Git Product home page Git Product logo

imgix-rails's Introduction

imgix logo

imgix-rails is a gem for integrating imgix into Ruby on Rails applications. It builds on imgix-rb to offer a few Rails-specific interfaces. It is tested under Ruby versions 3.1, 3.0, 2.7, and jruby-9.2.11.0.

Gem Version Build Status Downloads License FOSSA Status


Installation

Add this line to your application's Gemfile:

gem 'imgix-rails'

And then execute:

$ bundle

Usage

imgix-rails provides a few different hooks to work with your existing Rails application. All current methods are drop-in replacements for the image_tag helper.

Configuration

Before you get started, you will need to define your imgix configuration in your config/application.rb, or in an environment-specific configuration file.

Rails.application.configure do
  config.imgix = {
    source: "assets.imgix.net"
  }
end

The following configuration flags will be respected:

  • use_https: toggles the use of HTTPS. Defaults to true
  • source: a String or Array that specifies the imgix Source address. Should be in the form of "assets.imgix.net".
  • srcset_width_tolerance: an optional numeric value determining the maximum tolerance allowable, between the downloaded dimensions and rendered dimensions of the image (default 0.08 i.e. 8%).
  • secure_url_token: an optional secure URL token found in your dashboard (https://dashboard.imgix.com) used for signing requests
  • include_library_param: toggles the inclusion of the ixlib parameter. Defaults to true.

Multi-source configuration

In addition to the standard configuration flags, the following options can be used for multi-source support.

  • sources: a Hash of imgix source-secure_url_token key-value pairs. If the value for a source is nil, URLs generated for the corresponding source won't be secured. sources and source cannot be used together.
  • default_source: optionally specify a default source for generating URLs.

Example:

Rails.application.configure do
  config.imgix = {
    sources: {
      "assets.imgix.net"  => "foobarbaz",
      "assets2.imgix.net" => nil,   # Will generate unsigned URLs
    },
    default_source: "assets.imgix.net"
  }
end

ix_image_tag

The ix_image_tag helper method makes it easy to pass parameters to imgix to handle resizing, cropping, etc. It also simplifies adding responsive imagery to your Rails app by automatically generating a srcset based on the parameters you pass. We talk a bit about using the srcset attribute in an application in the following blog post: “Responsive Images with srcset and imgix.”.

ix_image_tag generates <img> tags with a filled-out srcset attribute that leans on imgix-rb to do the hard work. It also makes a variety of options available for customizing how the srcset is generated. For example, if you already know the minimum or maximum number of physical pixels that this image will need to be displayed at, you can pass the min_width and/or max_width options. This will result in a smaller, more tailored srcset.

ix_image_tag takes the following arguments:

  • source: An optional String indicating the source to be used. If unspecified :source or :default_source will be used. If specified, the value must be defined in the config.
  • path: The path or URL of the image to display.
  • tag_options: HTML attributes to apply to the generated img element. This is useful for adding class names, alt tags, etc.
  • url_params: The imgix URL parameters to apply to this image. These will be applied to each URL in the srcset attribute, as well as the fallback src attribute.
  • srcset_options: A variety of options that allow for fine tuning srcset generation. More information on each of these modifiers can be found in the imgix-rb documentation. Any of the following can be passed as arguments:
    • widths: An array of exact widths that srcset pairs will be generated with.
    • min_width: The minimum width that srcset pairs will be generated with. Will be ignored if widths are provided.
    • max_width: The maximum width that srcset pairs will be generated with. Will be ignored if widths are provided.
    • disable_variable_quality: Pass true to disable variable quality parameters when generating a srcset (fixed-images only). In addition, imgix-rails will respect an overriding q (quality) parameter if one is provided through url_params.
    • attribute_options: Allow you to change where imgix-rails renders attributes. This can be helpful if you want to add lazy-loading.
<%= ix_image_tag('/unsplash/hotairballoon.jpg', url_params: { w: 300, h: 500, fit: 'crop', crop: 'right'}, tag_options: { alt: 'A hot air balloon on a sunny day' }) %>

Will render out HTML like the following:

<img
  alt="A hot air balloon on a sunny day"
  sizes="100vw"
  srcset="
    https://assets.imgix.net/unsplash/hotairballoon.jpg?w=100&h=167&fit=crop&crop=right 100w,
    https://assets.imgix.net/unsplash/hotairballoon.jpg?w=200&h=333&fit=crop&crop=right 200w,

    https://assets.imgix.net/unsplash/hotairballoon.jpg?w=2560&h=4267&fit=crop&crop=right 2560w
  "
  src="https://assets.imgix.net/unsplash/hotairballoon.jpg?w=300&h=500&fit=crop&crop=right"
>

Similarly

<%= ix_image_tag('assets2.imgix.net', '/unsplash/hotairballoon.jpg') %>

Will generate URLs using assets2.imgix.net source.

We recommend leveraging this to generate powerful helpers within your application like the following:

def profile_image_tag(user)
  ix_image_tag(user.profile_image_url, url_params: { w: 100, h: 200, fit: 'crop' })
end

Then rendering the portrait in your application is very easy:

<%= profile_image_tag(@user) %>

If you already know all the exact widths you need images for, you can specify that by passing the widths option as an array. In this case, imgix-rails will only generate srcset pairs for the specified widths.

<%= ix_image_tag('/unsplash/hotairballoon.jpg', srcset_options: { widths: [320, 640, 960, 1280] }, tag_options: { alt: 'A hot air balloon on a sunny day' }) %>

Fixed image rendering

In cases where enough information is provided about an image's dimensions, ix_image_tag will instead build a srcset that will allow for an image to be served at different resolutions. The parameters taken into consideration when determining if an image is fixed-width are w, h, and ar. By invoking ix_image_tag with either a width or the height and aspect ratio (along with fit=crop, typically) provided, a different srcset will be generated for a fixed-size image instead.

<%= ix_image_tag('/unsplash/hotairballoon.jpg', url_params: {w: 1000}) %>

Will render the following HTML:

<img srcset="https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=1&q=75 1x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=2&q=50 2x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=3&q=35 3x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=4&q=23 4x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=5&q=20 5x" sizes="100vw" src="https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000">

Fixed image rendering will automatically append a variable q parameter mapped to each dpr parameter when generating a srcset. This technique is commonly used to compensate for the increased filesize of high-DPR images. Since high-DPR images are displayed at a higher pixel density on devices, image quality can be lowered to reduce overall filesize without sacrificing perceived visual quality. For more information and examples of this technique in action, see this blog post. This behavior will respect any overriding q value passed in via url_params and can be disabled altogether with srcset_options: { disable_variable_quality: true }.

Lazy loading

If you'd like to lazy load images, we recommend using lazysizes. In order to use imgix-rails with lazysizes, you need to use attribute_options as well as set tag_options[:src]:

<%= ix_image_tag('image.jpg', attribute_options: {src: "data-src",
srcset: "data-srcset", sizes: "data-sizes"}, url_params: {w: 1000},
tag_options: {src: "lqip.jpg"}) %>

Will render the following HTML:

<img data-srcset="https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=1&q=75 1x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=2&q=50 2x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=3&q=35 3x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=4&q=23 4x,
https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000&dpr=5&q=20 5x"
data-sizes="100vw"
data-src="https://assets.imgix.net/image.jpg?ixlib=rails-3.0.2&w=1000"
src="lqip.jpg">

ix_picture_tag

The ix_picture_tag helper method makes it easy to generate picture elements in your Rails app. picture elements are useful when an images needs to be art directed differently at different screen sizes.

ix_picture_tag takes the following arguments:

  • source: an optional String indicating the source to be used. If unspecified :source or :default_source will be used. If specified, the value must be defined in the config.
  • path: The path or URL of the image to display.
  • tag_options: Any options to apply to the parent picture element. This is useful for adding class names, etc.
  • img_tag_options: Any options to apply to the generated img element. This can be useful to add an alt attribute.
  • url_params: Default imgix options. These will be used to generate a fallback img tag for older browsers, and used in each source unless overridden by breakpoints.
  • breakpoints: A hash describing the variants. Each key must be a media query (e.g. (max-width: 880px)), and each value must be a hash of parameter overrides for that media query. A source element will be generated for each breakpoint specified.
  • srcset_options: A variety of options that allow for fine tuning srcset generation. More information on each of these modifiers can be found in the imgix-rb documentation. Any of the following can be passed as arguments:
    • widths: An array of exact widths that srcset pairs will be generated with.
    • min_width: The minimum width that srcset pairs will be generated with. Will be ignored if widths are provided.
    • max_width: The maximum width that srcset pairs will be generated with. Will be ignored if widths are provided.
    • disable_variable_quality: Pass true to disable variable quality parameters when generating a srcset (fixed-images only). In addition, imgix-rails will respect an overriding q (quality) parameter if one is provided through url_params.
<%= ix_picture_tag('bertandernie.jpg',
  tag_options: {
    class: 'a-picture-tag'
  },
  img_tag_options: {
    alt: 'A picture of Bert and Ernie arguing'
  },
  url_params: {
    w: 300,
    h: 300,
    fit: 'crop',
  },
  breakpoints: {
    '(max-width: 640px)' => {
      url_params: {
        h: 100,
      },
      tag_options: {
        sizes: 'calc(100vw - 20px)'
      }
    },
    '(max-width: 880px)' => {
      url_params: {
        crop: 'right',
      },
      tag_options: {
        sizes: 'calc(100vw - 20px - 50%)'
      }
    },
    '(min-width: 881px)' => {
      url_params: {
        crop: 'left',
      },
      tag_options: {
        sizes: '430px'
      }
    }
  }
) %>

To generate a picture element on a different source:

<%= ix_picture_tag('assets2.imgix.net', 'bertandernie.jpg',
      tag_options: {},
      img_tag_options: {},
      url_params: {},
      breakpoints: {
        '(max-width: 640px)' => {
          url_params: { h: 100 },
          tag_options: { sizes: 'calc(100vw - 20px)' }
        },
      }
   ) %>

ix_image_url

The ix_image_url helper makes it easy to generate a URL to an image in your Rails app.

ix_image_url takes three arguments:

  • source: an optional String indicating the source to be used. If unspecified :source or :default_source will be used. If specified, the value must be defined in the config.
  • path: The path or URL of the image to display.
  • options: The imgix URL parameters to apply to this image URL. Optionally, you can use disable_path_encoding: false for disabling URL-encoding which will be applied by default.
<%= ix_image_url('/users/1/avatar.png', { w: 400, h: 300 }) %>
<%= ix_image_url('assets2.imgix.net', '/users/1/avatar.png', { w: 400, h: 300, disable_path_encoding: true }) %>

Will generate the following URLs:

https://assets.imgix.net/users/1/avatar.png?w=400&h=300
https://assets2.imgix.net/users/1/avatar.png?w=400&h=300

Usage in Model

Since ix_image_url lives inside UrlHelper, it can also be used in places other than your views quite easily. This is useful for things such as including imgix URLs in JSON output from a serializer class.

include Imgix::Rails::UrlHelper

puts ix_image_url('/users/1/avatar.png', { w: 400, h: 300 })
# => https://assets.imgix.net/users/1/avatar.png?w=400&h=300

Alternatively, you can also use the imgix Ruby client in the same way.

Usage in Sprockets

ix_image_url is also pulled in as a Sprockets helper, so you can generate imgix URLs in your asset pipeline files. For example, here's how it would work inside an .scss.erb file:

.something {
  background-image: url(<%= ix_image_url('a-background.png', { w: 400, h: 300 }) %>);
}

Using With Image Uploading Libraries

imgix-rails plays well with image uploading libraries, because it just requires a URL and optional parameters as arguments. A good way to handle this interaction is by creating helpers that bridge between your uploading library of choice and imgix-rails. Below are examples of how this can work with some common libraries. Please submit an issue if you'd like to see specific examples for another!

Paperclip and CarrierWave

Paperclip and CarrierWave can directly provide paths to uploaded images, so we can use them with imgix-rails without a bridge.

<%= ix_image_tag(@user.avatar.path, { auto: 'format', fit: 'crop', w: 500}) %>

Refile

Since Refile doesn't actually store URLs or paths in the database (instead using a "prefix" + image identifier), the basic setup is slightly different. In this case, we use a couple helpers that bridge between Refile and imgix-rails.

module ImgixRefileHelper
  def ix_refile_image_url(obj, key, **opts)
    path = s3_path(obj, key)
    path ? ix_image_url(path, opts) : ''
  end

  def ix_refile_image_tag(obj, key, **opts)
    path = s3_path(obj, key)
    path ? ix_image_tag(path, opts) : ''
  end

private
  def s3_path(obj, key)
    refile_id = obj["#{key}_id"]
    s3_prefix = obj.send(key).try(:backend).instance_variable_get(:@prefix)

    s3_prefix ? "#{s3_prefix}/#{refile_id}" : nil
  end
end
<%= ix_refile_image_tag(@blog_post, :hero_photo, {auto: 'format', fit: 'crop', w: 500}) %>

Active Storage

To set up imgix with ActiveStorage, first ensure that the remote source your ActiveStorage service is pointing to is the same as your imgix source — such as an s3 bucket.

S3

config/storage.yml

service: S3
access_key_id: <%= Rails.application.credentials.dig(:aws, :access_key_id) %>
secret_access_key: <%= Rails.application.credentials.dig(:aws, :secret_access_key) %>
region: us-east-1
bucket: your_own_bucket

GCS

google:
  service: GCS
  project: Project Name
  credentials: <%= Rails.root.join("path/to/key.json") %>
  bucket: Bucket Name

Modify your active_storage.service setting depending on what environment you are using. For example, to use Amazon s3 in production, make the following change:

config/environments/production.rb

config.active_storage.service = :amazon

To use Google GCS in production, configure the active storage service like so:

config.active_storage.service = :google

As you would normally with imgix-rails, configure your application to point to your imgix source:

config/application.rb

Rails.application.configure do
      config.imgix = {
        source: your_domain,
        use_https: true,
        include_library_param: true
      }
end

Finally, the two can be used together by passing in the filename of the ActiveStorage blob into the imgix-rails helper function:

show.html.erb

<%= ix_image_tag(@your_model.image.key) %>

Upgrade Guides

3.x to 4.0

The v4.0.0 release of imgix-rails introduces a variety of improvements relating to how this gem handles and generates srcset attributes. However, in releasing this version there are some significant interface/behavioral changes that users need to be aware of. Users should note that the min_width and max_width fields (passed via tag_options), as well as the widths field, have all been moved to their own encompassing srcset_options field. This is done with the intention of providing a more organized and intuitive experience when fine-tuning how srcset width pairs are generated. See the following example demonstrating this new pattern:

<%= ix_image_tag('/unsplash/hotairballoon.jpg',
  srcset_options: { min_width: 1000, max_width: 2500},
  tag_options: { alt: 'A hot air balloon on a sunny day' }) %>

For users migrating to version 4.0 or later, it is important that all srcset-related modifiers be passed via srcset_options, as doing so through tag_options or widths directly will result in errors. For more details on these modifiers, please see the ix_image_tag or ix_picture_tag sections.

In addition to these changes, imgix-rails is now capable of producing fixed-image srcsets. Users should note that when certain dimension information is provided, imgix-rails will produce a srcset at different screen resolutions rather than the typical width pairs. This feature provides expanded functionality to cover more srcset use cases that users can take advantage of. We are always happy to provide our users with more tools to assist them in their efforts to build out responsive images on the web.

Development

After checking out the repo, run bin/setup to install dependencies. Then, run bin/console for an interactive prompt that will allow you to experiment.

To install this gem onto your local machine, run bundle exec rake install. To release a new version, update the version number in version.rb, and then run bundle exec rake release to create a git tag for the version, push git commits and tags, and push the .gem file to rubygems.org.

Contributing

See contributing guidelines.

Code of Conduct

Users contributing to or participating in the development of this project are subject to the terms of imgix's Code of Conduct.

License

FOSSA Status

imgix-rails's People

Contributors

alexdunae avatar arno-fukuda avatar atlawrie avatar chengz avatar copyconstruct avatar deep-spaced avatar ericdeansanchez avatar fossabot avatar frederickfogerty avatar hashknot avatar ihid avatar jayeb avatar kellysutton avatar killercodemonkey avatar lou avatar lunks avatar luqven avatar marckohlbrugge avatar meltingice avatar mkusaka avatar olleolleolle avatar paulstraw avatar pedroaguilar avatar ravster avatar richessler avatar schmidt avatar sherwinski avatar spaghetticode avatar takamario avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

imgix-rails's Issues

Would be nice to see an example working with Refile

I am currently using Refile to handle image uploads and resizing in my app. However, I'm moving to using imgix. It would be nice to see an example of how to easily migrate to using imgix without much modification on my part.

ix_picture_tag helper sets custom alt: attribute on the <picture> tag instead of <img> tag

Rails' regular image_tag helper allows an optional alt: option to be passed in. However, in your helpers, notably the ix_picture_tag, the alt: option when passed in is applied to the <picture> tag rather than the <img> tag which is the HTML standard.

For example:

<%= ix_picture_tag(url,
  picture_tag_options: {
    alt: "Some custom alt text"
  }
) %>

will result in:

<picture alt="Some custom alt text">
  ...
  <img>
  ...
</picture>

Where the behavior should be (ideally):

<picture>
  ...
  <img alt="Some custom alt text">
  ...
</picture>

max_width not working

I'm using this (HAML syntax):

ix_image_tag image, { w: 420, max_width: 540, auto: "format", fit: "crop", q: 70 }

And getting back this srcset:

<img max_width="540" srcset="https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=100 100w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=200 200w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=300 300w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=320 320w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=400 400w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=500 500w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=420 420w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=840 840w, https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=1260 1260w" sizes="100vw" src="https://host.imgix.net/uploads/post/266802f7-2fbd-44ab-9c38-d36dcaf819f1/Bill_Murray.jpg?ixlib=rails-2.1.4&amp;auto=format&amp;fit=max&amp;q=70&amp;w=420" alt="Bill murray.jpg?ixlib=rails 2.1">

And then the 1260w gets delivered. Is this expected behavior or am I doing something wrong? Trying to make the max width 540px.

extra srcset link generated causes issue on non-retina displays

After adding imgix-rails, we noticed that an extra srcset was being included at the very end of the generated srcset links causing non-retina displays to not handle the image properly. This additional srcset link does not include a fixed size attribute like all the others.

When the browser is viewed on a retina display, the correct srcset is used and all is well- but when the browser is loaded on a non-retina display this extra srcset is used by default and does not render as intended on the page.

Does anyone know the purpose of this extra srcset link that is generated after all the ones with defined sizes?

Here is the code from the imgix-rails gem that generates the srcset links. The extra link that is causing issues has been underlined.

screen shot 2018-11-19 at 2 43 19 pm

Here you can see the end of the srcset links that are generated, and the link pointed to by the arrow does not have a defined size like the others.

screen shot 2018-11-19 at 2 39 05 pm

Below are two profile cards, where the one with the image not displaying correctly is when the browser was on a non-retina display.
screen shot 2018-11-19 at 2 45 52 pm

Here the image shows correctly when viewed on a retina display.
screen shot 2018-11-19 at 2 46 21 pm

Locally, commenting out the line of code that generates the extra srcset resolves this issue and all images work perfectly on both retina and non-retina displays. If this additional srcset link is not needed and causing issues, could it be removed from the gem? Also I noticed that if you check out the images on imgix's actual website, they don't include this extra srcset.

Thanks so much for your help!

Imgix::Rails::UrlHelper

We'd like to use the ix_image_url in an Oat Serializer, and to do that successfully we have to include Imgix::Rails::ViewHelper in the serializer. That also allows using the tag-helpers in the serializer, which is not something we want.

If we made a PR that created an Imgix::Rails::UrlHelper that is fit for use in a serializer, would it be accepted into this gem? We would set it up so that the existing ViewHelper would call the new UrlHelper as a dependency.

Multiple secure_url_tokens when using multiple sources

I'm a little confused about some of the usage around having multiple sources.

First, how do I designate multiple secure_url_tokens when I have multiple sources. I see in the documentation that Source can be an array and so can hostnames_to_replace, but I don't see anything about secure_url_tokens. Looking at my Imgix sources, looks like the secure_url_token is different for each source.

Secondly, how do I specify on each individual ix_image_tag which source, hostname, and secure_url_token it should be using?

Thanks!

Getting static image instead of GIF

Hi there,
This issue isn't an emergency so considering the current COVID situation, please take your time to respond.

I am facing problem rendering GIF image, it works perfectly without any params as linked below.

original GIF — https://sideway.imgix.net/projects/covers/000/000/043/original/wp2757874.gif

GIF with params doesn't work — https://sideway.imgix.net/projects/covers/000/000/043/original/wp2757874.gif?ixlib=rails-
4.0.0&fit=crop&w=1024&dpr=2&q=50

code:
=ix_image_tag(@project.cover.path, url_params: { auto: 'format', fit: 'crop', w: 1024})

ix_picture_tag provides wrong ouput of v3

Hello all,

I think the output of the ix_picture_tag is not correct. I'm using v3.0.

We have used the following example code:

<%= ix_picture_tag('/016a447e-8631-423a-8659-1151ceff973d',
          tag_options: {class: 'media-thumbnail'},
          url_params: {w: 100, h: 100, crop: 'fit'},
          breakpoints: {
    '(max-width: 640px)' => {
      url_params: {
        h: 100,
      },
      tag_options: {
        sizes: 'calc(100vw - 20px)'
      }
    },
    '(max-width: 880px)' => {
      url_params: {
        crop: 'right',
      },
      tag_options: {
        sizes: 'calc(100vw - 20px - 50%)'
      }
    },
    '(min-width: 881px)' => {
      url_params: {
        crop: 'left',
      },
      tag_options: {
        sizes: '430px',
        class: 'media-thumbnail'
      },
    }
  }

I expected something it the sense of:

<picture>
  <source
   srcset="https://assets.imgix.net/blog/unsplash-kiss.jpg?w=1280"
   media="(min-width: 1280px)"
  >
  <source
    srcset="https://assets.imgix.net/blog/unsplash-kiss.jpg?w=768&h=1024&fit=crop"
    media="(min-width: 768px)"
  >
  <source
    srcset="https://assets.imgix.net/blog/unsplash-kiss.jpg?w=568&h=320&fit=crop"
    media="(min-width: 480px)"
  >
  <img src="https://assets.imgix.net/blog/unsplash-kiss.jpg?w=320&h=568&fit=crop">
</picture>

I copied this output of the example page, so It does not correspond with the actual expected output. The point is, I get this LONG list of html as ouput:

<picture class="media-thumbnail"><source sizes="calc(100vw - 20px)" media="(max-width: 640px)" srcset="https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=100&amp;h=100&amp;crop=fit 100w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=116&amp;h=116&amp;crop=fit 116w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=134&amp;h=134&amp;crop=fit 134w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=156&amp;h=156&amp;crop=fit 156w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=182&amp;h=182&amp;crop=fit 182w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=210&amp;h=210&amp;crop=fit 210w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=244&amp;h=244&amp;crop=fit 244w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=282&amp;h=282&amp;crop=fit 282w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=328&amp;h=328&amp;crop=fit 328w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=380&amp;h=380&amp;crop=fit 380w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=442&amp;h=442&amp;crop=fit 442w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=512&amp;h=512&amp;crop=fit 512w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=594&amp;h=594&amp;crop=fit 594w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=688&amp;h=688&amp;crop=fit 688w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=798&amp;h=798&amp;crop=fit 798w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=926&amp;h=926&amp;crop=fit 926w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1074&amp;h=1074&amp;crop=fit 1074w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1246&amp;h=1246&amp;crop=fit 1246w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1446&amp;h=1446&amp;crop=fit 1446w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1678&amp;h=1678&amp;crop=fit 1678w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1946&amp;h=1946&amp;crop=fit 1946w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=2258&amp;h=2258&amp;crop=fit 2258w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=2618&amp;h=2618&amp;crop=fit 2618w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=3038&amp;h=3038&amp;crop=fit 3038w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=3524&amp;h=3524&amp;crop=fit 3524w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=4088&amp;h=4088&amp;crop=fit 4088w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=4742&amp;h=4742&amp;crop=fit 4742w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=5500&amp;h=5500&amp;crop=fit 5500w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=6380&amp;h=6380&amp;crop=fit 6380w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=7400&amp;h=7400&amp;crop=fit 7400w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;crop=fit"></source><source sizes="calc(100vw - 20px - 50%)" media="(max-width: 880px)" srcset="https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=100&amp;h=100&amp;crop=right 100w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=116&amp;h=116&amp;crop=right 116w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=134&amp;h=134&amp;crop=right 134w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=156&amp;h=156&amp;crop=right 156w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=182&amp;h=182&amp;crop=right 182w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=210&amp;h=210&amp;crop=right 210w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=244&amp;h=244&amp;crop=right 244w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=282&amp;h=282&amp;crop=right 282w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=328&amp;h=328&amp;crop=right 328w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=380&amp;h=380&amp;crop=right 380w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=442&amp;h=442&amp;crop=right 442w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=512&amp;h=512&amp;crop=right 512w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=594&amp;h=594&amp;crop=right 594w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=688&amp;h=688&amp;crop=right 688w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=798&amp;h=798&amp;crop=right 798w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=926&amp;h=926&amp;crop=right 926w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1074&amp;h=1074&amp;crop=right 1074w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1246&amp;h=1246&amp;crop=right 1246w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1446&amp;h=1446&amp;crop=right 1446w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1678&amp;h=1678&amp;crop=right 1678w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1946&amp;h=1946&amp;crop=right 1946w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=2258&amp;h=2258&amp;crop=right 2258w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=2618&amp;h=2618&amp;crop=right 2618w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=3038&amp;h=3038&amp;crop=right 3038w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=3524&amp;h=3524&amp;crop=right 3524w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=4088&amp;h=4088&amp;crop=right 4088w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=4742&amp;h=4742&amp;crop=right 4742w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=5500&amp;h=5500&amp;crop=right 5500w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=6380&amp;h=6380&amp;crop=right 6380w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=7400&amp;h=7400&amp;crop=right 7400w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;crop=right"></source><source sizes="430px" class="media-thumbnail" media="(min-width: 881px)" srcset="https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=100&amp;h=100&amp;crop=left 100w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=116&amp;h=116&amp;crop=left 116w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=134&amp;h=134&amp;crop=left 134w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=156&amp;h=156&amp;crop=left 156w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=182&amp;h=182&amp;crop=left 182w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=210&amp;h=210&amp;crop=left 210w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=244&amp;h=244&amp;crop=left 244w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=282&amp;h=282&amp;crop=left 282w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=328&amp;h=328&amp;crop=left 328w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=380&amp;h=380&amp;crop=left 380w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=442&amp;h=442&amp;crop=left 442w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=512&amp;h=512&amp;crop=left 512w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=594&amp;h=594&amp;crop=left 594w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=688&amp;h=688&amp;crop=left 688w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=798&amp;h=798&amp;crop=left 798w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=926&amp;h=926&amp;crop=left 926w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1074&amp;h=1074&amp;crop=left 1074w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1246&amp;h=1246&amp;crop=left 1246w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1446&amp;h=1446&amp;crop=left 1446w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1678&amp;h=1678&amp;crop=left 1678w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=1946&amp;h=1946&amp;crop=left 1946w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=2258&amp;h=2258&amp;crop=left 2258w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=2618&amp;h=2618&amp;crop=left 2618w, https://CLIENT.imgix.net/016a447e-8631-423a-8659-1151ceff973d?ixlib=rails-3.0.0&amp;w=3038&amp;h=3038&amp;crop=left 3038w, https://CLIENT.imgix.net/016a44...

etc..

Each srcset including the <img> tag gets a huge output with all kinds of dimensions, not even corresponding the the srcset value. This cannot be right..

`ix_image_url` doesn't work with fingerprinted assets anymore

Describe the bug

Starting from v4.3 the helper UrlHelper#ix_umage_url doesn't work with fingerprinted assets anymore, actually it breaks them.

The previous behavior was not optimal, as the resulting URL was including 2 question marks, still it was working at least for us.

The new behavior completely breaks the image URL which results in 404s.

I understand that fingerprinting assets with a timestamp is not best-practice anymore, but I believe this to be still pretty common especially in the Rails world with Paperclip.

To Reproduce

Imgix::Rails::VERSION
=> "4.2.0"
include Imgix::Rails::UrlHelper
=> Object
ix_image_url("some/image.jpg?123123", {some: "query"})
=> "https://example.imgix.net/some/image.jpg?123123?some=query" # <- - 2 question marks

Imgix::Rails::VERSION
=> "4.3.0"
include Imgix::Rails::UrlHelper
=> Object
ix_image_url("some/image.jpg?123123", {some: "query"})
=> "https://example.imgix.net/some/image.jpg%3F123123?some=query" # first question mark gets url-encoded, thus breaking the image URL

Expected behaviour

The first question mark is not URL-encoded anymore.

Information:

  • @imgix/imgix-rails version: v4.3.0

Additional context

I also opened an issue on imgix-rb since the breaking change was introduced there, but may be considered legit in that context.

`widths` option is appended to the IMGIX url

Hi,

When specifying a widths option, it gets appended to the generated IMGIX url like so:

...?auto=format&fit=max&h=120&q=60&w=280&widths=%5B280%2C%20335%2C%20374%2C%20560%2C%20670%2C%20748%2C%20768%2C%201024%2C%201200%2C%201400%2C%201536%2C%201600%2C%201800%2C%202000%2C%202048%2C%202200%2C%202400%2C%202800%2C%203200%2C%203600%2C%204000%2C%204400%5D

And it's polluting the HTML:

screenshot

Any chance it can be removed?

Thanks!

Broken for Ruby < 2.1 due to required keyword arguments

The required keyword arguments in ix_picture_tag in view_helper.rb aren't supported in Ruby < 2.1.

It would be helpful for 3.2 and 4.2 apps running on older Rubies to swap these for hashes, although some additional work might be done if you want to throw errors in the case of a missing parameter here.

SemVer? Changelog?

Hi Imgix!

Saw that you recently released a new major version. Does this repo follow semver?

Do you have a changelog? What broke backwards compatibility in the new release?

It wasn't obvious from this: v2.1.4...v3.0.0

Imgix for background images (rails)

Hey,

The guys in Imgix support told me to come here so hoping someone might be able to help me with a rails questions. What's the easiest way to serve up CSS background images using Imgix? Or do I have to wait for this to be implemented: #10

Thanks!

Rob

Switching between dev (local filesystem) and production (aws s3)

Hey guys,

you removed the hostnames_to_replace config so i need to switch to relative paths of my images.
I am using it with Carrierwave and AWS S3 in production and local file system for local development.
What is you approach to switch between those things with imgix?

Greets and thanks :)

`widths` option is rendered in HTML

When specifying a :widths option to #ix_image_tag, that option gets carried through and rendered as an attribute in the resulting HTML. This results in something that looks like the following:

<img src="..." widths="250 500 750" />

Expected Result:

The widths attribute does not appear in the rendered HTML when specified as an option in #ix_image_tag.

Digest hash

Is there a way to add a digest hash with imgix-rails same as image_tag converts image_tag("image.jpg") to such as image-088ed3d6c28095c7dfecc21d1a70309e.jpg?

When given a fixed `w:` input value, generate appropriate `w` values for known DPRs

To better hit the 1x, 2x, etc. case while still strictly adhering to generating only w-style srcset rules, imgix-rails should be smarter about how it generates srcset rules.

This will come into play for things like fixed-width avatars that only need to be resolution-switched across different DPRs.

Developers should be able to write:

<%= ix_image_tag('/avatar.jpg', { w: 40, h: 40, sizes: "40px", max_width: 120 } %>

And have imgix-rails generate the following:

<img srcset="https://source.imgix.net/avatar.jpg?w=40&amp;h=40 40w,
             https://source.imgix.net/avatar.jpg?w=80&amp;h=80 80w,
             https://source.imgix.net/avatar.jpg?w=120&amp;h=120 120w"
     sizes="40px"
     src="https://source.imgix.net/avatar.jpg?w=40&amp;h=40 40w"
/>

See the conversation here for some context: https://imgix-community.slack.com/archives/general/p1464697975000282

Vulnerable to XSS attack

Using the following source:

<% source = '/foo"><script>alert("hacked")</script><' %>

Either of the following will result in an XSS attack:

<%= ix_image_tag source %>
<%= image_tag ix_image_url source %>

You can verify this by pasting the code into any Rails ERB template. The browser will show an alert dialog saying "hacked".

The source of the vulnerability is this line. html_safe is being called without verifying that the input is safe. Here's the documentation for html_safe.

Updating imgix-rb dependency to v4?

Question
Hi, are there plans to update the imgix-rb dependency to v4? That uses an updated version of the purge command, and I couldn't get the v3 purge functionality working.

ssrf external service interaction to malicious external source - security issue

Hi Imgix Team,

I have found security vulnerability issue w.r.t one application utilizing imgix framework

#Vulnerability description & attacker scenario:

External service interaction arises when it is possible to induce an application to interact with an arbitrary external service, such as a web or mail server. The ability to send requests to other systems can allow the vulnerable server to be used as an attack proxy. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. This may include public third-party systems, internal systems within the same organization, or services available on the local loopback adapter of the application server itself. Depending on the network architecture, this may expose highly vulnerable internal services that are not otherwise accessible to external attackers

Steps to Reproduce

  1. Create a listener instance for ssrf external interaction purpose
    Access the site in incognito mode https://webhook.site/ it will create a listener for ssrf interaction such as https://webhook.site/#!/{{some random id}}

2.Copy the url of listener https://webhook.site/#!/{{some random id}} from created listener

  1. Paste the listener url for ssrf https://webhook.site/#!/{{some random id}} to vulnerable parameter mark

https://images.pexels.com/photos/1168981/pexels-photo-1168981.jpeg?fit=&h=&mark=https://webhook.site/#!/{{some random id}}&markalign=&txt=&txtalign=&txtclr=&txtfont=&txtshad=&txtsize=&w=

4.Curl request that is generated from imgix application server
Curl request that is generated from imgix application server to webhook application listener this data is from interaction logs from webhook listener:

curl -X 'GET' 'https://webhook.site/9554d7ba-d76b-49f0-8fd9-ac1d480f4a77' -H 'connection: close' -H 'user-agent: imgix/2.0' -H 'accept-encoding: gzip' -H 'x-imgix-cache: MISS' -H 'x-imgix-hops: 1' -H 'x-imgix-id: 9d6c3a806cc8f1d43b714831abbc3d1617939d02' -H 'accept: /' -H 'host: webhook.site' -H 'content-length: ' -H 'content-type: '

You will see interaction in https://webhook.site/#!/ website

Proof of Concept - Steps to reproduce

  1. Access the effected url with ssrf interaction url injected in mark parameter in query string

ssrf 1

  1. Interaction happened with listener

ssrf2

Business Impact

The ability to send requests to other systems can allow the vulnerable server to be used as an attack proxy. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with. This may include public third-party systems, internal systems within the same organization, or services available on the local loopback adapter of the application server itself. Depending on the network architecture, this may expose highly vulnerable internal services that are not otherwise accessible to external attackers.

more details around vulnerability.
https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery

https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html

How to use inside a model?

Hello, I have to parse an html with some img tag in my model and I need to save in a callback the responsive images.
How can I call these helpers in my model?

Support Multiple Sources

We would like to serve images from multiple s3 buckets and our website simultaneously. Imgix allows us to configure multiple sources. It would be useful if this gem would make those multiple sources easy to use!

Ideally, I'd get a hash mapping hostnames to rewrite to the source to rewrite them to. Maybe something like this:

Rails.application.configure do
  config.imgix = {
    sources: {
      'assets.myapp.com' => 'myapp.imgix.net',
      'www.myapp.com' => 'myapp1.imgix.net',
      'assets2.myapp.com' => 'myapp2.imgix.net'
    }
  }
end

I'd be happy to work on this, if it is a feature that you would merge.

Rails gem version as a param in helper method URLs is rendered in resulting image's alt-tag

When using any of the IMGIX Rails gem helper methods (ix_image_tag, ix_picture_tag, ix_image_url) the resulting IMGIX URL(s) include the rails gem name and version as the first param. This subsequently is rendered in the image's alt-tag (Rails by default renders the image file name if you don't explicitly pass an alt: option in image_tag).

Example URL: example.imgix.net/bucket/file-name.jpg?ixlib=rails-2.1.1&w=300&h=300

Without the ixlib=rails param the alt-tag looks like: alt="file name"
With the ixlib=rails param the alt-tag looks like: alt="file name.jpg?ixlib=rails 2.1"

Would it be possible to remove the ixlib from the URL params, or pass it along in some other way so it doesn't interfere with Rails native alt-tagging abilities?

Ruby version: 2.3.1p112
Rails version: 5.0.0
IMGIX gem version: 2.1.1

imgix middleman support

I love all the helpers imgix provides in rails, but when I want to use imgix in middleman I have no idea how to get it to work.

Any suggestions?

data-srcset instead of srcset

Would it be possible to generate data-src & data-srcset etc. instead of the normal attributes? So it's easier to make it compatible with lazyloading libraries.

Incompatible with production Rails?

Hello,

ix_image_tag doesn't appear to pass the image path through ActionView's image_path, instead using it as is. This caused an issue for me when deploying to production because sprockets requires an auto-generated cache buster to be part of the path. So I was getting 404's until I wrapped the paths in image_path before passing them off to ix_image_tag.

Not sure if it's intentional or not, but adding that into the code or noting it in documentation would improve this library.

Best,
Blake

Option to designate format in the request

According to the imgix API documentation, you can get the exif data by utilizing the fm modifier. Unfortunately, that doesn't seem to be supported within imgix-rails. Adding the fm option would be helpful.

bundler restricted to version <2.0

imgix-rails.gemspec is pinning the version of bundler between 1.9 and 2.0, not inclusive. This will require anyone running version 2.0 (released at the beginning of the year) to downgrade in order to successfully build. The gemspec file should be modified to allow for newer versions of bundler.

spec.add_development_dependency "bundler", "~> 1.9"

Steps to reproduce:

$ git clone https://github.com/imgix/imgix-rails.git
...
$ cd imgix-rails/
$ bundler --version
Bundler version 2.0.1
$ bin/setup
Fetching gem metadata from https://rubygems.org/.........
Fetching gem metadata from https://rubygems.org/.
Resolving dependencies...
Bundler could not find compatible versions for gem "bundler":
  In Gemfile:
    bundler (~> 1.9)

  Current Bundler version:
    bundler (2.0.1)
This Gemfile requires a different version of Bundler.
Perhaps you need to update Bundler by running `gem install bundler`?

Could not find gem 'bundler (~> 1.9)' in any of the relevant sources:
  the local ruby installation

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.