mirror of
https://github.com/chatwoot/chatwoot.git
synced 2026-06-04 21:02:35 +08:00
ffbf40c720
Hardens Active Storage handling on Rails 7.1 by filtering internal direct-upload metadata keys and limiting proxy range requests, while keeping audio playback on redirect URLs so large recordings are not routed through the proxy limiter. Closes - CVE-2026-33173 - CVE-2026-33174 - CVE-2026-33658 Why Rails 7.1 does not currently have patched releases for these Active Storage advisories, and Chatwoot exposes Active Storage direct-upload endpoints and media URLs. This keeps the Rails dependency unchanged while adding small local mitigations until Rails can be upgraded to 7.2.3.1+. What changed - Filters `identified`, `analyzed`, and `composed` from direct-upload blob metadata. - Limits Active Storage proxy range requests to one range under 100 MB. - Uses redirect URLs for inline audio attachments so normal playback of large recordings avoids the proxy streaming path. - Adds scoped bundle-audit ignores for the locally mitigated Active Storage advisories and the remaining Rails advisories that are not reachable through current Chatwoot usage. How to test - Upload an attachment from the dashboard reply composer and confirm it sends successfully. - Upload an attachment from the website widget and confirm it appears in the conversation. - POST a direct-upload request with `blob.metadata.identified`, `blob.metadata.analyzed`, and `blob.metadata.composed`; confirm those keys are not persisted while custom metadata remains. - Play an audio/call-recording attachment and confirm the audio URL loads through Active Storage redirect rather than proxy. - Run `bundle exec bundle audit check -v`. --------- Co-authored-by: Muhsin Keloth <muhsinkeramam@gmail.com>
55 lines
1.7 KiB
Ruby
55 lines
1.7 KiB
Ruby
# Allow audio attachments (call recordings, voice notes) to serve inline so the
|
|
# in-app <audio> player can stream them. Without this, ActiveStorage's blob model
|
|
# forces Content-Disposition: attachment for any MIME outside the default allowlist
|
|
# (images + PDF), which makes the browser download instead of play.
|
|
Rails.application.config.active_storage.content_types_allowed_inline += %w[
|
|
audio/webm
|
|
audio/ogg
|
|
audio/mpeg
|
|
audio/mp4
|
|
audio/x-m4a
|
|
audio/wav
|
|
audio/x-wav
|
|
]
|
|
|
|
module ActiveStorageDirectUploadMetadataFilter
|
|
INTERNAL_METADATA_KEYS = %w[identified analyzed composed].freeze
|
|
|
|
private
|
|
|
|
def blob_args
|
|
super.tap do |args|
|
|
args[:metadata]&.except!(*INTERNAL_METADATA_KEYS, *INTERNAL_METADATA_KEYS.map(&:to_sym))
|
|
end
|
|
end
|
|
end
|
|
|
|
module ActiveStorageProxyRangeLimit
|
|
STREAMING_MAX_RANGES = 1
|
|
STREAMING_CHUNK_MAX_SIZE = 100.megabytes
|
|
|
|
private
|
|
|
|
def send_blob_byte_range_data(blob, range_header, disposition: nil)
|
|
ranges = Rack::Utils.get_byte_ranges(range_header, blob.byte_size)
|
|
return head(:range_not_satisfiable) unless valid_ranges?(ranges)
|
|
|
|
super
|
|
end
|
|
|
|
def valid_ranges?(ranges)
|
|
ranges.present? &&
|
|
ranges.any?(&:present?) &&
|
|
ranges.length <= STREAMING_MAX_RANGES &&
|
|
ranges.sum { |range| range.end - range.begin } < STREAMING_CHUNK_MAX_SIZE
|
|
end
|
|
end
|
|
|
|
Rails.application.config.to_prepare do
|
|
unless ActiveStorage::DirectUploadsController < ActiveStorageDirectUploadMetadataFilter
|
|
ActiveStorage::DirectUploadsController.prepend(ActiveStorageDirectUploadMetadataFilter)
|
|
end
|
|
|
|
ActiveStorage::Streaming.prepend(ActiveStorageProxyRangeLimit) unless ActiveStorage::Streaming < ActiveStorageProxyRangeLimit
|
|
end
|