Repository is archived
No commit activity in last 3 years
No release in over 3 years
There's a lot of open issues
Protect your carrierwave from image bombs
2005
2006
2007
2008
2009
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
 Dependencies

Development

~> 1.10
>= 0
>= 0
~> 10.0

Runtime

 Project Readme

CarrierWave::BombShelter

Build Status

BombShelter is a module which protects your uploaders from image bombs like https://www.bamsoftware.com/hacks/deflate.html and http://www.openwall.com/lists/oss-security/2016/05/03/18. It checks type and pixel dimensions of uploaded image before ImageMagick touches it.

Sponsored by Evil Martians

How it works

BombShelter uses fastimage gem, which reads just a header of an image to get info about it. BombShelter compares type and pixel dimensions of the uploaded image with allowed ones and raises integrity error if image is too big or have unsupported type. Works perfectly with ActiveRecord validators.

Installation

Add this line to your application's Gemfile:

gem 'carrierwave-bombshelter'

And then execute:

$ bundle

Or install it yourself as:

$ gem install carrierwave-bombshelter

Usage

Just include CarrierWave::BombShelter to your uploader and you're done:

class YourUploader < CarrierWave::Uploader::Base
  include CarrierWave::BombShelter
end

You can change allowed image types by defining image_type_whitelist method (default are [:jpeg, :png, :gif]):

class YourUploader < CarrierWave::Uploader::Base
  include CarrierWave::BombShelter

  def image_type_whitelist
    [:bmp, :jpeg, :png, :gif]
  end
end

Note: Whitelisted file types should be supported by fastimage.

Warning: Allowing svg and mvg is totally insecure.

You can change maximum allowed dimensions by defining max_pixel_dimensions method (default is 4096x4096):

class YourUploader < CarrierWave::Uploader::Base
  include CarrierWave::BombShelter

  def max_pixel_dimensions
    [1024, 1024]
  end
end

Contributing

Bug reports and pull requests are welcome on GitHub at https://github.com/DarthSim/carrierwave-bombshelter. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.

Locales

Please don't create PRs that add locales. I can't maintain locales of languages that I don't know, and I can't poke you every time when I need to add a new string.

License

The gem is available as open source under the terms of the MIT License.