content_type validation may be broken for application/x-ole-storage

[kapso]

For the following model, content_type validation fails for - application/x-ole-storage

So basically a user was able to upload a .doc file with content type = application/x-ole-storage even though this content type is not manifested in CONTENT_TYPES

class Blog < ApplicationRecord

  CONTENT_TYPES = ["application/rtf",
 "application/pdf",
 "application/msword",
 "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
 "application/vnd.openxmlformats-officedocument.wordprocessingml.template",
 "application/vnd.ms-word.document.macroEnabled.12",
 "application/vnd.ms-excel",
 "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
 "application/vnd.openxmlformats-officedocument.spreadsheetml.template",
 "application/vnd.ms-excel.sheet.macroEnabled.12",
 "application/vnd.ms-powerpoint",
 "application/vnd.openxmlformats-officedocument.presentationml.template",
 "application/vnd.openxmlformats-officedocument.presentationml.presentation",
 "application/vnd.openxmlformats-officedocument.presentationml.slideshow",
 "application/vnd.ms-powerpoint.presentation.macroEnabled.12"]

  has_one_attached :document

  validates :document, content_type: { in: CONTENT_TYPES, message: 'is not a PDF or Word or PPT doc' }, attached: true
end

[Mth0158]

Hi @kapso,

The issue here lies in the fact that your user might upload a file with an "application/vnd.ms-excel" declared content_type, therefore it passes our validation (we validate against the declared content type).

But then, when storing the blob, Rails perform something a bit more specific to set the corresponding blob content_type value. It uses the file io (first 4kb) + declared content type (Marcel::MimeType.for download_identifiable_chunk, name: filename.to_s, declared_type: content_type here). This might result in a different output content type than the declared one, and I think it's what you are experiencing.

I am considering to do change the way we do things to mimic Rails blob content type assignation, this might be easier for everyone (plus it is a bit more robust than just validating the declared content type). I'll drop a PR in the coming days to solve this.

[Mth0158]

Will be available in a coming 1.3.5 release this week.

[kapso]

thanks a lot, for the quick fix

[Mth0158]

@kapso Released is up, let me know if you still have this issue :)