Security: Fix bypass in content_type_denylist via unescaped RegExp chars

Refs. GHSA-7g26-2qgj-chfg

Author: mshibuya

lib/carrierwave/uploader/content_type_denylist.rb

@@ -54,7 +54,10 @@ def check_content_type_denylist!(new_file)
       end
 
       def denylisted_content_type?(denylist, content_type)
-        Array(denylist).any? { |item| content_type =~ /#{item}/ }
+        Array(denylist).any? do |item|
+          item = Regexp.quote(item) if item.class != Regexp
+          content_type =~ /#{item}/
+        end
       end
 
     end # ContentTypeDenylist

spec/uploader/content_type_denylist_spec.rb

@@ -54,6 +54,28 @@
 
           expect { uploader.cache!(ruby_file) }.to raise_error(CarrierWave::IntegrityError)
         end
+
+        it "properly escapes metacharacters" do
+          allow(uploader).to receive(:content_type_denylist).and_return(['image/svg+xml'])
+
+          sanitized_file = CarrierWave::SanitizedFile.new(ruby_file)
+          allow(sanitized_file).to receive(:content_type).and_return('image/svg+xml')
+
+          expect { uploader.send(:check_content_type_denylist!, sanitized_file) }.to raise_error(CarrierWave::IntegrityError)
+        end
+
+        it "matches anywhere in the string to be more restrictive" do
+          allow(uploader).to receive(:content_type_denylist).and_return(['html'])
+
+          sanitized_file = CarrierWave::SanitizedFile.new(ruby_file)
+          allow(sanitized_file).to receive(:content_type).and_return('text/html')
+
+          expect { uploader.send(:check_content_type_denylist!, sanitized_file) }.to raise_error(CarrierWave::IntegrityError)
+
+          allow(sanitized_file).to receive(:content_type).and_return('application/html')
+
+          expect { uploader.send(:check_content_type_denylist!, sanitized_file) }.to raise_error(CarrierWave::IntegrityError)
+        end
       end
 
       context "when the denylist is a single value" do