Images uploaded with wrong extension trigger ActiveStorage::IntegrityError

Ouverte
  • Quelque chose ne va pas ?
#597 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
55/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
rails, ruby
Domaine
backend, cloud

Piste de recherche

Commencez par ActiveStorage::Service::CloudinaryService#ext_for_file et comparez sa sélection d’extension avec le monkey patch signalé. Reproduisez un Rails Direct Upload en utilisant un JPEG dont le nom se termine par .png, puis suivez l’URL Cloudinary, le checksum du blob et le chemin vers ActiveStorage::IntegrityError. Le travail est terminé lorsque l’image téléversée à l’origine peut être téléchargée et analysée sans différence de checksum ni transformation de format involontaire.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Describe the bug in a sentence or two.

When using Rails Direct Uploads, we can't analyze a file before it reaches Cloudinary. If a user uploads an image with the wrong extension (say a JPEG named image.png), then Cloudinary will return an URL ending with .png, which requests a transformation of the image to PNG, resulting in a checksum that does not match the one stored in the associated ActiveStorage::Blob, which triggers ActiveStorage::IntegrityError.

Issue Type (Can be multiple)

  • Build - Cannot install or import the SDK
  • Performance - Performance issues
  • Behaviour - Functions are not working as expected (such as generate URL)
  • Documentation - Inconsistency between the docs and behaviour
  • Other (Specify)

Operating System

  • Linux
  • Windows
  • macOS
  • All

Environment and Libraries (fill in the version numbers)

  • Cloudinary Ruby SDK version - 2.4.4
  • Ruby Version - 3.4.10
  • Rails Version - 8.1.3

Current workaround

In our codebase, we monkey patched ActiveStorage::Service::CloudinaryService#ext_for_file like this as a workaround:

# The original ext_for_file method takes the extension from the filename and only falls back to the
# content type when the filename carries none. What this patch does is let Rails determine the real
# content type of the file, and if it matches the filename extension return this extension, otherwise
# return an extension that really matches the content_type.
#
# This logic does not apply to "raw" resource types, as these are never transcoded by cloudinary.
def ext_for_file(key, filename = nil, content_type = nil)
  attributes = key.is_a?(ActiveStorage::BlobKey) ? key.attributes : {}
  content_type = content_type.presence || attributes[:content_type]
  return super if content_type_to_resource_type(content_type).eql?('raw')

  # { 'identified' => true } in metadata means Rails has analyzed the file and determined its true
  # content type. It does that by downloading the file from the provided url, at the moment of
  # attaching the blob to the record. Before that, the content type is what the client said it was,
  # which can be wrong. Returning nil before identification forces no extension and therefore no
  # conversion on the Cloudinary side. That allows Rails to download and analyze the original file
  # intead of a converted one.
  return nil unless attributes.dig(:metadata, 'identified')

  filename = ActiveStorage::Filename.wrap(filename.presence || attributes[:filename])
  filename_extension = filename.extension_without_delimiter
  content_type_extensions = Marcel::TYPE_EXTS[content_type]
  return filename_extension if content_type_extensions.blank?

  content_type_extensions.find { it == filename_extension } || content_type_extensions.first
end
Langage dominant
Ruby
Étoiles
420
Forks
282
Aucune PR mergée en 30 j

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de cloudinary/cloudinary_gem

Toutes les issues de cloudinary/cloudinary_gem

Issues similaires

Plus d'issues Ruby

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.