spree_core 5.3.4 → 5.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2b1ea480e8607e801d3c45d8decf522c829003eb3fa6c1f8f92b9185a4bfefec
-  data.tar.gz: 552fb0686b6da4a560dd47144d52079d1ab73c270a9e4c9093e62b9e556ef74f
+  metadata.gz: 6ed5afbde4c027a14e708b2f10a4585eab43df462da64c93d409336561bd3e45
+  data.tar.gz: 7f10df74f02a7770d794793e396486adefcc2349c6e2f0232ed5771b6dec83b2
 SHA512:
-  metadata.gz: 1ed2cab50fb7c122df6565b931324ea7ba307c8580a98ac8f9e2e400140df75092ed417db47311a6d3ec01985a6696cfbce1d3e3fa7917c329646b13ef51b095
-  data.tar.gz: 34bd9929ed9e4a962696b2be41a5bb0da2c330fd12d1cbff89e34fa78cdceaa84d6b58cb7ae321d1868864c2888eccd752cd0bef7dbd9cd473aa68490619c2f6
+  metadata.gz: 588d726ccf12398f757ded2e252e1fb90de5a11e2c5863aa06bb27a489dd6ba3e9f1993ef68e6370b4476fa8846f59b85a60046d13953723cec4140b516128ea
+  data.tar.gz: 11a5f3e4298506982cecdf1dea096852e500ed157cce75343659252d3573d3e499a3d39ab82553be8e70fb7c8af414e93e016fcb8204b3c6a9cebe03521fcee7

data/app/jobs/spree/images/save_from_url_job.rb

@@ -1,12 +1,15 @@
 require 'open-uri'
 require 'openssl'
+require 'ssrf_filter'
+require 'tempfile'
 
 module Spree
   module Images
     class SaveFromUrlJob < ::Spree::BaseJob
       queue_as Spree.queues.images
-      retry_on ActiveRecord::RecordInvalid, OpenURI::HTTPError, wait: :polynomially_longer, attempts: Spree::Config.images_save_from_url_job_attempts.to_i
+      retry_on ActiveRecord::RecordInvalid, wait: :polynomially_longer, attempts: Spree::Config.images_save_from_url_job_attempts.to_i
       discard_on URI::InvalidURIError
+      discard_on SsrfFilter::Error
 
       def perform(viewable_id, viewable_type, external_url, external_id = nil, position = nil)
         viewable = viewable_type.safe_constantize.find(viewable_id)
@@ -29,34 +32,55 @@ module Spree
         # still trigger save! if position has changed
         image.save! and return if image_already_saved?(image, external_url)
 
-        uri = URI.parse(external_url)
-        unless %w[http https].include?(uri.scheme)
-          raise URI::InvalidURIError, "Invalid URL scheme: #{uri.scheme}. Only http and https are allowed."
-        end
-
-        file = uri.open(
-          'User-Agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
-          'Accept' => 'image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8',
-          'Accept-Language' => 'en-US,en;q=0.9',
-          'Accept-Encoding' => 'gzip, deflate, br',
-          'Cache-Control' => 'no-cache',
-          'Pragma' => 'no-cache',
-          read_timeout: 60,
-          ssl_verify_mode: OpenSSL::SSL::VERIFY_PEER,
-          redirect: true
-        )
-        filename = File.basename(uri.path)
-
-        image.attachment.attach(io: file, filename: filename)
-        image.external_url = external_url
-        image.external_id = external_id if external_id.present? && image.respond_to?(:external_id)
-        image.save!
+        download_and_attach_image(external_url, image, external_id)
       rescue ActiveStorage::IntegrityError => e
         raise e unless Rails.env.test?
       end
 
       private
 
+      def download_and_attach_image(external_url, image, external_id)
+        max_size = Spree::Config.max_image_download_size
+
+        response = SsrfFilter.get(
+          external_url,
+          headers: {
+            'User-Agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+            'Accept' => 'image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8',
+            'Accept-Language' => 'en-US,en;q=0.9',
+            'Accept-Encoding' => 'gzip, deflate, br',
+            'Cache-Control' => 'no-cache',
+            'Pragma' => 'no-cache'
+          },
+          http_options: {
+            read_timeout: 60,
+            open_timeout: 30
+          }
+        )
+
+        body = response.body
+        if body.bytesize > max_size
+          raise StandardError, "Image file size exceeds the maximum allowed size of #{max_size} bytes"
+        end
+
+        uri = URI.parse(external_url)
+        filename = File.basename(uri.path)
+        tempfile = Tempfile.new(['spree_image', File.extname(uri.path)], binmode: true)
+
+        begin
+          tempfile.write(body)
+          tempfile.rewind
+
+          image.attachment.attach(io: tempfile, filename: filename)
+          image.external_url = external_url
+          image.external_id = external_id if external_id.present? && image.respond_to?(:external_id)
+          image.save!
+        ensure
+          tempfile.close
+          tempfile.unlink
+        end
+      end
+
       def image_already_saved?(image, external_url)
         image.persisted? && image.attachment.attached? && image.external_url.present? && external_url == image.external_url
       end

data/app/models/spree/gift_card_batch.rb

@@ -30,6 +30,10 @@ module Spree
 
     money_methods :amount
 
+    def amount=(amount)
+      self[:amount] = Spree::LocalizedNumber.parse(amount)
+    end
+
     self.whitelisted_ransackable_attributes = %w[prefix]
 
     def generate_gift_cards

data/app/models/spree/order.rb

@@ -275,9 +275,9 @@ module Spree
     # @return [Boolean]
     def order_refunded?
       return false if item_count.zero?
+      return false if refunds_total.zero?
 
-      (payment_state.in?(%w[void failed]) && refunds_total.positive?) ||
-        refunds_total == total_minus_store_credits - additional_tax_total.abs
+      payment_state.in?(%w[void failed]) || refunds_total == total_minus_store_credits - additional_tax_total.abs
     end
 
     def refunds_total

data/app/models/spree/refund.rb

@@ -34,6 +34,10 @@ module Spree
 
     delegate :order, :currency, to: :payment
 
+    def amount=(amount)
+      self[:amount] = Spree::LocalizedNumber.parse(amount)
+    end
+
     def money
       Spree::Money.new(amount, currency: currency)
     end

data/app/models/spree/store_credit.rb

@@ -52,6 +52,10 @@ module Spree
     extend Spree::DisplayMoney
     money_methods :amount, :amount_used, :amount_remaining, :amount_authorized
 
+    def amount=(amount)
+      self[:amount] = Spree::LocalizedNumber.parse(amount)
+    end
+
     self.whitelisted_ransackable_attributes = %w[user_id created_by_id amount currency type_id]
     self.whitelisted_ransackable_associations = %w[type user created_by]
 

data/app/models/spree/webhook_endpoint.rb

@@ -1,17 +1,23 @@
 # frozen_string_literal: true
 
+require 'ssrf_filter'
+require 'resolv'
+
 module Spree
   class WebhookEndpoint < Spree.base_class
     acts_as_paranoid
 
     include Spree::SingleStoreResource
 
+    encrypts :secret_key, deterministic: true if Rails.configuration.active_record.encryption.include?(:primary_key)
+
     belongs_to :store, class_name: 'Spree::Store'
     has_many :webhook_deliveries, class_name: 'Spree::WebhookDelivery', dependent: :destroy_async
 
     validates :store, :url, presence: true
     validates :url, format: { with: URI::DEFAULT_PARSER.make_regexp(%w[http https]), message: :invalid_url }
     validates :active, inclusion: { in: [true, false] }
+    validate :url_must_not_resolve_to_private_ip, if: -> { url.present? && url_changed? }
 
     before_create :generate_secret_key
 
@@ -49,5 +55,16 @@ module Spree
     def generate_secret_key
       self.secret_key ||= SecureRandom.hex(32)
     end
+
+    def url_must_not_resolve_to_private_ip
+      uri = URI.parse(url)
+      blacklist = SsrfFilter::IPV4_BLACKLIST + SsrfFilter::IPV6_BLACKLIST
+      addresses = Resolv.getaddresses(uri.host)
+      if addresses.any? { |addr| blacklist.any? { |range| range.include?(IPAddr.new(addr)) } }
+        errors.add(:url, :internal_address_not_allowed)
+      end
+    rescue URI::InvalidURIError, Resolv::ResolvError, IPAddr::InvalidAddressError, ArgumentError
+      # URI format validation handles invalid URLs; DNS failures are not SSRF
+    end
   end
 end

data/app/services/spree/data_feeds/google/required_attributes.rb

@@ -41,15 +41,10 @@ module Spree
         end
 
         def get_image_link(variant, product)
-          # try getting image from variant
-          img = variant.images.first&.plp_url
+          image = variant.thumbnail || product.thumbnail
+          return if image.nil?
 
-          # if no image specified for variant try getting product image
-          if img.nil?
-            img = product.images.first&.plp_url
-          end
-
-          img
+          Rails.application.routes.url_helpers.cdn_image_url(image.attachment.variant(:xlarge))
         end
 
         def format_price(variant)

data/app/services/spree/gift_cards/apply.rb

@@ -25,15 +25,16 @@ module Spree
           return failure(:gift_card_mismatched_customer) if gift_card.user != order.user
         end
 
-        amount = [gift_card.amount_remaining, order.total].min
         store = order.store
 
-        return failure(:gift_card_no_amount_remaining) unless amount.positive? || order.total.zero?
-
         payment_method = ensure_store_credit_payment_method!(store)
 
-        gift_card.lock!
         order.with_lock do
+          gift_card.lock!
+          amount = [gift_card.amount_remaining, order.total].min
+
+          return failure(:gift_card_no_amount_remaining) unless amount.positive? || order.total.zero?
+
           store_credit = gift_card.store_credits.create!(
             store: store,
             user: order.user,

data/config/locales/en.yml

@@ -361,6 +361,10 @@ en:
               cannot_destroy_if_attached_to_line_items: Cannot delete Variants that are added to placed Orders. In such cases, please discontinue them.
               must_supply_price_for_variant_or_master: Must supply price for variant or master price for product.
               no_master_variant_found_to_infer_price: No master variant found to infer price
+        spree/webhook_endpoint:
+          attributes:
+            url:
+              internal_address_not_allowed: must not point to an internal or private network address
         spree/wished_item:
           attributes:
             variant:

data/lib/spree/core/configuration.rb

@@ -47,6 +47,7 @@ module Spree
       preference :expedited_exchanges_days_window, :integer, default: 14 # the amount of days the customer has to return their item after the expedited exchange is shipped in order to avoid being charged
       preference :geocode_addresses, :boolean, default: true
       preference :images_save_from_url_job_attempts, :integer, default: 5
+      preference :max_image_download_size, :integer, default: 20_971_520 # 20 MB in bytes
 
       # Preprocessed product image variant sizes at 2x retina resolution.
       # These variants are generated on upload to reduce runtime processing.

data/lib/spree/core/version.rb

@@ -1,5 +1,5 @@
 module Spree
-  VERSION = '5.3.4'.freeze
+  VERSION = '5.3.5'.freeze
 
   def self.version
     VERSION

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: spree_core
 version: !ruby/object:Gem::Version
-  version: 5.3.4
+  version: 5.3.5
 platform: ruby
 authors:
 - Sean Schofield
@@ -573,6 +573,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: ssrf_filter
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
 description: Spree Models, Helpers, Services and core libraries
 email: hello@spreecommerce.org
 executables: []
@@ -1717,9 +1731,9 @@ licenses:
 - BSD-3-Clause
 metadata:
   bug_tracker_uri: https://github.com/spree/spree/issues
-  changelog_uri: https://github.com/spree/spree/releases/tag/v5.3.4
+  changelog_uri: https://github.com/spree/spree/releases/tag/v5.3.5
   documentation_uri: https://docs.spreecommerce.org/
-  source_code_uri: https://github.com/spree/spree/tree/v5.3.4
+  source_code_uri: https://github.com/spree/spree/tree/v5.3.5
 rdoc_options: []
 require_paths:
 - lib