#399

backend/app/models/post.rb

@@ -20,13 +20,19 @@ class Post < ApplicationRecord
 
   def self.resized_thumbnail_attachment(upload, content_type: nil)
     upload.rewind
-    image = image_for_thumbnail_upload(upload.read, content_type:)
-    image.resize '180x180'
-    image.format 'jpg'
+    bytes = upload.read
+    blob = Timeout.timeout(THUMBNAIL_PROCESS_TIMEOUT) do
+      image = image_for_thumbnail_upload(bytes, content_type:)
+      image.resize '180x180'
+      image.format 'jpg'
+      image.to_blob
+    end
 
-    { io: StringIO.new(image.to_blob),
+    { io: StringIO.new(blob),
       filename: 'resized_thumbnail.jpg',
       content_type: 'image/jpeg' }
+  rescue Timeout::Error
+    raise MiniMagick::Error, 'サムネイル画像の変換に失敗しました．'
   ensure
     upload.rewind
   end
@@ -41,6 +47,7 @@ class Post < ApplicationRecord
          Preview::HttpFetcher::FetchFailed,
          Preview::HttpFetcher::FetchTimeout,
          Preview::HttpFetcher::ResponseTooLarge,
+         Timeout::Error,
          MiniMagick::Error => e
     raise RemoteThumbnailFetchFailed, e.message
   end
@@ -240,13 +247,11 @@ class Post < ApplicationRecord
   end
 
   def self.decode_raster_thumbnail(bytes)
-    Timeout.timeout(THUMBNAIL_PROCESS_TIMEOUT) { MiniMagick::Image.read(bytes) }
+    MiniMagick::Image.read(bytes)
   end
 
   def self.decode_svg_thumbnail(bytes)
-    Timeout.timeout(THUMBNAIL_PROCESS_TIMEOUT) do
-      MiniMagick::Image.read(sanitised_svg_bytes(bytes))
-    end
+    MiniMagick::Image.read(sanitised_svg_bytes(bytes))
   end
 
   def self.sanitised_svg_bytes(bytes)
@@ -303,7 +308,7 @@ class Post < ApplicationRecord
     stripped = value.to_s.strip
     return false if stripped.blank? || stripped.start_with?('#')
 
-    stripped.match?(/\A(?:https?:|data:|\/\/)/i)
+    true
   end
 
   def self.style_contains_disallowed_urls?(value)
@@ -325,6 +330,8 @@ class Post < ApplicationRecord
 
     view_box = root['viewBox'].to_s.strip.split(/\s+/).map { Float(_1) rescue nil }
     return [nil, nil] if view_box.length != 4 || view_box.any?(&:nil?)
+    return [nil, nil] unless view_box[2].finite? && view_box[2].positive?
+    return [nil, nil] unless view_box[3].finite? && view_box[3].positive?
 
     [view_box[2], view_box[3]]
   end