carrierwaveuploader/carrierwave · error · CarrierWave::IntegrityError

errors.messages.content_type_allowlist_error

Error message

errors.messages.content_type_allowlist_error

What it means

Raised as CarrierWave::IntegrityError when check_content_type_allowlist! finds the uploaded file's content type is not matched by the uploader's content_type_allowlist. Matching is prefix-based (content_type =~ /\A#{item}/), and the message comes from errors.messages.content_type_allowlist_error (with a fallback to the old whitelist key). It also honors a deprecated content_type_whitelist with a warning.

Source

Thrown at lib/carrierwave/uploader/content_type_allowlist.rb:48

      #
      def content_type_allowlist
      end

    private

      def check_content_type_allowlist!(new_file)
        allowlist = content_type_allowlist
        if !allowlist && respond_to?(:content_type_whitelist) && content_type_whitelist
          CarrierWave.deprecator.warn "#content_type_whitelist is deprecated, use #content_type_allowlist instead." unless instance_variable_defined?(:@content_type_whitelist_warned)
          @content_type_whitelist_warned = true
          allowlist = content_type_whitelist
        end

        return unless allowlist

        content_type = new_file.content_type
        if !allowlisted_content_type?(allowlist, content_type)
          raise CarrierWave::IntegrityError, I18n.translate(:"errors.messages.content_type_allowlist_error", content_type: content_type,
                                                            allowed_types: Array(allowlist).join(", "), default: :"errors.messages.content_type_whitelist_error")
        end
      end

      def allowlisted_content_type?(allowlist, content_type)
        Array(allowlist).any? do |item|
          item = Regexp.quote(item) if item.class != Regexp
          content_type =~ /\A#{item}/
        end
      end

    end # ContentTypeAllowlist
  end # Uploader
end # CarrierWave

View on GitHub (pinned to b5f0abe10e)

Solutions

1. Add every type you actually accept to the allowlist, e.g. %w(image/jpeg image/png image/webp) or the prefix 'image/' for all images
2. Rescue CarrierWave::IntegrityError at the assignment/save site and convert it into a model validation error
3. If types arrive as application/octet-stream, sniff real content with Marcel and set it before validation
4. Replace any old content_type_whitelist with content_type_allowlist to drop the deprecation warning

Example fix

# before
class ImageUploader < CarrierWave::Uploader::Base
  def content_type_allowlist; ['image/jpeg']; end # png upload -> IntegrityError
end

# after
class ImageUploader < CarrierWave::Uploader::Base
  def content_type_allowlist; %w(image/jpeg image/png image/webp); end
end

ALLOWED = %w[image/jpeg image/png image/webp].freeze

before_cache do |file|
  type = file.content_type.to_s
  unless ALLOWED.any? { |a| type.start_with?(a) }
    raise CarrierWave::IntegrityError, I18n.t('errors.messages.content_type_allowlist_error')
  end
end

def acceptable_content_type?(type)
  ALLOWED.any? { |a| type.to_s.start_with?(a) }
end

begin
  record.image = params[:image]
  record.save!
rescue CarrierWave::IntegrityError
  record.errors.add(:image, :content_type_not_allowed)
  render :new
end

When it happens

Trigger: Declaring content_type_allowlist ['image/jpeg'] (or a Proc/regexp) and uploading a PNG, WEBP, or a file sent as application/octet-stream; regexp entries must match from the string start, so a loose entry like 'jpeg' never matches 'image/jpeg'.

Common situations: Browsers or upload widgets sending generic application/octet-stream; new formats (webp/avif/heic) added to the product but not the list; prefix entries that are too narrow ('image/jpg' is not a real MIME type); formats where the OS/browser reports a variant type.

Related errors

• errors.messages.content_type_denylist_error
• errors.messages.min_width_error
• errors.messages.max_width_error
• errors.messages.min_height_error
• errors.messages.max_height_error

AI-assisted analysis of carrierwaveuploader/carrierwave@b5f0abe10e (2026-08-21). Data as JSON: /api/errors/f31af1d5284ee5a7. Report an issue: GitHub.