{"record":{"id":"f31af1d5284ee5a7","repo":"carrierwaveuploader/carrierwave","slug":"errors-messages-content-type-allowlist-error","errorCode":null,"errorMessage":"errors.messages.content_type_allowlist_error","messagePattern":"errors\\.messages\\.content_type_allowlist_error","errorType":"exception","errorClass":"CarrierWave::IntegrityError","httpStatus":null,"severity":"error","filePath":"lib/carrierwave/uploader/content_type_allowlist.rb","lineNumber":48,"sourceCode":"      #\n      def content_type_allowlist\n      end\n\n    private\n\n      def check_content_type_allowlist!(new_file)\n        allowlist = content_type_allowlist\n        if !allowlist && respond_to?(:content_type_whitelist) && content_type_whitelist\n          CarrierWave.deprecator.warn \"#content_type_whitelist is deprecated, use #content_type_allowlist instead.\" unless instance_variable_defined?(:@content_type_whitelist_warned)\n          @content_type_whitelist_warned = true\n          allowlist = content_type_whitelist\n        end\n\n        return unless allowlist\n\n        content_type = new_file.content_type\n        if !allowlisted_content_type?(allowlist, content_type)\n          raise CarrierWave::IntegrityError, I18n.translate(:\"errors.messages.content_type_allowlist_error\", content_type: content_type,\n                                                            allowed_types: Array(allowlist).join(\", \"), default: :\"errors.messages.content_type_whitelist_error\")\n        end\n      end\n\n      def allowlisted_content_type?(allowlist, content_type)\n        Array(allowlist).any? do |item|\n          item = Regexp.quote(item) if item.class != Regexp\n          content_type =~ /\\A#{item}/\n        end\n      end\n\n    end # ContentTypeAllowlist\n  end # Uploader\nend # CarrierWave\n","sourceCodeStart":30,"sourceCodeEnd":63,"githubUrl":"https://github.com/carrierwaveuploader/carrierwave/blob/b5f0abe10ecf6500309fc83e0e8969cf57ba690e/lib/carrierwave/uploader/content_type_allowlist.rb#L30-L63","documentation":"Raised as CarrierWave::IntegrityError when check_content_type_allowlist! finds the uploaded file's content type is not matched by the uploader's content_type_allowlist. Matching is prefix-based (content_type =~ /\\A#{item}/), and the message comes from errors.messages.content_type_allowlist_error (with a fallback to the old whitelist key). It also honors a deprecated content_type_whitelist with a warning.","triggerScenarios":"Declaring content_type_allowlist ['image/jpeg'] (or a Proc/regexp) and uploading a PNG, WEBP, or a file sent as application/octet-stream; regexp entries must match from the string start, so a loose entry like 'jpeg' never matches 'image/jpeg'.","commonSituations":"Browsers or upload widgets sending generic application/octet-stream; new formats (webp/avif/heic) added to the product but not the list; prefix entries that are too narrow ('image/jpg' is not a real MIME type); formats where the OS/browser reports a variant type.","solutions":["Add every type you actually accept to the allowlist, e.g. %w(image/jpeg image/png image/webp) or the prefix 'image/' for all images","Rescue CarrierWave::IntegrityError at the assignment/save site and convert it into a model validation error","If types arrive as application/octet-stream, sniff real content with Marcel and set it before validation","Replace any old content_type_whitelist with content_type_allowlist to drop the deprecation warning"],"exampleFix":"# before\nclass ImageUploader < CarrierWave::Uploader::Base\n  def content_type_allowlist; ['image/jpeg']; end # png upload -> IntegrityError\nend\n\n# after\nclass ImageUploader < CarrierWave::Uploader::Base\n  def content_type_allowlist; %w(image/jpeg image/png image/webp); end\nend","handlingStrategy":"validation","validationCode":"ALLOWED = %w[image/jpeg image/png image/webp].freeze\n\nbefore_cache do |file|\n  type = file.content_type.to_s\n  unless ALLOWED.any? { |a| type.start_with?(a) }\n    raise CarrierWave::IntegrityError, I18n.t('errors.messages.content_type_allowlist_error')\n  end\nend","typeGuard":"def acceptable_content_type?(type)\n  ALLOWED.any? { |a| type.to_s.start_with?(a) }\nend","tryCatchPattern":"begin\n  record.image = params[:image]\n  record.save!\nrescue CarrierWave::IntegrityError\n  record.errors.add(:image, :content_type_not_allowed)\n  render :new\nend","preventionTips":["List every content type the product actually accepts — remember the allowlist matches by prefix, so 'image/' covers all images","Rescue CarrierWave::IntegrityError wherever files are assigned so rejections become form errors","Keep the allowlist and the client-side accept= attribute in sync"],"tags":["carrierwave","content-type","allowlist","validation","upload"],"backgroundTag":"content-type-rejected","analyzedSha":"b5f0abe10ecf6500309fc83e0e8969cf57ba690e","analyzedAt":"2026-08-21T18:07:27.715Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}