Skip to content

Commit

Permalink
Revert "Don't allow calling Kernel methods via loader/saver options"
Browse files Browse the repository at this point in the history
It doesn't fully resolve the security vulnerability, and there is no
point in only partially resolving it.

See #100

This reverts commit aed5b80.
  • Loading branch information
janko committed Jul 24, 2024
1 parent 84e5b61 commit 4cc0440
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 25 deletions.
2 changes: 0 additions & 2 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,5 @@
## HEAD

* [minimagick] Don't allow calling Kernel options via `loader`/`saver` options (@janko)

* Add `#cover` that allows one to resize an image to cover a given width and height without cropping
the excess. (@brendon)

Expand Down
6 changes: 3 additions & 3 deletions lib/image_processing/mini_magick.rb
Original file line number Diff line number Diff line change
Expand Up @@ -223,9 +223,9 @@ def disallow_split_layers!(destination_path)
def apply_options(magick, define: {}, **options)
options.each do |option, value|
case value
when true, nil then magick.public_send(option)
when false then magick.public_send(option).+
else magick.public_send(option, *value)
when true, nil then magick.send(option)
when false then magick.send(option).+
else magick.send(option, *value)
end
end

Expand Down
20 changes: 0 additions & 20 deletions test/mini_magick_test.rb
Original file line number Diff line number Diff line change
Expand Up @@ -174,26 +174,6 @@
assert_dimensions [600, 800], result
end

it "doesn't allow calling Kernel methods via loader/saver options" do
error = assert_raises(MiniMagick::Error) do
ImageProcessing::MiniMagick
.source(@portrait)
.loader(system: "touch test/malicious.txt")
.call
end

assert_match "unrecognized option `-system'", error.message

error = assert_raises(MiniMagick::Error) do
ImageProcessing::MiniMagick
.source(@portrait)
.saver(system: "touch test/malicious.txt")
.call
end

assert_match "unrecognized option `-system'", error.message
end

describe ".valid_image?" do
it "returns true for correct images" do
assert ImageProcessing::MiniMagick.valid_image?(@portrait)
Expand Down

0 comments on commit 4cc0440

Please sign in to comment.