shrine 3.10.0 → 3.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5601661d53737bf3290ec5897dc9d33cfe5edac60a7468e67de7191649671a14
-  data.tar.gz: bf2a26e2162a0c1805f2e8d174128e8ee5008060fdbbb9b8e358d41bfdf680a2
+  metadata.gz: 2027c3833ffb021cf9fe9be3761c3238ca807eb1591ed910b585b226cad80497
+  data.tar.gz: fd9ce3716ac5c110a306f4823acf90de7cf673132ef90b181e8d7040cc8d74d0
 SHA512:
-  metadata.gz: 7eb43ca8a78d4dedec0d24422ca4bc9f62eb6e454aa61ac7871760c4c398973a9787591295c39799f6b3250d4b3af9e80f7082c659fb6ed67435d775846ca5e2
-  data.tar.gz: 636a7343486f6baaa3fa841abcef8439eb0df5d7183d6ac39a756a508de544dd356bca2562a9e01ac76b871a29455d2a40601f8086e8050dcc793bd57fc568e0
+  metadata.gz: 9181db3a505b16fba406a6d98cc2f4a37222fcbacdf47427d5ec80d087ef3746b0db2152d21685b89f8cfc77db766b0ed13f1b976241354dc48b9e82aaa1fd35
+  data.tar.gz: 4f891d6fcfd5cdd29a39e04479d42d20bc7a6511557a2f82f85dc6889536bf38be9b5f281389fe6751ce7e26271bd1c85897c6e899b6ba3e08d3070ffc1e717e

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 3.10.2 (2026-10-11)
+
+* `derivation_endpoint` – Prevent bypassing CDN caching by modifying the encoding or structure of the signed URL query string (@Antsiscool, @janko)
+
+## 3.10.1 (2026-10-10)
+
+* `model` – Make `Attacher#write` a no-op when the attacher isn't backed by a model, fixing `remove_invalid` raising `NoMethodError` on attachers without a record (@janko)
+
 ## 3.10.0 (2026-09-20)
 
 * Add `fallback_storage` plugin for reading files from a secondary storage when they're missing in the primary storage (@yegorov, @janko)

data/doc/advantages.md

@@ -389,19 +389,19 @@ and Active Storage.
 
 Uppy supports direct uploads to [AWS S3][Uppy AwsS3] or to a [custom
 endpoint][Uppy XHRUpload]. It also supports **resumable** uploads, either
-[directly to S3][Uppy AwsS3Multipart] or via the [tus protocol][tus]. For the
+[directly to S3][Uppy AwsS3 multipart] or via the [tus protocol][tus]. For the
 UI you can choose from various components, ranging from a simple [status
 bar][Uppy StatusBar] to a full-featured [dashboard][Uppy Dashboard].
 
 Shrine provides server side components for each type of upload. They are built
 on top of Rack, so that they can be used with any Ruby web framework.
 
-| Uppy                                  | Shrine                                   |
-| :---                                  | :-----                                   |
-| [XHRUpload][Uppy XHRUpload]           | [`upload_endpoint`][upload_endpoint]     |
-| [AwsS3][Uppy AwsS3]                   | [`presign_endpoint`][presign_endpoint]   |
-| [AwsS3Multipart][Uppy AwsS3Multipart] | [`uppy-s3_multipart`][uppy-s3_multipart] |
-| [Tus][Uppy Tus]                       | [`tus-ruby-server`][tus-ruby-server]     |
+| Uppy                                      | Shrine                                   |
+| :---                                      | :-----                                   |
+| [XHRUpload][Uppy XHRUpload]               | [`upload_endpoint`][upload_endpoint]     |
+| [AwsS3][Uppy AwsS3]                       | [`presign_endpoint`][presign_endpoint]   |
+| [AwsS3 (multipart)][Uppy AwsS3 multipart] | [`uppy-s3_multipart`][uppy-s3_multipart] |
+| [Tus][Uppy Tus]                           | [`tus-ruby-server`][tus-ruby-server]     |
 
 [Rack]: https://rack.github.io
 [Sinatra]: http://sinatrarb.com
@@ -440,10 +440,10 @@ on top of Rack, so that they can be used with any Ruby web framework.
 [Uppy XHRUpload]: https://uppy.io/docs/xhr-upload/
 [Uppy AwsS3]: https://uppy.io/docs/aws-s3/
 [Uppy Tus]: https://uppy.io/docs/tus/
-[Uppy AwsS3Multipart]: https://uppy.io/docs/aws-s3-multipart/
+[Uppy AwsS3 multipart]: https://uppy.io/docs/aws-s3/#shouldusemultipartfile
 [tus]: https://tus.io
-[Uppy StatusBar]: https://uppy.io/examples/statusbar/
-[Uppy Dashboard]: https://uppy.io/examples/dashboard/
+[Uppy StatusBar]: https://uppy.io/docs/status-bar/
+[Uppy Dashboard]: https://uppy.io/docs/dashboard/
 [tus-ruby-server]: https://github.com/janko/tus-ruby-server
 [uppy-s3_multipart]: https://github.com/janko/uppy-s3_multipart
 [backgrounding]: https://shrinerb.com/docs/plugins/backgrounding

data/doc/direct_s3.md

@@ -174,11 +174,21 @@ and request headers.
 }
 ```
 
-Uppy's [AWS S3][uppy aws-s3] plugin would then make a request to this endpoint
-and use these parameters to upload the file directly to S3. Once the file has
-been uploaded, you can generate a JSON representation of the uploaded file on
-the client side, and write it to the hidden attachment field (or send it
-directly in an AJAX request).
+Uppy's [AWS S3][uppy aws-s3] plugin in Companion mode will then fetch these
+parameters from `<companionEndpoint>/s3/params` and use them to upload the file
+directly to S3:
+
+```js
+uppy.use(AwsS3, {
+  companionEndpoint: '', // relative to the current host
+  shouldUseMultipart: false, // Shrine's presign endpoint only signs single-request uploads
+})
+```
+
+Once the file has been uploaded, you can generate a JSON representation of the
+uploaded file on the client side (the S3 object key is available as
+`response.body.key` in the `upload-success` event), and write it to the hidden
+attachment field (or send it directly in an AJAX request).
 
 ```rb
 {
@@ -203,8 +213,8 @@ as the [Roda][roda demo] / [Rails][rails demo] demo app for a complete example
 of multiple direct S3 uploads.
 
 Also, if you're dealing with larger files, you may want to make the uploads
-resumable by using the [AWS S3 Multipart][uppy aws-s3-multipart] Uppy plugin
-instead, with the [uppy-s3_multipart] gem on the backend. Your back-end
+resumable by using Uppy's [AWS S3][uppy aws-s3-multipart] plugin in multipart
+mode instead, with the [uppy-s3_multipart] gem on the backend. Your back-end
 implementation is similar, just using `Shrine.uppy_s3_multipart` in place of
 `Shrine.presign_endpoint`. Instructions can be found in the [gem
 docs][uppy-s3_multipart shrine].
@@ -396,8 +406,8 @@ setup] guide.
 [rails demo]: https://github.com/erikdahlstrand/shrine-rails-example
 [Uppy]: https://uppy.io
 [uppy aws-s3]: https://uppy.io/docs/aws-s3/
-[uppy aws-s3 cors]: https://uppy.io/docs/aws-s3/#S3-Bucket-configuration
-[uppy aws-s3-multipart]: https://uppy.io/docs/aws-s3/
+[uppy aws-s3 cors]: https://uppy.io/docs/aws-s3/#bucket-and-cors-setup
+[uppy aws-s3-multipart]: https://uppy.io/docs/aws-s3/#shouldusemultipartfile
 [uppy-s3_multipart]: https://github.com/janko/uppy-s3_multipart
 [uppy-s3_multipart shrine]: https://github.com/janko/uppy-s3_multipart#shrine
 [Amazon S3 Data Consistency Model]: http://docs.aws.amazon.com/AmazonS3/latest/dev/Introduction.html#ConsistencyMode

data/doc/external/extensions.md

@@ -50,4 +50,4 @@ title: Extensions
 | [faster_s3_url](https://github.com/jrochkind/faster_s3_url)     | Optimized generation of public and presigned AWS S3 GET URLs                    |
 | [imgproxy](https://github.com/imgproxy/imgproxy.rb)             | Integration for [imgproxy](https://github.com/imgproxy/imgproxy)                |
 | [rails_admin](https://github.com/sferik/rails_admin)            | Integration for [RailsAdmin](https://github.com/sferik/rails_admin)             |
-| [uppy-s3_multipart](https://github.com/janko/uppy-s3_multipart) | Integration for [Uppy AWS S3 Multipart](https://uppy.io/docs/aws-s3-multipart/) |
+| [uppy-s3_multipart](https://github.com/janko/uppy-s3_multipart) | Integration for [Uppy AWS S3](https://uppy.io/docs/aws-s3/) multipart uploads |

data/doc/getting_started.md

@@ -896,13 +896,13 @@ on slow and flaky internet connections.
 
 #### Uppy S3 Multipart
 
-You can achieve resumable uploads directly to S3 with the [AWS S3
-Multipart][uppy aws-s3-multipart] Uppy plugin, accompanied with
+You can achieve resumable uploads directly to S3 with Uppy's [AWS S3][uppy
+aws-s3-multipart] plugin in multipart mode, accompanied with the
 `uppy_s3_multipart` Shrine plugin provided by the [uppy-s3_multipart] gem.
 
 ```rb
 # Gemfile
-gem "uppy-s3_multipart", "~> 0.3"
+gem "uppy-s3_multipart", "~> 1.3"
 ```
 ```rb
 Shrine.plugin :uppy_s3_multipart
@@ -1108,7 +1108,7 @@ Shrine.logger.level = Logger::WARN
 [Uppy]: https://uppy.io
 [shrine-tus]: https://github.com/shrinerb/shrine-tus
 [tus]: https://tus.io
-[uppy aws-s3-multipart]: https://uppy.io/docs/aws-s3-multipart/
+[uppy aws-s3-multipart]: https://uppy.io/docs/aws-s3/#shouldusemultipartfile
 [uppy aws-s3]: https://uppy.io/docs/aws-s3/
 [uppy tus]: https://uppy.io/docs/tus/
 [uppy xhr-upload]: https://uppy.io/docs/xhr-upload/

data/doc/release_notes/3.10.1.md

@@ -0,0 +1,15 @@
+---
+title: Shrine 3.10.1
+---
+
+## Bug fixes
+
+* Since Shrine 3.9.0, the `remove_invalid` plugin would raise `NoMethodError` when validation failed on an attacher without a record and the `model` plugin was loaded (directly or through the `activerecord`/`sequel` plugins).
+
+  ```rb
+  attacher = Shrine::Attacher.new
+  attacher.assign(invalid_file)
+  # NoMethodError: undefined method '=' for nil
+  ```
+
+  `Attacher#write` from the `model` plugin is now a no-op when the attacher isn't backed by a model, so the invalid file is removed and validation errors are kept as before.

data/doc/release_notes/3.10.2.md

@@ -0,0 +1,31 @@
+---
+title: Shrine 3.10.2
+---
+
+## Security
+
+* The `derivation_endpoint` plugin now verifies the URL signature against the
+  URL exactly as it was received. Previously, query parameters were decoded and
+  re-encoded before verification, so the same signed URL could be requested
+  through an unlimited number of variants that all passed verification. Since
+  each variant is a separate cache key on a CDN, this could be used to bypass
+  CDN caching and repeatedly trigger derivations on the server:
+
+  ```
+  /derivations/thumbnail/...?type=image%2Fwebp&signature=abc123      # original
+  /derivations/thumbnail/...?%74ype=image%2Fwebp&signature=abc123    # encoded parameter name
+  /derivations/thumbnail/...?&&type=image%2Fwebp&signature=abc123    # empty parameters
+  /derivations/thumbnail/...?type=image%2Fwebp&signature=abc123?foo  # appended query
+  ```
+
+  These variants now return a `403 Forbidden` response. The `signature` query
+  parameter is also required to be the last parameter, which is where Shrine
+  always puts it.
+
+## Backwards compatibility
+
+* URLs generated by the `derivation_endpoint` plugin are unchanged, so
+  existing URLs remain valid. However, if a proxy between the client and your
+  application rewrites the query string (e.g. re-encodes characters, reorders
+  parameters, or appends tracking parameters), signature verification will now
+  fail for those requests.

data/lib/shrine/plugins/derivation_endpoint.rb

@@ -717,29 +717,27 @@ class Shrine
 
     # Returns a URL with the `signature` query parameter
     def sign_url(url)
-      path, query = url.split("?")
+      path, query = url.split("?", 2)
 
-      params = Rack::Utils.parse_query(query.to_s)
-      params.merge!("signature" => generate_signature(url))
-
-      query = Rack::Utils.build_query(params)
+      signature = generate_signature("#{path}?#{query}")
+      query     = [query, "signature=#{signature}"].reject { |part| part.to_s.empty? }.join("&")
 
       "#{path}?#{query}"
     end
 
-    # Calculcates the signature from the URL and checks whether it matches the
-    # value in the `signature` query parameter. Raises `InvalidSignature` if
-    # the `signature` parameter is missing or its value doesn't match the
-    # calculated signature.
+    # Calculates the signature from the URL and checks whether it matches the
+    # value in the trailing `signature` query parameter. Raises
+    # `InvalidSignature` if the `signature` parameter is missing or its value
+    # doesn't match the calculated signature. The URL is verified as is,
+    # without any normalization, so that each signed URL has only one valid
+    # form (otherwise variants of it could be used to bypass CDN caching).
     def verify_url(url)
-      path, query = url.split("?")
-
-      params    = Rack::Utils.parse_query(query.to_s)
-      signature = params.delete("signature")
+      path, query = url.split("?", 2)
 
-      query = Rack::Utils.build_query(params)
+      params    = query.to_s.split("&", -1)
+      signature = params.pop.delete_prefix("signature=") if params.last&.start_with?("signature=")
 
-      verify_signature("#{path}?#{query}", signature)
+      verify_signature("#{path}?#{params.join("&")}", signature)
     end
 
     def verify_signature(string, signature)

data/lib/shrine/plugins/model.rb

@@ -122,12 +122,15 @@ class Shrine
         # Writes uploaded file data into the model.
         def set(*)
           result = super
-          write if model?
+          write
           result
         end
 
-        # Writes the attachment data into the model attribute.
+        # Writes the attachment data into the model attribute. Does nothing
+        # when the attacher isn't backed by a model instance.
         def write
+          return unless model?
+
           column_values.each do |name, value|
             write_attribute(name, value)
           end

data/lib/shrine/version.rb

@@ -8,7 +8,7 @@ class Shrine
   module VERSION
     MAJOR = 3
     MINOR = 10
-    TINY  = 0
+    TINY  = 2
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shrine
 version: !ruby/object:Gem::Version
-  version: 3.10.0
+  version: 3.10.2
 platform: ruby
 authors:
 - Janko Marohnić
@@ -490,6 +490,8 @@ files:
 - doc/release_notes/3.0.1.md
 - doc/release_notes/3.1.0.md
 - doc/release_notes/3.10.0.md
+- doc/release_notes/3.10.1.md
+- doc/release_notes/3.10.2.md
 - doc/release_notes/3.2.0.md
 - doc/release_notes/3.2.1.md
 - doc/release_notes/3.2.2.md