gitea/nas
1
0
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

Detect and prevent image bombs, max. processable dimension 4096^2 (#7229)

Browse source
This commit is contained in:
Eugen Rochko 2018-04-23 09:16:38 +02:00 • committed by GitHub
parent 3bf6da1ffc
commit 7db7d68136
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 34 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

32
app/models/concerns/attachmentable.rb
View file

@ -1,10 +1,15 @@
# frozen_string_literal: true
require 'mime/types'
module Attachmentable
extend ActiveSupport::Concern
MAX_MATRIX_LIMIT = 16_777_216 # 4096x4096px or approx. 16MB
included do
before_post_process :set_file_extensions
before_post_process :check_image_dimensions
end
private
@ -12,10 +17,31 @@ module Attachmentable
def set_file_extensions
self.class.attachment_definitions.each_key do |attachment_name|
attachment = send(attachment_name)
next if attachment.blank?
extension = Paperclip::Interpolations.content_type_extension(attachment, :original)
basename = Paperclip::Interpolations.basename(attachment, :original)
attachment.instance_write :file_name, [basename, extension].delete_if(&:blank?).join('.')
attachment.instance_write :file_name, [Paperclip::Interpolations.basename(attachment, :original), appropriate_extension(attachment)].delete_if(&:blank?).join('.')
end
end
def check_image_dimensions
self.class.attachment_definitions.each_key do |attachment_name|
attachment = send(attachment_name)
next if attachment.blank? || !attachment.content_type.match?(/image.*/) || attachment.queued_for_write[:original].blank?
width, height = FastImage.size(attachment.queued_for_write[:original].path)
raise Mastodon::DimensionsValidationError, "#{width}x#{height} images are not supported" if width.present? && height.present? && (width * height >= MAX_MATRIX_LIMIT)
end
end
def appropriate_extension(attachment)
mime_type = MIME::Types[attachment.content_type]
extensions_for_mime_type = mime_type.empty? ? [] : mime_type.first.extensions
original_extension = Paperclip::Interpolations.extension(attachment, :original)
extensions_for_mime_type.include?(original_extension) ? original_extension : extensions_for_mime_type.first
end
end