Skip to content

Commit

Permalink
Merge pull request #29 from Conorbro/upgrade-cocaine
Browse files Browse the repository at this point in the history
Upgrade cocaine to terrapin
  • Loading branch information
musaffa committed Aug 2, 2018
2 parents 9657fdc + 317b216 commit 00cb914
Show file tree
Hide file tree
Showing 3 changed files with 14 additions and 14 deletions.
18 changes: 9 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ class Profile

attr_accessor :avatar
validates :avatar, file_size: { less_than_or_equal_to: 100.kilobytes },
file_content_type: { allow: ['image/jpeg', 'image/png'] }
file_content_type: { allow: ['image/jpeg', 'image/png'] }
end
```
ActiveRecord example:
Expand Down Expand Up @@ -67,23 +67,23 @@ validates :avatar, file_size: { less_than: 2.gigabytes }
```
* `less_than_or_equal_to`: Less than or equal to a number in bytes or a proc that returns a number
```ruby
validates :avatar, file_size: { less_than_or_equal_to: 50.bytes }
validates :avatar, file_size: { less_than_or_equal_to: 50.bytes }
```
* `greater_than`: greater than a number in bytes or a proc that returns a number
```ruby
validates :avatar, file_size: { greater_than: 1.byte }
validates :avatar, file_size: { greater_than: 1.byte }
```
* `greater_than_or_equal_to`: Greater than or equal to a number in bytes or a proc that returns a number
```ruby
validates :avatar, file_size: { greater_than_or_equal_to: 50.bytes }
validates :avatar, file_size: { greater_than_or_equal_to: 50.bytes }
```
* `message`: Error message to display. With all the options above except `:in`, you will get `count` as a replacement.
With `:in` you will get `min` and `max` as replacements.
* `message`: Error message to display. With all the options above except `:in`, you will get `count` as a replacement.
With `:in` you will get `min` and `max` as replacements.
`count`, `min` and `max` each will have its value and unit together.
You can write error messages without using any replacement.
```ruby
validates :avatar, file_size: { less_than: 100.kilobytes,
message: 'avatar should be less than %{count}' }
message: 'avatar should be less than %{count}' }
```
```ruby
validates :document, file_size: { in: 1.kilobyte..1.megabyte,
Expand Down Expand Up @@ -172,15 +172,15 @@ validates :avatar, file_content_type: { allow: /^image\/.*/, exclude: ['image/pn
This gem can use Unix file command to get the content type based on the content of the file rather
than the extension. This prevents fake content types inserted in the request header.

It also prevents file media type spoofing. For example, user may upload a .html document as
It also prevents file media type spoofing. For example, user may upload a .html document as
a part of the EXIF header of a valid JPEG file. Content type validator will identify its content type
as `image/jpeg` and, without spoof detection, it may pass the validation and be saved as .html document
thus exposing your application to a security vulnerability. Media type spoof detector wont let that happen.
It will not allow a file having `image/jpeg` content type to be saved as `text/plain`. It checks only media
type mismatch, for example `text` of `text/plain` and `image` of `image/jpeg`. So it will not prevent
`image/jpeg` from saving as `image/png` as both have the same `image` media type.

**note**: This security feature is disabled by default. To enable it, first add `cocaine` gem in
**note**: This security feature is disabled by default. To enable it, first add `terrapin` gem in
your Gemfile and then add `mode: :strict` option in [content type validations](#file-content-type-validator).
`:strict` mode may not work in direct file uploading systems as the file is not passed along with the form.

Expand Down
2 changes: 1 addition & 1 deletion file_validators.gemspec
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ Gem::Specification.new do |s|
s.add_dependency 'activemodel', '>= 3.2'
s.add_dependency 'mime-types', '>= 1.0'

s.add_development_dependency 'cocaine', '~> 0.5.4'
s.add_development_dependency 'terrapin', '~> 0.6'
s.add_development_dependency 'rake'
s.add_development_dependency 'rspec', '~> 3.5.0'
s.add_development_dependency 'coveralls'
Expand Down
8 changes: 4 additions & 4 deletions lib/file_validators/utils/content_type_detector.rb
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
require 'logger'

begin
require 'cocaine'
require 'terrapin'
rescue LoadError
puts "file_validators requires 'cocaine' gem as you are using file content type validations in strict mode"
puts "file_validators requires 'terrapin' gem as you are using file content type validations in strict mode"
end

module FileValidators
Expand Down Expand Up @@ -51,8 +51,8 @@ def content_type_from_content

def type_from_file_command
begin
Cocaine::CommandLine.new('file', '-b --mime-type :file').run(file: @file_path).strip
rescue Cocaine::CommandLineError => e
Terrapin::CommandLine.new('file', '-b --mime-type :file').run(file: @file_path).strip
rescue Terrapin::CommandLineError => e
logger.info(e.message)
DEFAULT_CONTENT_TYPE
end
Expand Down

0 comments on commit 00cb914

Please sign in to comment.