discourse/lib/compression/engine.rb
Roman Rizzi 10565e4623
SECURITY: Safely decompress files. (#8124)
* FEATURE: Adds an extra protection layer when decompressing files.

* Rename exporter/importer to zip importer. Update old locale

* Added a new composite class to decompress a file with multiple strategies

* Set max file size inside a site setting

* Ensure that file is deleted after compression

* Sanitize path and files before compressing/decompressing
2019-10-03 10:19:35 -03:00

34 lines
896 B
Ruby

# frozen_string_literal: true
module Compression
class Engine
UnsupportedFileExtension = Class.new(StandardError)
def self.default_strategies
[
Compression::Zip.new,
Compression::Pipeline.new([Compression::Tar.new, Compression::Gzip.new]),
Compression::Gzip.new,
Compression::Tar.new
]
end
def self.engine_for(filename, strategies: default_strategies)
strategy = strategies.detect(-> { raise UnsupportedFileExtension }) { |e| e.can_handle?(filename) }
new(strategy)
end
def initialize(strategy)
@strategy = strategy
end
def decompress(dest_path, compressed_file_path, allow_non_root_folder: false)
@strategy.decompress(dest_path, compressed_file_path, allow_non_root_folder: false)
end
def compress(path, target_name)
@strategy.compress(path, target_name)
end
end
end