Commit cddd270

author

Andrey Glushkov

committed

Allow to use vips_block_untrusted_set and vips_operation_block_set methods

1 parent dde924b commit cddd270Copy full SHA for cddd270

File tree

+47

-4

lines changed

+47

-4

lines changed

Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -8,6 +8,11 @@`
`8`	`8`	`require "set"`
`9`	`9`
`10`	`10`	`module Vips`
	`11`	`+ if at_least_libvips?(8, 13)`
	`12`	`+ attach_function :vips_block_untrusted_set, [:bool], :void`
	`13`	`+ attach_function :vips_operation_block_set, %i[string bool], :void`
	`14`	`+ end`
	`15`	`+`
`11`	`16`	`private`
`12`	`17`
`13`	`18`	`attach_function :vips_operation_new, [:string], :pointer`

Lines changed: 34 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,34 @@`
	`1`	`+require "spec_helper"`
	`2`	`+`
	`3`	`+RSpec.describe Vips, version: [8, 13] do`
	`4`	`+ let(:svg_image) { simg("lion.svg") }`
	`5`	`+ let(:jpg_image) { simg("wagon.jpg") }`
	`6`	`+`
	`7`	`+ if has_svg?`
	`8`	`+ it "can block untrusted operations" do`
	`9`	`+ untrusted_image = svg_image # svgload operation is known as untrusted`
	`10`	`+`
	`11`	`+ # Block`
	`12`	`+ Vips.vips_block_untrusted_set(true)`
	`13`	`+ expect { Vips::Image.new_from_file(untrusted_image) }.to raise_error Vips::Error, /svgload/`
	`14`	`+`
	`15`	`+ # Unblock`
	`16`	`+ Vips.vips_block_untrusted_set(false)`
	`17`	`+ expect { Vips::Image.new_from_file(untrusted_image) }.not_to raise_error`
	`18`	`+ end`
	`19`	`+ end`
	`20`	`+`
	`21`	`+ if has_jpeg? && has_svg?`
	`22`	`+ it "can block specific operations" do`
	`23`	`+ # Block all loaders except jpeg`
	`24`	`+ Vips.vips_operation_block_set("VipsForeignLoad", true)`
	`25`	`+ Vips.vips_operation_block_set("VipsForeignLoadJpeg", false)`
	`26`	`+ expect { Vips::Image.new_from_file(svg_image) }.to raise_error Vips::Error, /svgload/`
	`27`	`+ expect { Vips::Image.new_from_file(jpg_image) }.not_to raise_error`
	`28`	`+`
	`29`	`+ # Unblock all loaders`
	`30`	`+ Vips.vips_operation_block_set("VipsForeignLoad", false)`
	`31`	`+ expect { Vips::Image.new_from_file(svg_image) }.not_to raise_error`
	`32`	`+ end`
	`33`	`+ end`
	`34`	`+end`

Lines changed: 0 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -1,9 +1,5 @@`
`1`	`1`	`require "spec_helper"`
`2`	`2`
`3`		`-def has_jpeg?`
`4`		`- Vips.type_find("VipsOperation", "jpegload") != nil`
`5`		`-end`
`6`		`-`
`7`	`3`	`RSpec.describe Vips::Image do`
`8`	`4`	`it "can save an image to a file" do`
`9`	`5`	`filename = timg "x.v"`

Lines changed: 8 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,14 @@ def timg(name)`
`22`	`22`	`File.join(@temp_dir, name)`
`23`	`23`	`end`
`24`	`24`
	`25`	`+def has_jpeg?`
	`26`	`+ Vips.type_find("VipsOperation", "jpegload") != nil`
	`27`	`+end`
	`28`	`+`
	`29`	`+def has_svg?`
	`30`	`+ Vips.type_find("VipsOperation", "svgload") != nil`
	`31`	`+end`
	`32`	`+`
`25`	`33`	`RSpec.configure do \|config\|`
`26`	`34`	`config.around do \|example\|`
`27`	`35`	`Dir.mktmpdir("ruby-vips-spec-") do \|dir\|`

Comments

(0)