Skip to content

275 spoofingdetection issue #278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Nov 8, 2024
Merged

275 spoofingdetection issue #278

merged 2 commits into from
Nov 8, 2024

Conversation

Mth0158
Copy link
Collaborator

@Mth0158 Mth0158 commented Nov 8, 2024 •
edited
Loading

This was a pretty heavy PR to make 😅. But damn it was worth it!

@Mth0158 Mth0158 linked an issue Nov 8, 2024 that may be closed by this pull request
[SpoofingDetection] Issue #275
Closed
Mth0158
Mth0158 commented Nov 8, 2024
View reviewed changes
test/matchers/content_type_validator_matcher_test.rb
@@ -213,7 +213,7 @@
describe '#allowing + #rejecting' do
let(:model_attribute) { :allowing_one }
let(:allowed_type) { 'image/png' }
let(:not_allowed_type) { 'video/mkv' }
Copy link
Collaborator Author

@Mth0158 Mth0158 Nov 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

video/mkv is not a valid content_type, video/x-matroska is, with .mkv extension

Mth0158
Mth0158 commented Nov 8, 2024
View reviewed changes
test/matchers/content_type_validator_matcher_test.rb
@@ -229,8 +229,8 @@

describe '#allowing + #rejecting + #with_message' do
let(:model_attribute) { :allowing_one_with_message }
let(:allowed_type) { 'file/pdf' }
Copy link
Collaborator Author

@Mth0158 Mth0158 Nov 8, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

file/pdf is not a valid content_type, application/pdf is

Mth0158
Mth0158 commented Nov 8, 2024
View reviewed changes
test/support/mime_types.rb
@@ -27,7 +27,7 @@ def most_common_mime_types
# Audio
{ mime_type: "audio/mpeg", extension: "mp3" },
{ mime_type: "audio/mp4", extension: "m4a" },
{ mime_type: "audio/wav", extension: "wav" },
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

audio/wav is not a valid content_type, audio/x-wav is

@Mth0158
Copy link
Collaborator Author

Mth0158 commented Nov 8, 2024

FYI @MaksJS, should be merged and release soon

@igorkasyanchuk igorkasyanchuk merged commit fa64570 into master Nov 8, 2024
40 checks passed
@igorkasyanchuk igorkasyanchuk deleted the 275-spoofingdetection-issue branch November 8, 2024 11:47
jrmhaig added a commit to ministryofjustice/Claim-for-Crown-Court-Defence that referenced this pull request Nov 11, 2024
@jrmhaig
Fix content type for test files
897dd43 
Version 1.3.1 of active_storage_validations makes the validation of document
type stricter to improve spoofing detection. One impact of this is that a docx
file is rejected when uploaded with the document type application/msword. The
correct type is application/vnd.openxmlformats-officedocument.wordprocessingml.document

Ref: igorkasyanchuk/active_storage_validations#278
@marckohlbrugge
Copy link

My validations stopped working properly when upgrading from 1.3.0 to 1.3.1. It might be caused by this PR as it seems the only major change.

I'm still investigating what exactly is going wrong, but accepted content types are reported as being invalid. I think active_storage_validations is somehow thinking the content_typeis nil, when it is in fact image/jpeg

wip(dev)> attachment.errors.full_messages
=> ["File has an invalid content type"]
wip(dev)> attachment.file.content_type
=> "image/jpeg"
wip(dev)> attachment.valid?
=> false
wip(dev)> attachment.errors
=> #<ActiveModel::Errors [#<ActiveModel::Error attribute=file, type=content_type_invalid, options={:validator_type=>:content_type, :filename=>"file_173.jpg", :content_type=>nil, :authorized_types=>"PNG, JPG, JPEG, GIF, AVIF, WEBP, MP4, MP4, QUICKTIME"}>]>

Notice the last line has :content_type=>nil, which is incorrect.

chaadow
chaadow reviewed Nov 11, 2024
View reviewed changes
lib/active_storage_validations/processable_image_validator.rb
require_relative 'concerns/symbolizable.rb'

module ActiveStorageValidations
class ProcessableImageValidator < ActiveModel::EachValidator # :nodoc
include ActiveStorageable
include Attachable
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

I have a concern in my application located in app/models/concerns/attachable, and since Zeitwerk has a special case for the concerns/*.rb directory when autoloading/eager loading,

==> it picks up this gem's before mine

lib/active_storage_validations/concerns/attachable.rb ( probably because active_storage_validations comes before app alphabetically )

Do you think it's possible to rename the directory concerns to something else please? @igorkasyanchuk

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As a workaround, I need to do this for now include ::Attachable in my models :/

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @chaadow,
I did not think Zeitwerk would pick up the gem concerns... That's something I was unaware of, I am going to fix this issue. You can still downgrade to v1.3.0 while waiting the fix. :)

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Issue #281 opened to solve this

This was referenced Nov 11, 2024
Closed
Closed
@Mth0158
Copy link
Collaborator Author

Mth0158 commented Nov 11, 2024

My validations stopped working properly when upgrading from 1.3.0 to 1.3.1. It might be caused by this PR as it seems the only major change.

I'm still investigating what exactly is going wrong, but accepted content types are reported as being invalid. I think active_storage_validations is somehow thinking the content_typeis nil, when it is in fact image/jpeg

wip(dev)> attachment.errors.full_messages
=> ["File has an invalid content type"]
wip(dev)> attachment.file.content_type
=> "image/jpeg"
wip(dev)> attachment.valid?
=> false
wip(dev)> attachment.errors
=> #<ActiveModel::Errors [#<ActiveModel::Error attribute=file, type=content_type_invalid, options={:validator_type=>:content_type, :filename=>"file_173.jpg", :content_type=>nil, :authorized_types=>"PNG, JPG, JPEG, GIF, AVIF, WEBP, MP4, MP4, QUICKTIME"}>]>

Notice the last line has :content_type=>nil, which is incorrect.

@marckohlbrugge issue #282 opened to discuss your issue

jrmhaig added a commit to ministryofjustice/Claim-for-Crown-Court-Defence that referenced this pull request Nov 12, 2024
@jrmhaig
Fix content type for test files
42127d2 
Version 1.3.1 of active_storage_validations makes the validation of document
type stricter to improve spoofing detection. One impact of this is that a docx
file is rejected when uploaded with the document type application/msword. The
correct type is application/vnd.openxmlformats-officedocument.wordprocessingml.document

Ref: igorkasyanchuk/active_storage_validations#278
jrmhaig added a commit to ministryofjustice/Claim-for-Crown-Court-Defence that referenced this pull request Nov 12, 2024
@jrmhaig
Fix content type for test files
2a12740 
Version 1.3.1 of active_storage_validations makes the validation of document
type stricter to improve spoofing detection. One impact of this is that a docx
file is rejected when uploaded with the document type application/msword. The
correct type is application/vnd.openxmlformats-officedocument.wordprocessingml.document

Ref: igorkasyanchuk/active_storage_validations#278
@jessie19 jessie19 mentioned this pull request Nov 12, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@chaadow chaadow chaadow left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[SpoofingDetection] Issue
4 participants
@Mth0158 @marckohlbrugge @chaadow @igorkasyanchuk