commit
ff7aae3037
17 changed files with 214 additions and 33 deletions
@ -0,0 +1,27 @@ |
|||||||
|
<policymap> |
||||||
|
<!-- Set some basic system resource limits --> |
||||||
|
<policy domain="resource" name="time" value="60" /> |
||||||
|
|
||||||
|
<policy domain="module" rights="none" pattern="URL" /> |
||||||
|
|
||||||
|
<policy domain="filter" rights="none" pattern="*" /> |
||||||
|
|
||||||
|
<!-- |
||||||
|
Ideally, we would restrict ImageMagick to only accessing its own |
||||||
|
disk-backed pixel cache as well as Mastodon-created Tempfiles. |
||||||
|
|
||||||
|
However, those paths depend on the operating system and environment |
||||||
|
variables, so they can only be known at runtime. |
||||||
|
|
||||||
|
Furthermore, those paths are not necessarily shared across Mastodon |
||||||
|
processes, so even creating a policy.xml at runtime is impractical. |
||||||
|
|
||||||
|
For the time being, only disable indirect reads. |
||||||
|
--> |
||||||
|
<policy domain="path" rights="none" pattern="@*" /> |
||||||
|
|
||||||
|
<!-- Disallow any coder by default, and only enable ones required by Mastodon --> |
||||||
|
<policy domain="coder" rights="none" pattern="*" /> |
||||||
|
<policy domain="coder" rights="read | write" pattern="{PNG,JPEG,GIF,HEIC,WEBP}" /> |
||||||
|
<policy domain="coder" rights="write" pattern="{HISTOGRAM,RGB,INFO}" /> |
||||||
|
</policymap> |
@ -0,0 +1,22 @@ |
|||||||
|
# frozen_string_literal: true |
||||||
|
|
||||||
|
module Paperclip |
||||||
|
module MediaTypeSpoofDetectorExtensions |
||||||
|
def calculated_content_type |
||||||
|
return @calculated_content_type if defined?(@calculated_content_type) |
||||||
|
|
||||||
|
@calculated_content_type = type_from_file_command.chomp |
||||||
|
|
||||||
|
# The `file` command fails to recognize some MP3 files as such |
||||||
|
@calculated_content_type = type_from_marcel if @calculated_content_type == 'application/octet-stream' && type_from_marcel == 'audio/mpeg' |
||||||
|
@calculated_content_type |
||||||
|
end |
||||||
|
|
||||||
|
def type_from_marcel |
||||||
|
@type_from_marcel ||= Marcel::MimeType.for Pathname.new(@file.path), |
||||||
|
name: @file.path |
||||||
|
end |
||||||
|
end |
||||||
|
end |
||||||
|
|
||||||
|
Paperclip::MediaTypeSpoofDetector.prepend(Paperclip::MediaTypeSpoofDetectorExtensions) |
Binary file not shown.
Loading…
Reference in new issue