commit
ff7aae3037
17 changed files with 214 additions and 33 deletions
@ -0,0 +1,27 @@ |
||||
<policymap> |
||||
<!-- Set some basic system resource limits --> |
||||
<policy domain="resource" name="time" value="60" /> |
||||
|
||||
<policy domain="module" rights="none" pattern="URL" /> |
||||
|
||||
<policy domain="filter" rights="none" pattern="*" /> |
||||
|
||||
<!-- |
||||
Ideally, we would restrict ImageMagick to only accessing its own |
||||
disk-backed pixel cache as well as Mastodon-created Tempfiles. |
||||
|
||||
However, those paths depend on the operating system and environment |
||||
variables, so they can only be known at runtime. |
||||
|
||||
Furthermore, those paths are not necessarily shared across Mastodon |
||||
processes, so even creating a policy.xml at runtime is impractical. |
||||
|
||||
For the time being, only disable indirect reads. |
||||
--> |
||||
<policy domain="path" rights="none" pattern="@*" /> |
||||
|
||||
<!-- Disallow any coder by default, and only enable ones required by Mastodon --> |
||||
<policy domain="coder" rights="none" pattern="*" /> |
||||
<policy domain="coder" rights="read | write" pattern="{PNG,JPEG,GIF,HEIC,WEBP}" /> |
||||
<policy domain="coder" rights="write" pattern="{HISTOGRAM,RGB,INFO}" /> |
||||
</policymap> |
@ -0,0 +1,22 @@ |
||||
# frozen_string_literal: true |
||||
|
||||
module Paperclip |
||||
module MediaTypeSpoofDetectorExtensions |
||||
def calculated_content_type |
||||
return @calculated_content_type if defined?(@calculated_content_type) |
||||
|
||||
@calculated_content_type = type_from_file_command.chomp |
||||
|
||||
# The `file` command fails to recognize some MP3 files as such |
||||
@calculated_content_type = type_from_marcel if @calculated_content_type == 'application/octet-stream' && type_from_marcel == 'audio/mpeg' |
||||
@calculated_content_type |
||||
end |
||||
|
||||
def type_from_marcel |
||||
@type_from_marcel ||= Marcel::MimeType.for Pathname.new(@file.path), |
||||
name: @file.path |
||||
end |
||||
end |
||||
end |
||||
|
||||
Paperclip::MediaTypeSpoofDetector.prepend(Paperclip::MediaTypeSpoofDetectorExtensions) |
Binary file not shown.
Loading…
Reference in new issue