Module: Magick::ConfigDSL

Defined in:
lib/magick/config.rb

Overview

DSL for configuration

Class Attribute Summary collapse

Class Method Summary collapse

Class Attribute Details

.project_root ⇒ Object

The directory a config file must live under.

Rails.root when the host is a Rails app, otherwise the Bundler project (the directory holding the Gemfile). Deliberately not Dir.pwd: a process started from /, or one that chdirs after boot, must not be able to widen the guard in front of the eval sink below.

Returns nil when no root can be determined; the loader then refuses every path unless MAGICK_ALLOW_CONFIG_EVAL=1 is set. Apps that run outside both Rails and Bundler can assign a root explicitly with Magick::ConfigDSL.project_root = '/srv/app' — never from untrusted input.



417
418
419
420
421
422
 
# File 'lib/magick/config.rb', line 417

def self.project_root
  root = @project_root || detect_project_root
  return nil if root.nil? || root.to_s.empty?

  real_path(root.to_s)
end

Class Method Details

.configure(&block) ⇒ Object 



389
390
391
392
393
394
 
# File 'lib/magick/config.rb', line 389

def self.configure(&block)
  config = Config.new
  config.instance_eval(&block)
  config.apply!
  config
end

.load_from_file(file_path) ⇒ Object

Load a Magick configuration DSL file by path.

SECURITY: This method evaluates the file's contents as Ruby via instance_eval. Never pass a path derived from HTTP input, ENV variables, build artifacts, or any other untrusted source — doing so is remote code execution. Callers must guarantee the path points at a file that lives inside the project tree (typical use: Rails.root.join('config/features.rb')).

The path is resolved with File.realpath and must sit inside project_root (see above). Setting MAGICK_ALLOW_CONFIG_EVAL=1 skips the check entirely and is dangerous: it hands any caller that can influence file_path arbitrary code execution. Use it only for a trusted file you deliberately keep outside the project tree.



474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
 
# File 'lib/magick/config.rb', line 474

def self.load_from_file(file_path)
  resolved = File.realpath(file_path)

  unless ENV['MAGICK_ALLOW_CONFIG_EVAL'] == '1'
    root = project_root
    unless inside_project_root?(resolved, root)
      raise SecurityError,
            'Refusing to load Magick config from outside the project tree ' \
            "(#{root || 'project root could not be determined'}): #{resolved}. " \
            'Set MAGICK_ALLOW_CONFIG_EVAL=1 to override (only if you trust the file).'
    end
  end

  config = Config.new
  config.instance_eval(File.read(resolved), resolved)
  config.apply!
  config
end