Fix uploading files with invalid byte sequences in their file names

Author: ahukkanen

app/controllers/decidim/apifiles/blobs_controller.rb

@@ -31,7 +31,7 @@ def create
 
         blob = ActiveStorage::Blob.create_and_upload!(
           io: uploaded_file,
-          filename: uploaded_file.original_filename,
+          filename: sanitized_filename,
           content_type: uploaded_file.content_type
         )
 
@@ -46,6 +46,22 @@ def uploaded_file
         @uploaded_file ||= params.require(:file)
       end
 
+      # In case the file name contains invalid byte sequences, they could not be
+      # stored in the database due to the following exception:
+      #   ActiveRecord::StatementInvalid:
+      #     PG::CharacterNotInRepertoire: ERROR:  invalid byte sequence for encoding "UTF8": 0xea 0x78 0xe4
+      #     CONTEXT:  unnamed portal parameter $2
+      #
+      # This replaces all invalid byte sequences before persisting the file to
+      # the database.
+      def sanitized_filename
+        @sanitized_filename || begin
+          name = uploaded_file.original_filename
+          name = name.scrub unless name.valid_encoding?
+          name
+        end
+      end
+
       def uploaded_file_extension
         @uploaded_file_extension ||= File.extname(uploaded_file.original_filename).strip.downcase[1..-1]
       end

spec/controllers/decidim/apifiles/blobs_controller_spec.rb

@@ -86,6 +86,24 @@
           expect(response.parsed_body).to eq({ "error" => "unallowed_content_type" })
         end
       end
+
+      context "with file name in Windows-1252 encoding" do
+        let(:file) do
+          Decidim::Dev.test_file("Exampledocument.pdf", "application/pdf").tap do |f|
+            # In case we stored a file with such name in the "fixtures" folder,
+            # this would not work because `rack-test` fails to generate the
+            # `Rack::Test::UploadedFile` due to the weird name. We need to force
+            # the name on the instance in order to replicate the bug with
+            # storing file names with this encoding. There is no other way to
+            # change the "original_filename" of the instance.
+            f.instance_variable_set(:@original_filename, "êxämplö®'.pdf".encode("WINDOWS-1252"))
+          end
+        end
+
+        it "allows uploading a file" do
+          expect(response).to have_http_status(:ok)
+        end
+      end
     end
   end
 end