Images uploaded with wrong extension trigger ActiveStorage::IntegrityError

Abierto
  • ¿Algo no está bien?
#597 1 comentario 0 reacciones 0 asignados Ver en GitHub

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
55/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
rails, ruby
Área
backend, cloud

Línea de trabajo

Comienza con ActiveStorage::Service::CloudinaryService#ext_for_file y compara su selección de extensión con el monkey patch reportado. Reproduce un Rails Direct Upload usando un JPEG cuyo nombre termina en .png y, a continuación, sigue la URL de Cloudinary, el checksum del blob y la ruta de ActiveStorage::IntegrityError. Se considera terminado cuando la imagen subida originalmente se puede descargar y analizar sin una discrepancia de checksum ni una transformación de formato no intencionada.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Describe the bug in a sentence or two.

When using Rails Direct Uploads, we can't analyze a file before it reaches Cloudinary. If a user uploads an image with the wrong extension (say a JPEG named image.png), then Cloudinary will return an URL ending with .png, which requests a transformation of the image to PNG, resulting in a checksum that does not match the one stored in the associated ActiveStorage::Blob, which triggers ActiveStorage::IntegrityError.

Issue Type (Can be multiple)

  • Build - Cannot install or import the SDK
  • Performance - Performance issues
  • Behaviour - Functions are not working as expected (such as generate URL)
  • Documentation - Inconsistency between the docs and behaviour
  • Other (Specify)

Operating System

  • Linux
  • Windows
  • macOS
  • All

Environment and Libraries (fill in the version numbers)

  • Cloudinary Ruby SDK version - 2.4.4
  • Ruby Version - 3.4.10
  • Rails Version - 8.1.3

Current workaround

In our codebase, we monkey patched ActiveStorage::Service::CloudinaryService#ext_for_file like this as a workaround:

# The original ext_for_file method takes the extension from the filename and only falls back to the
# content type when the filename carries none. What this patch does is let Rails determine the real
# content type of the file, and if it matches the filename extension return this extension, otherwise
# return an extension that really matches the content_type.
#
# This logic does not apply to "raw" resource types, as these are never transcoded by cloudinary.
def ext_for_file(key, filename = nil, content_type = nil)
  attributes = key.is_a?(ActiveStorage::BlobKey) ? key.attributes : {}
  content_type = content_type.presence || attributes[:content_type]
  return super if content_type_to_resource_type(content_type).eql?('raw')

  # { 'identified' => true } in metadata means Rails has analyzed the file and determined its true
  # content type. It does that by downloading the file from the provided url, at the moment of
  # attaching the blob to the record. Before that, the content type is what the client said it was,
  # which can be wrong. Returning nil before identification forces no extension and therefore no
  # conversion on the Cloudinary side. That allows Rails to download and analyze the original file
  # intead of a converted one.
  return nil unless attributes.dig(:metadata, 'identified')

  filename = ActiveStorage::Filename.wrap(filename.presence || attributes[:filename])
  filename_extension = filename.extension_without_delimiter
  content_type_extensions = Marcel::TYPE_EXTS[content_type]
  return filename_extension if content_type_extensions.blank?

  content_type_extensions.find { it == filename_extension } || content_type_extensions.first
end
Lenguaje dominante
Ruby
Estrellas
420
Forks
282
Sin PR fusionados en 30 d

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de cloudinary/cloudinary_gem

Todos los issues de cloudinary/cloudinary_gem

Issues similares

Más issues de Ruby

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.