#399

backend/app/models/post.rb

@@ -17,6 +17,7 @@ class Post < ApplicationRecord
   MAX_SVG_DIMENSION = 4_096
   MAX_SVG_PIXELS = 16_777_216
   THUMBNAIL_PROCESS_TIMEOUT = 5.seconds
+  RASTER_THUMBNAIL_FORMATS = ['jpeg', 'png', 'gif', 'webp'].freeze
 
   def self.resized_thumbnail_attachment(upload, content_type: nil)
     upload.rewind
@@ -225,9 +226,23 @@ class Post < ApplicationRecord
   end
 
   def self.image_for_thumbnail_upload(bytes, content_type: nil)
-    return decode_raster_thumbnail(bytes) unless svg_content_type?(content_type) || svg_document_bytes?(bytes)
+    if svg_content_type?(content_type) || svg_document_bytes?(bytes)
+      return decode_svg_thumbnail(bytes)
+    end
 
-    decode_svg_thumbnail(bytes)
+    raise MiniMagick::Error, 'サムネイル画像の形式が不正です．' unless raster_thumbnail_bytes?(bytes)
+
+    decode_raster_thumbnail(bytes)
+  end
+
+  def self.raster_thumbnail_bytes?(bytes)
+    raster_thumbnail_format(bytes).present?
+  end
+
+  def self.remote_thumbnail_image_bytes?(bytes, content_type: nil)
+    return true if svg_content_type?(content_type) || svg_document_bytes?(bytes)
+
+    raster_thumbnail_bytes?(bytes)
   end
 
   def self.svg_content_type?(content_type)
@@ -254,6 +269,18 @@ class Post < ApplicationRecord
     MiniMagick::Image.read(sanitised_svg_bytes(bytes))
   end
 
+  def self.raster_thumbnail_format(bytes)
+    binary = bytes.to_s.b
+    return 'jpeg' if binary.start_with?("\xFF\xD8\xFF".b)
+    return 'png' if binary.start_with?("\x89PNG\r\n\x1A\n".b)
+    return 'gif' if binary.start_with?('GIF87a'.b) || binary.start_with?('GIF89a'.b)
+    return 'webp' if binary.bytesize >= 12 &&
+                     binary.start_with?('RIFF'.b) &&
+                     binary.byteslice(8, 4) == 'WEBP'
+
+    nil
+  end
+
   def self.sanitised_svg_bytes(bytes)
     parse_options =
         Nokogiri::XML::ParseOptions::STRICT |
@@ -354,6 +381,7 @@ class Post < ApplicationRecord
                        :svg_content_type?,
                        :decode_raster_thumbnail,
                        :decode_svg_thumbnail,
+                       :raster_thumbnail_format,
                        :sanitised_svg_bytes,
                        :svg_uses_disallowed_features?,
                        :external_svg_reference?,