER).freeze
+    STDERR_TAIL_BYTES = 2000
+
+    def available?
+      verify!
+      true
+    rescue Error, CommandError, LoadError
+      false
+    end
+
+    def ensure_available!
+      return if File.executable?(HELPER)
+
+      raise VipsUnavailableError, "compiled safe_image_vips_helper is missing or not executable: #{HELPER}"
+    end
+
+    def verify!
+      return true if @verified
+
+      call!("version", sandbox: false)
+      @verified = true
+    end
+
+    def probe(path, max_pixels)
+      call!("probe", input: path, max_pixels: max_pixels)
+    end
+
+    def thumbnail(input, output, width, height, format, quality, max_pixels)
+      call!(
+        "thumbnail",
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        format: format,
+        quality: quality,
+        max_pixels: max_pixels
+      )
+    end
+
+    def resize(input, output, scale, format, quality, max_pixels)
+      call!(
+        "resize",
+        input: input,
+        output: output,
+        scale: scale,
+        format: format,
+        quality: quality,
+        max_pixels: max_pixels
+      )
+    end
+
+    def crop_north(input, output, width, height, format, quality, max_pixels)
+      call!(
+        "crop-north",
+        input: input,
+        output: output,
+        width: width,
+        height: height,
+        format: format,
+        quality: quality,
+        max_pixels: max_pixels
+      )
+    end
+
+    def convert(input, output, format, quality, max_pixels)
+      call!("convert", input: input, output: output, format: format, quality: quality, max_pixels: max_pixels)
+    end
+
+    def png_from_rgba(raw_input, width, height, output)
+      call!("png-from-rgba", raw_input: raw_input, width: width, height: height, output: output)
+    end
+
+    def letter_avatar(output, size, red, green, blue, markup, font, fontfile)
+      call!(
+        "letter-avatar",
+        output: output,
+        size: size,
+        red: red,
+        green: green,
+        blue: blue,
+        markup: markup,
+        font: font,
+        fontfile: fontfile
+      )
+    end
+
+    def dominant_color(path, max_pixels)
+      call!("dominant-color", input: path, max_pixels: max_pixels).fetch(:value)
+    end
+
+    def pages(path, max_pixels)
+      call!("pages", input: path, max_pixels: max_pixels).fetch(:value)
+    end
+
+    def orientation(path, max_pixels)
+      call!("orientation", input: path, max_pixels: max_pixels).fetch(:value)
+    end
+
+    def call!(command, sandbox: SafeImage.sandbox?, **options)
+      ensure_available!
+
+      Dir.mktmpdir("safe-image-vips-helper-") do |tmpdir|
+        response = File.join(tmpdir, "response.json")
+        argv = [HELPER, command, "--response", response]
+        options.each do |key, value|
+          next if value.nil?
+
+          argv << "--#{key.to_s.tr("_", "-")}" << value.to_s
+        end
+
+        stdout = stderr = nil
+        status = nil
+        if sandbox
+          begin
+            stdout, stderr, status = run_sandboxed!(argv, tmpdir, options)
+          rescue Sandbox.landlock_command_error => e
+            stdout = e.stdout
+            stderr = e.stderr
+            status = e.status
+            payload = read_response(response, stderr: stderr)
+            raise_helper_error(payload, status, command, stderr: stderr, stdout: stdout)
+          end
+        else
+          begin
+            stdout, stderr, status = run_process!(argv, tmpdir)
+          rescue CommandError => e
+            stdout = e.stdout
+            stderr = e.stderr
+            status = e.status
+            payload = read_response(response, stderr: stderr)
+            raise_helper_error(payload, status, command, stderr: stderr, stdout: stdout)
+          end
+        end
+
+        payload = read_response(response, stderr: stderr)
+        helper_failed = status.respond_to?(:success?) ? !status.success? : false
+        raise_helper_error(payload, status, command, stderr: stderr, stdout: stdout) if helper_failed || !payload[:ok]
+        payload.reject { |key, _| key == :ok }
+      end
+    rescue LoadError
+      raise Error, "landlock sandbox requested but the landlock gem is unavailable"
+    end
+
+    def run_process!(argv, tmpdir)
+      stdout, stderr = Runner.run_process!(argv, helper_env(tmpdir), timeout: Runner::DEFAULT_TIMEOUT)
+      [stdout, stderr, nil]
+    end
+
+    def run_sandboxed!(argv, tmpdir, options)
+      require "landlock"
+
+      result =
+        Sandbox.landlock_capture!(
+          argv,
+          read:
+            Sandbox.existing_paths([*Sandbox.default_read_paths, *Sandbox.runtime_read_paths, *read_paths(options)]),
+          write: Sandbox.existing_paths([tmpdir, *write_paths(options)]),
+          execute: Sandbox.existing_paths([File.dirname(HELPER), *Sandbox.default_execute_paths]),
+          env: helper_env(tmpdir),
+          unsetenv_others: true,
+          bind_tcp: landlock_abi >= 4 ? [1] : [],
+          scope: landlock_abi >= 6 ? %i[abstract_unix_socket signal] : [],
+          timeout: Runner::DEFAULT_TIMEOUT,
+          rlimits: Sandbox::DEFAULT_RLIMITS,
+          seccomp_deny_network: true,
+          max_output_bytes: Runner::MAX_OUTPUT_BYTES,
+          truncate_output: false
+        )
+      stdout = result.stdout if result.respond_to?(:stdout)
+      stderr = result.stderr if result.respond_to?(:stderr)
+      status = result.status if result.respond_to?(:status)
+      [stdout, stderr, status]
+    end
+
+    def helper_env(tmpdir)
+      Runner.command_env(tmpdir).merge("SAFE_IMAGE_SANDBOX_CHILD" => "1")
+    end
+
+    def landlock_abi
+      @landlock_abi ||= Landlock.abi_version
+    end
+
+    def tail(value)
+      text = value.to_s
+      return nil if text.empty?
+
+      text.bytesize > STDERR_TAIL_BYTES ? text.byteslice(-STDERR_TAIL_BYTES, STDERR_TAIL_BYTES) : text
+    end
+
+    def read_response(path, stderr: nil)
+      JSON.parse(File.read(path), symbolize_names: true)
+    rescue Errno::ENOENT
+      {
+        ok: false,
+        error: "CommandError",
+        message: "native vips helper did not write a response",
+        stderr_tail: tail(stderr)
+      }
+    rescue JSON::ParserError => e
+      {
+        ok: false,
+        error: "CommandError",
+        message: "native vips helper wrote invalid JSON: #{e.message}",
+        stderr_tail: tail(stderr)
+      }
+    end
+
+    def raise_helper_error(payload, status, command, stderr: nil, stdout: nil)
+      message =
+        (
+          if payload[:message].to_s.empty?
+            "native vips helper failed with status #{exit_status(status).inspect}"
+          else
+            payload[:message]
+          end
+        )
+      original_class = payload[:error].to_s
+      stderr_tail = payload[:stderr_tail] || tail(stderr)
+      case original_class
+      when "LimitError"
+        raise LimitError.new(message, original_error_class: original_class, stderr_tail: stderr_tail)
+      when "UnsupportedFormatError"
+        raise UnsupportedFormatError.new(message, original_error_class: original_class, stderr_tail: stderr_tail)
+      when "VipsUnavailableError"
+        raise VipsUnavailableError.new(message, original_error_class: original_class, stderr_tail: stderr_tail)
+      when "ArgumentError"
+        raise ArgumentError, append_helper_detail(message, original_class, stderr_tail)
+      when "InvalidImageError", ""
+        raise InvalidImageError.new(message, original_error_class: original_class, stderr_tail: stderr_tail)
+      else
+        raise CommandError.new(
+                "native vips helper downgraded unknown error class #{original_class.inspect}: #{message}",
+                command: [HELPER, command],
+                status: exit_status(status),
+                stdout: stdout.to_s,
+                stderr: stderr.to_s,
+                category: :native_helper,
+                operation: command,
+                original_error_class: original_class,
+                stderr_tail: stderr_tail
+              )
+      end
+    end
+
+    def exit_status(status)
+      status.respond_to?(:exitstatus) ? status.exitstatus : status
+    end
+
+    def append_helper_detail(message, _original_class, stderr_tail)
+      return message if stderr_tail.nil? || stderr_tail.empty?
+
+      "#{message} (native vips helper stderr tail: #{stderr_tail})"
+    end
+
+    def read_paths(options)
+      [options[:input], options[:raw_input], options[:fontfile]].compact.reject(&:empty?)
+    end
+
+    def write_paths(options)
+      output = options[:output]
+      return [] unless output
+
+      expanded = File.expand_path(output)
+      paths = [File.dirname(expanded)]
+      paths << expanded if File.exist?(expanded)
+      paths
+    end
+  end
+end

data/lib/safe_image/operation_backends/base.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require "pathname"
+
+module SafeImage
+  module OperationBackends
+    # Shared operation-strategy plumbing: path normalization, max-pixel config,
+    # optimizer post-processing and uniform Result construction.
+    class Base
+      attr_reader :config
+
+      def initialize(config:)
+        @config = config
+      end
+
+      def frame_count(path, max_pixels: nil)
+        max_pixels = resolved_max_pixels(max_pixels)
+        # ico directories are counted by the pure-Ruby parser on either backend;
+        # everything else is a header-only count.
+        if File.extname(PathSafety.local_path(path)).downcase == ".ico"
+          return Ico.frame_count(path, max_pixels: max_pixels)
+        end
+
+        backend_frame_count(path, max_pixels: max_pixels)
+      end
+
+      private
+
+      def input_output!(input, output)
+        input, output = PathSafety.ensure_distinct_file_paths!(input, output)
+        [input.to_s, output.to_s]
+      end
+
+      def safe_output!(output)
+        PathSafety.ensure_safe_output_path!(output).to_s
+      end
+
+      def resolved_max_pixels(max_pixels)
+        SafeImage.resolved_max_pixels(max_pixels, config: config)
+      end
+
+      # Post-processing applies only to the formats the optimizer tools
+      # understand; other outputs (gif, jxl, ...) skip the pass.
+      def optimize_output(output, quality)
+        format = Formats.extension(output)
+        return unless Formats.optimizable_output?(format)
+
+        write_through_tempfile(output) do |tmp_path|
+          Optimizer.optimize(
+            input: output,
+            output: tmp_path,
+            mode: :lossless,
+            strip_metadata: true,
+            quality: quality,
+            assume_upright: true
+          )
+        end
+      end
+
+      # Writes via a sibling tempfile and renames into place so callers never
+      # observe a partially-written destination.
+      def write_through_tempfile(output)
+        StagedOutput.replace(output, suffix: ".safe-image#{File.extname(output)}") { |tmp_path| yield tmp_path }
+      end
+
+      def result_from_info(input, output, info, backend, tier: nil, optimizer: nil)
+        Result.build(
+          input: input,
+          output: output,
+          input_format: info.fetch(:input_format),
+          output_format: info.fetch(:output_format),
+          width: info.fetch(:width),
+          height: info.fetch(:height),
+          backend: backend,
+          encoder: info[:encoder],
+          duration_ms: info.fetch(:duration_ms),
+          optimizer: optimizer,
+          tier: tier
+        )
+      end
+    end
+  end
+end

data/lib/safe_image/operation_backends/image_magick.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require_relative "base"
+
+module SafeImage
+  module OperationBackends
+    # ImageMagick operation orchestration. Inputs/outputs still pass the shared
+    # path safety checks before the lower backend builds argv arrays with coder:
+    # prefixes and the restrictive policy.xml.
+    class ImageMagick < Base
+      def resize(input:, output:, width:, height:, quality:, optimize:, max_pixels:, chroma_subsampling: nil)
+        input, output = input_output!(input, output)
+        probe = operation_probe(input, max_pixels: resolved_max_pixels(max_pixels))
+        output = safe_output!(output)
+        info =
+          ImageMagickBackend.thumbnail(
+            input: probe.input,
+            output: output,
+            width: width,
+            height: height,
+            format: Formats.extension(output),
+            quality: quality
+          )
+        optimize_output(output, quality) if optimize
+        result_from_info(probe.input, output, info, :imagemagick, tier: :resize)
+      end
+
+      def crop(input:, output:, width:, height:, quality:, optimize:, max_pixels:, chroma_subsampling: nil)
+        input, output = input_output!(input, output)
+        probe = operation_probe(input, max_pixels: resolved_max_pixels(max_pixels))
+        output = safe_output!(output)
+        info =
+          ImageMagickBackend.resize_like(
+            input: probe.input,
+            output: output,
+            width: width,
+            height: height,
+            format: Formats.extension(output),
+            quality: quality,
+            crop: :north
+          )
+        optimize_output(output, quality) if optimize
+        result_from_info(probe.input, output, info, :imagemagick, tier: :crop)
+      end
+
+      def downsize(input:, output:, dimensions:, optimize:, max_pixels:, quality: nil, chroma_subsampling: nil)
+        input, output = input_output!(input, output)
+        probe = operation_probe(input, max_pixels: resolved_max_pixels(max_pixels))
+        output = safe_output!(output)
+        info =
+          ImageMagickBackend.downsize(
+            input: probe.input,
+            output: output,
+            dimensions: dimensions,
+            format: Formats.extension(output)
+          )
+        optimize_output(output, nil) if optimize
+        result_from_info(probe.input, output, info, :imagemagick, tier: :downsize)
+      end
+
+      def convert(input:, output:, format:, quality:, optimize:, max_pixels:, chroma_subsampling: nil)
+        input, output = input_output!(input, output)
+        probe = operation_probe(input, max_pixels: resolved_max_pixels(max_pixels))
+        normalized_format = Formats.normalize(format)
+        info = ImageMagickBackend.convert(input: probe.input, output: output, format: format, quality: quality)
+        optimize_output(output, normalized_format == "jpg" ? quality : nil) if optimize
+        result_from_info(probe.input, output, info, :imagemagick, tier: :convert)
+      end
+
+      def fix_orientation(input:, output:, max_pixels:, quality: nil)
+        input, output = input_output!(input, output)
+        probe = operation_probe(input, max_pixels: resolved_max_pixels(max_pixels))
+        info = ImageMagickBackend.fix_orientation(input: probe.input, output: output)
+        result_from_info(probe.input, output, info, :imagemagick, tier: :fix_orientation)
+      end
+
+      def convert_favicon_to_png(input:, output:, optimize:, max_pixels: nil)
+        input, output = input_output!(input, output)
+        info = ImageMagickBackend.convert_ico_to_png(input: Pathname.new(input).expand_path.to_s, output: output)
+        optimize_output(output, nil) if optimize
+        result_from_info(input, output, info, :imagemagick, tier: :convert_favicon)
+      end
+
+      def letter_avatar(output:, size:, background_rgb:, letter:, pointsize:, font:)
+        output = safe_output!(output)
+        request = {
+          output: output,
+          size: size,
+          background_rgb: background_rgb,
+          letter: letter,
+          pointsize: pointsize,
+          font: font
+        }
+        result_from_info(
+          "generated",
+          output,
+          ImageMagickBackend.letter_avatar(**request),
+          :imagemagick,
+          tier: :letter_avatar
+        )
+      end
+
+      private
+
+      def operation_probe(path, max_pixels:)
+        path = Pathname.new(path).expand_path.to_s
+        info = ImageMagickBackend.probe(path, max_pixels: max_pixels)
+        Result.metadata(
+          input: path,
+          input_format: info.fetch(:input_format),
+          width: info.fetch(:width),
+          height: info.fetch(:height),
+          backend: :imagemagick,
+          duration_ms: info.fetch(:duration_ms)
+        )
+      end
+
+      def backend_frame_count(path, max_pixels:)
+        ImageMagickBackend.frame_count(path, max_pixels: max_pixels)
+      end
+    end
+  end
+end