{"record":{"id":"49c8df5067ac130a","repo":"carrierwaveuploader/carrierwave","slug":"errors-messages-content-type-denylist-error","errorCode":null,"errorMessage":"errors.messages.content_type_denylist_error","messagePattern":"errors\\.messages\\.content_type_denylist_error","errorType":"exception","errorClass":"CarrierWave::IntegrityError","httpStatus":null,"severity":"error","filePath":"lib/carrierwave/uploader/content_type_denylist.rb","lineNumber":51,"sourceCode":"\n    private\n\n      def check_content_type_denylist!(new_file)\n        denylist = content_type_denylist\n        if !denylist && respond_to?(:content_type_blacklist) && content_type_blacklist\n          CarrierWave.deprecator.warn \"#content_type_blacklist is deprecated, use #content_type_denylist instead.\" unless instance_variable_defined?(:@content_type_blacklist_warned)\n          @content_type_blacklist_warned = true\n          denylist = content_type_blacklist\n        end\n\n        return unless denylist\n\n        CarrierWave.deprecator.warn \"Use of #content_type_denylist is deprecated for the security reason, use #content_type_allowlist instead to explicitly state what are safe to accept\" unless instance_variable_defined?(:@content_type_denylist_warned)\n        @content_type_denylist_warned = true\n\n        content_type = new_file.content_type\n        if denylisted_content_type?(denylist, content_type)\n          raise CarrierWave::IntegrityError, I18n.translate(:\"errors.messages.content_type_denylist_error\",\n                                                            content_type: content_type, default: :\"errors.messages.content_type_blacklist_error\")\n        end\n      end\n\n      def denylisted_content_type?(denylist, content_type)\n        Array(denylist).any? do |item|\n          item = Regexp.quote(item) if item.class != Regexp\n          content_type =~ /#{item}/\n        end\n      end\n\n    end # ContentTypeDenylist\n  end # Uploader\nend # CarrierWave\n","sourceCodeStart":33,"sourceCodeEnd":66,"githubUrl":"https://github.com/carrierwaveuploader/carrierwave/blob/b5f0abe10ecf6500309fc83e0e8969cf57ba690e/lib/carrierwave/uploader/content_type_denylist.rb#L33-L66","documentation":"Raised as CarrierWave::IntegrityError when check_content_type_denylist! finds the uploaded file's content type matches an entry in the deprecated content_type_denylist (matching is unanchored regex: content_type =~ /#{item}/). Note the method itself warns that denylisting is deprecated for security reasons and recommends content_type_allowlist; it also still honors the older content_type_blacklist with a warning.","triggerScenarios":"Declaring content_type_denylist ['text/html', 'application/php'] and uploading a file whose reported type matches any entry as a substring; or still defining content_type_blacklist from pre-migration code, which routes into the same check.","commonSituations":"Apps migrated from old whitelist/blacklist-named methods that kept the blacklist semantics; security reviews flagging that content types can be spoofed client-side, since denylisting trusts the browser-reported type.","solutions":["Replace content_type_denylist with an explicit content_type_allowlist of the types you actually accept","Rescue CarrierWave::IntegrityError and render a validation message instead of a 500","If you must temporarily keep the denylist, remember matching is substring-based — anchor regexes deliberately"],"exampleFix":"# before\nclass DocUploader < CarrierWave::Uploader::Base\n  def content_type_denylist; ['application/x-msdownload']; end # IntegrityError + deprecation\nend\n\n# after\nclass DocUploader < CarrierWave::Uploader::Base\n  def content_type_allowlist; %w(application/pdf image/png); end\nend","handlingStrategy":"validation","validationCode":"ALLOWED = %w[application/pdf image/png].freeze\n\ndef content_type_allowed?(type)\n  ALLOWED.any? { |a| type.to_s.start_with?(a) }\nend","typeGuard":"def content_type_allowed?(type)\n  ALLOWED.any? { |a| type.to_s.start_with?(a) }\nend","tryCatchPattern":"begin\n  record.doc = params[:doc]\n  record.save!\nrescue CarrierWave::IntegrityError\n  record.errors.add(:doc, :content_type_not_allowed)\n  render :new\nend","preventionTips":["Replace content_type_denylist/content_type_blacklist with an explicit content_type_allowlist — denylists trust spoofable client-reported types","Rescue CarrierWave::IntegrityError at the assignment site for friendly errors","Remember denylist entries match as unanchored regex substrings when writing any temporary entries"],"tags":["carrierwave","content-type","denylist","deprecation","validation","upload"],"backgroundTag":"content-type-rejected","analyzedSha":"b5f0abe10ecf6500309fc83e0e8969cf57ba690e","analyzedAt":"2026-08-21T18:07:27.715Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}