
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
"(\( ⁰⊖⁰)/)"
Tori is a very very simple file uploader.
Tori does nothing.
Only file upload to backend store.
You can upload file without alter database.
Gemfile
gem 'tori', require: 'tori/rails'
app/models/photo.rb
class Photo < ActiveRecord::Base
tori :image
after_save do
image.write if image.from?
end
after_destroy do
image.delete
end
end
app/controllers/photos_controller.rb
class PhotosController < ApplicationController
def new
@photo = Photo.new
end
def create
Photo.create(photo_params)
redirect_to root_path
end
private
def photo_params
params.require(:photo).permit(:image)
end
end
app/views/photos/new.html.slim
= form_for @photo, multipart: true |f|
= f.file_field 'image'
= f.button 'Upload'
You can read file.
photo.image.read #=> image bin
photo.image.exist? #=> exist check
photo.image.name #=> filename
Two image file upload to backend example.
defined method by tori
method can define a key name for each by block.
class Photo < ActiveRecord::Base
tori :original_image do |model|
"#{model.class}/original/#{model.original_filename}"
end
tori :striped_image do |model|
"#{model.class}/striped/#{model.striped_filename}"
end
# customize backend each by `tori` method.
tori :custom, to: Tori::Backend::FileSystem.new(Pathname("custom")) do |model|
"#{__tori__}/#{id}"
end
end
class PhotoController < ApplicationController
def create
original = params[:file]
Tempfile.open("striped") { |striped|
# image processing example
MiniMagick::Tool::Convert.new { |c|
c.strip
c << original.path
c << striped.path
}
# create record
photo = Photo.create
# set image file to model
photo.original_image = original
photo.striped_image = striped
# write image file to backend
photo.original_image.write
photo.striped_image.write
}
end
end
https://github.com/ksss/tori/blob/master/lib/tori.rb
You can change configure any time.
FAQs
Unknown package
We found that tori demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.