uploaded_file.rb 2.31 KB
Newer Older
1 2
# frozen_string_literal: true

3
require "tempfile"
4
require "tmpdir"
5 6 7
require "fileutils"

class UploadedFile
8 9
  InvalidPathError = Class.new(StandardError)

10 11 12 13 14 15 16 17 18
  # The filename, *not* including the path, of the "uploaded" file
  attr_reader :original_filename

  # The tempfile
  attr_reader :tempfile

  # The content type of the "uploaded" file
  attr_accessor :content_type

19 20 21 22 23
  attr_reader :remote_id
  attr_reader :sha256

  def initialize(path, filename: nil, content_type: "application/octet-stream", sha256: nil, remote_id: nil)
    raise InvalidPathError, "#{path} file does not exist" unless ::File.exist?(path)
24 25

    @content_type = content_type
26
    @original_filename = sanitize_filename(filename || path)
27 28 29
    @content_type = content_type
    @sha256 = sha256
    @remote_id = remote_id
30 31 32
    @tempfile = File.new(path, 'rb')
  end

33
  def self.from_params(params, field, upload_paths)
34 35 36 37 38 39 40 41
    unless params["#{field}.path"]
      raise InvalidPathError, "file is invalid" if params["#{field}.remote_id"]

      return
    end

    file_path = File.realpath(params["#{field}.path"])

42
    paths = Array(upload_paths) << Dir.tmpdir
43
    unless self.allowed_path?(file_path, paths.compact)
44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59
      raise InvalidPathError, "insecure path used '#{file_path}'"
    end

    UploadedFile.new(file_path,
      filename: params["#{field}.name"],
      content_type: params["#{field}.type"] || 'application/octet-stream',
      sha256: params["#{field}.sha256"],
      remote_id: params["#{field}.remote_id"])
  end

  def self.allowed_path?(file_path, paths)
    paths.any? do |path|
      File.exist?(path) && file_path.start_with?(File.realpath(path))
    end
  end

60 61 62 63 64 65 66 67 68 69
  # copy-pasted from CarrierWave::SanitizedFile
  def sanitize_filename(name)
    name = name.tr("\\", "/") # work-around for IE
    name = ::File.basename(name)
    name = name.gsub(CarrierWave::SanitizedFile.sanitize_regexp, "_")
    name = "_#{name}" if name =~ /\A\.+\z/
    name = "unnamed" if name.empty?
    name.mb_chars.to_s
  end

70 71 72 73 74 75 76
  def path
    @tempfile.path
  end

  alias_method :local_path, :path

  def method_missing(method_name, *args, &block) #:nodoc:
77
    @tempfile.__send__(method_name, *args, &block) # rubocop:disable GitlabSecurity/PublicSend
78 79 80 81 82 83
  end

  def respond_to?(method_name, include_private = false) #:nodoc:
    @tempfile.respond_to?(method_name, include_private) || super
  end
end