Don't need to validate transformations actually

Since they're only ever generated in signed form. Users never have direct access to dictate transformations.
上级 5fcaa197
...@@ -4,11 +4,6 @@ ...@@ -4,11 +4,6 @@
class ActiveStorage::Variation class ActiveStorage::Variation
class_attribute :verifier class_attribute :verifier
ALLOWED_TRANSFORMATIONS = %i(
resize rotate format flip fill monochrome orient quality roll scale sharpen shave shear size thumbnail
transparent transpose transverse trim background bordercolor compress crop
)
attr_reader :transformations attr_reader :transformations
class << self class << self
...@@ -27,8 +22,6 @@ def initialize(transformations) ...@@ -27,8 +22,6 @@ def initialize(transformations)
def transform(image) def transform(image)
transformations.each do |(method, argument)| transformations.each do |(method, argument)|
next unless eligible_transformation?(method)
if eligible_argument?(argument) if eligible_argument?(argument)
image.public_send(method, argument) image.public_send(method, argument)
else else
...@@ -42,11 +35,6 @@ def key ...@@ -42,11 +35,6 @@ def key
end end
private private
def eligible_transformation?(method)
method.to_sym.in?(ALLOWED_TRANSFORMATIONS)
end
# FIXME: Consider whitelisting allowed arguments as well?
def eligible_argument?(argument) def eligible_argument?(argument)
argument.present? && argument != true argument.present? && argument != true
end end
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册