Images uploaded with wrong extension trigger ActiveStorage::IntegrityError

Aberta
  • Algo errado?
#597 1 comentário 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
4/5
Tempo estimado
3-5 dias
Facilidade para iniciantes
55/100
Tipo de issue
Bug
Clareza
Razoavelmente clara
Status de atividade
Ativa
Stack de tecnologia
rails, ruby
Domínio
backend, cloud

Direção de pesquisa

Comece por ActiveStorage::Service::CloudinaryService#ext_for_file e compare sua seleção de extensão com o monkey patch relatado. Reproduza um Rails Direct Upload usando um JPEG cujo nome tenha a extensão .png e, em seguida, acompanhe a URL do Cloudinary, o checksum do blob e o caminho de ActiveStorage::IntegrityError. Está concluído quando a imagem originalmente enviada puder ser baixada e analisada sem incompatibilidade de checksum ou transformação de formato não intencional.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Describe the bug in a sentence or two.

When using Rails Direct Uploads, we can't analyze a file before it reaches Cloudinary. If a user uploads an image with the wrong extension (say a JPEG named image.png), then Cloudinary will return an URL ending with .png, which requests a transformation of the image to PNG, resulting in a checksum that does not match the one stored in the associated ActiveStorage::Blob, which triggers ActiveStorage::IntegrityError.

Issue Type (Can be multiple)

  • Build - Cannot install or import the SDK
  • Performance - Performance issues
  • Behaviour - Functions are not working as expected (such as generate URL)
  • Documentation - Inconsistency between the docs and behaviour
  • Other (Specify)

Operating System

  • Linux
  • Windows
  • macOS
  • All

Environment and Libraries (fill in the version numbers)

  • Cloudinary Ruby SDK version - 2.4.4
  • Ruby Version - 3.4.10
  • Rails Version - 8.1.3

Current workaround

In our codebase, we monkey patched ActiveStorage::Service::CloudinaryService#ext_for_file like this as a workaround:

# The original ext_for_file method takes the extension from the filename and only falls back to the
# content type when the filename carries none. What this patch does is let Rails determine the real
# content type of the file, and if it matches the filename extension return this extension, otherwise
# return an extension that really matches the content_type.
#
# This logic does not apply to "raw" resource types, as these are never transcoded by cloudinary.
def ext_for_file(key, filename = nil, content_type = nil)
  attributes = key.is_a?(ActiveStorage::BlobKey) ? key.attributes : {}
  content_type = content_type.presence || attributes[:content_type]
  return super if content_type_to_resource_type(content_type).eql?('raw')

  # { 'identified' => true } in metadata means Rails has analyzed the file and determined its true
  # content type. It does that by downloading the file from the provided url, at the moment of
  # attaching the blob to the record. Before that, the content type is what the client said it was,
  # which can be wrong. Returning nil before identification forces no extension and therefore no
  # conversion on the Cloudinary side. That allows Rails to download and analyze the original file
  # intead of a converted one.
  return nil unless attributes.dig(:metadata, 'identified')

  filename = ActiveStorage::Filename.wrap(filename.presence || attributes[:filename])
  filename_extension = filename.extension_without_delimiter
  content_type_extensions = Marcel::TYPE_EXTS[content_type]
  return filename_extension if content_type_extensions.blank?

  content_type_extensions.find { it == filename_extension } || content_type_extensions.first
end
Linguagem predominante
Ruby
Estrelas
420
Forks
282
Nenhum PR com merge em 30d

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de cloudinary/cloudinary_gem

Todas as issues de cloudinary/cloudinary_gem

Issues semelhantes

Mais issues de Ruby

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.