normalize extension

lib/filename_utils.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module FilenameUtils
+  DANGEROUS_EXTENSIONS = %w[
+    exe com bat cmd scr pif vbs vbe js jse wsf wsh msi msp
+    hta cpl jar app deb rpm dmg pkg mpkg dll so dylib sys
+    inf reg ps1 psm1 psd1 ps1xml psc1 pssc vb vba
+    sh bash zsh fish run out bin elf gadget workflow lnk scf
+    url desktop application action apk ipa xap appx
+    appxbundle msix msixbundle diagcab diagpkg msc ocx
+    drv ins isp mst paf prf shb shs slk ws wsc inf1 inf2
+  ].freeze
+
+  DANGEROUS_EXTENSIONS_REGEXP = /\.(#{Regexp.union(DANGEROUS_EXTENSIONS).source})\W*\z/i
+
+  module_function
+
+  def dangerous_extension(filename)
+    ActiveStorage::Filename.wrap(filename).sanitized[DANGEROUS_EXTENSIONS_REGEXP, 1]&.downcase
+  end
+end

lib/submitters.rb

@@ -16,16 +16,6 @@ module Submitters
   MaliciousFileExtension = Class.new(StandardError)
   ParamsError = Class.new(StandardError)
 
-  DANGEROUS_EXTENSIONS = Set.new(%w[
-    exe com bat cmd scr pif vbs vbe js jse wsf wsh msi msp
-    hta cpl jar app deb rpm dmg pkg mpkg dll so dylib sys
-    inf reg ps1 psm1 psd1 ps1xml psc1 pssc bat cmd vb vba
-    sh bash zsh fish run out bin elf gadget workflow lnk scf
-    url desktop application action workflow apk ipa xap appx
-    appxbundle msix msixbundle diagcab diagpkg cpl msc ocx
-    drv scr ins isp mst paf prf shb shs slk ws wsc inf1 inf2
-  ].freeze)
-
   FILES_TTL = 5.minutes
 
   module_function
@@ -127,11 +117,9 @@ module Submitters
   def create_attachment!(submitter, file, metadata: {})
     raise ParamsError, 'file param is missing' if file.blank?
 
-    extension = File.extname(file.original_filename).delete_prefix('.').downcase
+    extension = FilenameUtils.dangerous_extension(file.original_filename)
 
-    if DANGEROUS_EXTENSIONS.include?(extension)
-      raise MaliciousFileExtension, "File type '.#{extension}' is not allowed."
-    end
+    raise MaliciousFileExtension, "File type '.#{extension}' is not allowed." if extension
 
     blob = ActiveStorage::Blob.create_and_upload!(io: file.tap(&:rewind).open,
                                                   filename: file.original_filename,

lib/submitters/normalize_values.rb

@@ -247,7 +247,7 @@ module Submitters
 
       detected_extensions = Marcel::TYPE_EXTS[mime_type].to_a.map(&:downcase)
 
-      if detected_extensions.any? { |e| Submitters::DANGEROUS_EXTENSIONS.include?(e) }
+      if detected_extensions.any? { |e| FilenameUtils::DANGEROUS_EXTENSIONS.include?(e) }
         raise InvalidDefaultValue, "File type '.#{detected_extensions.first}' is not allowed."
       end
 
@@ -276,11 +276,9 @@ module Submitters
 
     def find_or_create_blob_from_url(account, url)
       filename = Addressable::URI.parse(url).path.split('/').last.to_s
-      extension = File.extname(filename).delete_prefix('.').downcase
+      extension = FilenameUtils.dangerous_extension(filename)
 
-      if Submitters::DANGEROUS_EXTENSIONS.include?(extension)
-        raise InvalidDefaultValue, "File type '.#{extension}' is not allowed."
-      end
+      raise InvalidDefaultValue, "File type '.#{extension}' is not allowed." if extension
 
       cache_key = [account.id, url].join(':')
       checksum = CHECKSUM_CACHE_STORE.fetch(cache_key)