ankane / lockbox

Modern encryption for Ruby and Rails
MIT License
1.44k stars 68 forks source link

Rails 7 ActiveStorage introduces predefined variants which breaks Lockbox's variant handling #102

Closed geetfun closed 3 years ago

geetfun commented 3 years ago

In reference to this commit on edge rails (https://github.com/rails/rails/commit/65979c693bbf212736acc41bb200f04032cf9683), Rails now allow predefined variants:

Example:

```ruby
class User < ActiveRecord::Base
  has_one_attached :avatar do |attachable|
    attachable.variant :thumb, resize: "100x100"
    attachable.variant :medium, resize: "300x300", monochrome: true
  end
end
class Gallery < ActiveRecord::Base
  has_many_attached :photos do |attachable|
    attachable.variant :thumb, resize: "100x100"
    attachable.variant :medium, resize: "300x300", monochrome: true
  end
end
<%= image_tag user.avatar.variant(:thumb) %>
```

Looking at Lockbox's code, in the past, Lockbox basically disallows variants on encrypted files.

It looks like this new behaviour is pre-processing variants, so it somehow bypasses Lockbox's variant method in Lockbox::ActiveStorageExtensions::Attachment, and so Lockbox::Error is never raised.

I think the new code that's affecting Lockbox is here in activestorage/app/models/active_storage/attachment.rb: https://github.com/rails/rails/commit/65979c693bbf212736acc41bb200f04032cf9683#diff-afc2ef0d8123f4c9b33b3aa3da6ba0992217023f1aa5d748994a7a0e324a7314

ankane commented 3 years ago

Addressed in #103