Fix directly uploading using a MIME type synonym

When Content-Type is "application/x-gzip", request.content_type resolves to "application/gzip", because application/x-gzip is a synonym of application/gzip by default. This causes the acceptable_content? check in ActiveStorage::DiskController to fail, because the direct upload token contains application/x-gzip, which is not equal to application/gzip.

Fix by comparing the token content type with the request content type *and its synonyms*.
This commit is contained in:
George Claghorn 2018-10-08 11:21:13 -04:00 committed by GitHub
commit b4578c8b7f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 1 deletions

View File

@ -61,6 +61,6 @@ class ActiveStorage::DiskController < ActiveStorage::BaseController
end
def acceptable_content?(token)
token[:content_type] == request.content_type && token[:content_length] == request.content_length
token[:content_type] == request.content_mime_type && token[:content_length] == request.content_length
end
end

View File

@ -67,6 +67,16 @@ class ActiveStorage::DiskControllerTest < ActionDispatch::IntegrationTest
assert_not blob.service.exist?(blob.key)
end
test "directly uploading blob with different but equivalent content type" do
data = "Something else entirely!"
blob = create_blob_before_direct_upload(
byte_size: data.size, checksum: Digest::MD5.base64digest(data), content_type: "application/x-gzip")
put blob.service_url_for_direct_upload, params: data, headers: { "Content-Type" => "application/x-gzip" }
assert_response :no_content
assert_equal data, blob.download
end
test "directly uploading blob with mismatched content length" do
data = "Something else entirely!"
blob = create_blob_before_direct_upload byte_size: data.size - 1, checksum: Digest::MD5.base64digest(data)