Skip to content

Commit

Permalink
Fix directly uploading using a MIME type synonym
Browse files Browse the repository at this point in the history
When Content-Type is "application/x-gzip", request.content_type resolves to "application/gzip", because application/x-gzip is a synonym of application/gzip by default. This causes the acceptable_content? check in ActiveStorage::DiskController to fail, because the direct upload token contains application/x-gzip, which is not equal to application/gzip.

Fix by comparing the token content type with the request content type *and its synonyms*.
  • Loading branch information
georgeclaghorn committed Oct 9, 2018
1 parent 18161d0 commit 5fb4703
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 1 deletion.
Expand Up @@ -57,6 +57,6 @@ def decode_verified_token
end

def acceptable_content?(token)
token[:content_type] == request.content_type && token[:content_length] == request.content_length
token[:content_type] == request.content_mime_type && token[:content_length] == request.content_length
end
end
10 changes: 10 additions & 0 deletions activestorage/test/controllers/disk_controller_test.rb
Expand Up @@ -50,6 +50,16 @@ class ActiveStorage::DiskControllerTest < ActionDispatch::IntegrationTest
assert_not blob.service.exist?(blob.key)
end

test "directly uploading blob with different but equivalent content type" do
data = "Something else entirely!"
blob = create_blob_before_direct_upload(
byte_size: data.size, checksum: Digest::MD5.base64digest(data), content_type: "application/x-gzip")

put blob.service_url_for_direct_upload, params: data, headers: { "Content-Type" => "application/x-gzip" }
assert_response :no_content
assert_equal data, blob.download
end

test "directly uploading blob with mismatched content length" do
data = "Something else entirely!"
blob = create_blob_before_direct_upload byte_size: data.size - 1, checksum: Digest::MD5.base64digest(data)
Expand Down

0 comments on commit 5fb4703

Please sign in to comment.