← Extractions

Handling File Uploads for the Modern Developer — Janko Marohnić at wroclove.rb 2019

Janko Marohnić, creator of the Shrine file-attachment library, walks through best practices for file uploads in Ruby web applications: server-side metadata/MIME/dimension validation, image processing with libvips vs ImageMagick, on-the-fly vs on-upload processing, direct uploads to S3 via Uppy, and resumable uploads using S3 multipart or the tus protocol. Q&A covers signed URLs for DDoS protection, orphan-file handling with temporary storage, testing with MinIO, and the potential of imageflow.

Model

claude-opus-4-7

Ingestion

6641b3bc

Input tokens

432,182

fresh: 300,149
cached: 124,119
cache write: 7,914

Output tokens

19,008

Duration

293.2s

Roundtrips

Tool calls

Cost

$0.00

Nodes/edges extracted

38 / 66

Read set (nodes/edges)

96 / 2

Nodes (38)

create file (Unix command) tool

kind (empty) → tool

name (empty) → file (Unix command)

slug (empty) → file-unix-command

attrs (empty) → {"category" => "tool"}

description (empty) → The most popular UNIX tool for determining a file's type from its magic-bytes signature. The Shrine MIME-type plug-in...

short_description (empty) → UNIX command that identifies file type from magic bytes.

create Persist extracted metadata takeaway

kind (empty) → takeaway

name (empty) → Persist extracted metadata

slug (empty) → persist-extracted-metadata

attrs (empty) → {"type" => "recommendation"}

description (empty) → Any metadata you extract — common fields, dimensions, or custom per-type metadata like video duration — should be per...

short_description (empty) → Persist any extracted file metadata in the database for later retrieval.

create Magic bytes MIME detection concept

kind (empty) → concept

name (empty) → Magic bytes MIME detection

slug (empty) → magic-bytes-mime-detection

attrs (empty) → {"category" => "practice"}

description (empty) → Each file type has 'magic bytes' — a specific sequence of bytes at the beginning of the file that uniquely identifies...

short_description (empty) → Determining file type from a signature of bytes at the start of the file.

create Refile tool

kind (empty) → tool

name (empty) → Refile

slug (empty) → refile

attrs (empty) → {"category" => "library"}

description (empty) → Ruby file-attachment library released by the original author of CarrierWave. Attractive for its simplicity — it solve...

short_description (empty) → Ruby file-attachment library by CarrierWave's original author.

create imageflow project

kind (empty) → project

name (empty) → imageflow

slug (empty) → imageflow

attrs (empty) → {"status" => "active", "license" => "open-source"}

description (empty) → Image-processing project designed from a security-first perspective (in contrast to ImageMagick's security history an...

short_description (empty) → Security-first image processing library without Ruby bindings yet.

update Janko Marohnic person

attrs (empty) → {"role" => "Ruby on Rails developer", "country" => "Croatia"}

description Conference speaker. → Ruby on Rails developer from Croatia. Creator of the Shrine file-attachment library, previously a core maintainer of ...

short_description Conference speaker. → Ruby/Rails developer from Croatia, creator of the Shrine file-attachment library.

update Handling file uploads for modern developer talk

description Talk at wroclove.rb 2019. → wroclove.rb 2019 talk by Janko Marohnić sharing best practices for handling file uploads in web applications. Structu...

short_description Talk at wroclove.rb 2019. → Talk at wroclove.rb 2019 on best practices for file uploads in Ruby web apps.

create Shrine tool

kind (empty) → tool

name (empty) → Shrine

slug (empty) → shrine

attrs (empty) → {"category" => "library"}

description (empty) → Ruby file-attachment library created by Janko Marohnić after he forked from Refile. Design goals: work for any Ruby a...

short_description (empty) → Modular, framework-agnostic Ruby file-attachment library built on Rack.

create Paperclip tool

kind (empty) → tool

name (empty) → Paperclip

slug (empty) → paperclip

attrs (empty) → {"category" => "library"}

description (empty) → Ruby file-attachment library; first library Janko used. Keeps all file-uploading logic inside ActiveRecord models, wh...

short_description (empty) → Legacy Ruby file attachment library tied to ActiveRecord models.

create CarrierWave tool

kind (empty) → tool

name (empty) → CarrierWave

slug (empty) → carrierwave

attrs (empty) → {"category" => "library"}

description (empty) → Ruby file-attachment library that lets users move file-uploading logic into dedicated uploader classes outside of the...

short_description (empty) → Ruby file-attachment library using external uploader classes.

create image_processing gem tool

kind (empty) → tool

name (empty) → image_processing gem

slug (empty) → image_processing-gem

attrs (empty) → {"category" => "library"}

description (empty) → Ruby gem created by Janko Marohnić offering a functional image-processing API (source image in → processed file out)....

short_description (empty) → Functional Ruby gem for image processing with ImageMagick and libvips backends.

create ImageMagick tool

kind (empty) → tool

name (empty) → ImageMagick

slug (empty) → imagemagick

attrs (empty) → {"category" => "library"}

description (empty) → De-facto command-line image processing tool. Historically the default backend for Ruby image processing via the mini_...

short_description (empty) → Widely used image-manipulation command-line tool and library.

create libvips tool

kind (empty) → tool

name (empty) → libvips

slug (empty) → libvips

attrs (empty) → {"category" => "library"}

description (empty) → Image processing library (pronounced 'vips' or 'lib vips') that is often much faster than ImageMagick — 3–5× faster i...

short_description (empty) → High-performance image processing library with a narrower format scope.

create mini_magick tool

kind (empty) → tool

name (empty) → mini_magick

slug (empty) → mini_magick

attrs (empty) → {"category" => "library"}

description (empty) → Ruby wrapper over ImageMagick used as a backend in the image_processing gem.

short_description (empty) → Ruby wrapper around the ImageMagick command-line tool.

create Uppy tool

kind (empty) → tool

name (empty) → Uppy

slug (empty) → uppy

attrs (empty) → {"category" => "library"}

description (empty) → Modern, modular JavaScript file-upload library recommended by Janko regardless of backend. Ships built-in UI componen...

short_description (empty) → Modular modern JavaScript library for browser file uploads.

create tus protocol concept

kind (empty) → concept

name (empty) → tus protocol

slug (empty) → tus-protocol

attrs (empty) → {"category" => "protocol"}

description (empty) → Open protocol (tus.io) for resumable file uploads, created by the same team as Uppy. Despite sounding intimidating, i...

short_description (empty) → Open HTTP-based protocol for resumable file uploads.

create Transloadit company

kind (empty) → company

name (empty) → Transloadit

slug (empty) → transloadit

attrs (empty) → {"industry" => "file processing / uploads"}

description (empty) → Company that created both the Uppy JavaScript file-upload library and the tus.io resumable-upload HTTP protocol.

short_description (empty) → Company behind Uppy and the tus resumable-upload protocol.

create Amazon S3 tool

kind (empty) → tool

name (empty) → Amazon S3

slug (empty) → amazon-s3

attrs (empty) → {"category" => "service"}

description (empty) → Amazon Web Services object-storage service used as the typical cloud target for user file uploads. Supports direct br...

short_description (empty) → AWS object storage service commonly used for user uploads.

create MinIO tool

kind (empty) → tool

name (empty) → MinIO

slug (empty) → minio

attrs (empty) → {"category" => "service"}

description (empty) → Open-source tool that implements the Amazon S3 API over local storage. Recommended for testing file-upload code: poin...

short_description (empty) → Open-source, S3-compatible object storage server, useful for tests.

create Rack tool

kind (empty) → tool

name (empty) → Rack

slug (empty) → rack

attrs (empty) → {"category" => "library"}

description (empty) → Low-level web-server interface that is the basis of all Ruby web frameworks. Shrine is built on Rack rather than Rail...

short_description (empty) → Common Ruby web-server interface underlying all major Ruby web frameworks.

create Image bomb concept

kind (empty) → concept

name (empty) → Image bomb

slug (empty) → image-bomb

attrs (empty) → {"category" => "security"}

description (empty) → Attack vector (introduced to Janko by Evil Martians) in which an attacker crafts an image file that is small in file ...

short_description (empty) → Small-in-bytes image with huge pixel dimensions, used to crash processors.

create Direct Upload to Cloud concept

kind (empty) → concept

name (empty) → Direct Upload to Cloud

slug (empty) → direct-upload-to-cloud

attrs (empty) → {"category" => "pattern"}

description (empty) → Upload flow in which the browser fetches upload parameters (derived from server-only credentials) from the applicatio...

short_description (empty) → Uploading files directly from the browser to a cloud storage service.

create On-the-fly Processing concept

kind (empty) → concept

name (empty) → On-the-fly Processing

slug (empty) → on-the-fly-processing

attrs (empty) → {"category" => "pattern"}

description (empty) → Pattern where processing (e.g. image resizing) happens when a derivative URL is requested for the first time, then th...

short_description (empty) → Generating processed file derivatives when a URL is first requested.

create On-Upload Processing concept

kind (empty) → concept

name (empty) → On-Upload Processing

slug (empty) → on-upload-processing

attrs (empty) → {"category" => "pattern"}

description (empty) → Pattern where processing runs when the file is uploaded/attached, producing a collection of derivative files that are...

short_description (empty) → Running processing synchronously/asynchronously when a file is attached.

create Resumable Uploads concept

kind (empty) → concept

name (empty) → Resumable Uploads

slug (empty) → resumable-uploads

attrs (empty) → {"category" => "pattern"}

description (empty) → Technique that avoids restarting large uploads from scratch when a single HTTP request fails. The file is split into ...

short_description (empty) → Uploads split into chunks so interruptions don't restart from zero.

create Orphan Files concept

kind (empty) → concept

name (empty) → Orphan Files

slug (empty) → orphan-files

attrs (empty) → {"category" => "pattern"}

description (empty) → Files that a user uploaded but that never got attached to a persistent record — e.g. because the user abandoned the f...

short_description (empty) → Uploaded files that are never attached to any record.

create Signed On-the-fly URLs takeaway

kind (empty) → takeaway

name (empty) → Signed On-the-fly URLs

slug (empty) → signed-on-the-fly-urls

attrs (empty) → {"type" => "recommendation"}

description (empty) → To defend against attackers requesting many variants of the same file to overload on-the-fly processing, the server s...

short_description (empty) → Sign processing URLs with a server-only secret to prevent DDoS.

create Validate MIME type from file content takeaway

kind (empty) → takeaway

name (empty) → Validate MIME type from file content

slug (empty) → validate-mime-type-from-file-content

attrs (empty) → {"type" => "recommendation"}

description (empty) → The Content-Type header sent by the browser is derived from the file extension and can be spoofed. Validate MIME type...

short_description (empty) → Use magic bytes, not the Content-Type header, to validate uploaded MIME types.

create Validate image dimensions to prevent image bombs takeaway

kind (empty) → takeaway

name (empty) → Validate image dimensions to prevent image bombs

slug (empty) → validate-image-dimensions-to-prevent-image-bombs

attrs (empty) → {"type" => "recommendation"}

description (empty) → Validating only file size is insufficient: an attacker can craft an image that is tiny on disk but huge in pixels (an...

short_description (empty) → Validate dimensions (not just file size) to defeat image-bomb attacks.

create Prefer libvips over ImageMagick takeaway

kind (empty) → takeaway

name (empty) → Prefer libvips over ImageMagick

slug (empty) → prefer-libvips-over-imagemagick

attrs (empty) → {"type" => "recommendation"}

description (empty) → Benchmarks of 500×500 thumbnail generation show libvips is 3–5× faster than ImageMagick depending on source size, whi...

short_description (empty) → libvips is typically 3–5× faster than ImageMagick for web image processing.

create Use Uppy regardless of backend takeaway

kind (empty) → takeaway

name (empty) → Use Uppy regardless of backend

slug (empty) → use-uppy-regardless-of-backend

attrs (empty) → {"type" => "recommendation"}

description (empty) → Recommended even if you are not using Shrine: Uppy provides built-in UI components, easy direct uploads to S3, multip...

short_description (empty) → Uppy gives you great UI and direct-to-S3 support out of the box — use it regardless of Ruby upload library.

create Use MinIO for S3 testing takeaway

kind (empty) → takeaway

name (empty) → Use MinIO for S3 testing

slug (empty) → use-minio-for-s3-testing

attrs (empty) → {"type" => "recommendation"}

description (empty) → Instead of replacing S3 with a different local storage in tests, run MinIO as a separate service and point the AWS SD...

short_description (empty) → Run MinIO locally so tests use the real S3 API against local storage.

create Use temporary storage to avoid orphan files takeaway

kind (empty) → takeaway

name (empty) → Use temporary storage to avoid orphan files

slug (empty) → use-temporary-storage-to-avoid-orphan-files

attrs (empty) → {"type" => "recommendation"}

description (empty) → Shrine requires a temporary storage (the 'cache' directory used by its upload endpoints) separate from permanent stor...

short_description (empty) → Use separate temporary + permanent storages, and auto-expire temp uploads.

create DDoS risk of on-the-fly processing question

kind (empty) → question

name (empty) → DDoS risk of on-the-fly processing

slug (empty) → ddos-risk-of-on-the-fly-processing

attrs (empty) → {"answer_summary" => "Sign derivative URLs with a server-only secret; CDN caches legitimate variants."}

description (empty) → Audience question: on-the-fly processing is nice because it doesn't load the server upfront, but seems prone to DDoS ...

short_description (empty) → How to defend on-the-fly processing from attackers requesting many variants.

create Orphan files from async uploads question

kind (empty) → question

name (empty) → Orphan files from async uploads

slug (empty) → orphan-files-from-async-uploads

attrs (empty) → {"answer_summary" => "Use temporary ('cache') storage with auto-expiration and separate permanent storage."}

description (empty) → Audience question: async uploads aren't transactional — a user can submit a huge file but never finish filling in met...

short_description (empty) → How to handle users who upload a file but never submit the form.

create Local storage for tests question

kind (empty) → question

name (empty) → Local storage for tests

slug (empty) → local-storage-for-tests

attrs (empty) → {"answer_summary" => "Run MinIO — an S3-compatible server — locally and point the SDK at it."}

description (empty) → Audience question: how to test uploads without hitting real S3 — ideally backed by local storage. Answer: run MinIO a...

short_description (empty) → How to substitute S3 for local storage during tests.

create Adding imageflow to image_processing gem question

kind (empty) → question

name (empty) → Adding imageflow to image_processing gem

slug (empty) → adding-imageflow-to-image_processing-gem

attrs (empty) → {"answer_summary" => "Yes, wants to add support but needs someone to write Ruby bindings first."}

description (empty) → Audience question: ImageMagick has a history of security vulnerabilities and libvips wasn't built with security in mi...

short_description (empty) → Will imageflow (security-first) be supported as a backend?

update Active Storage tool

description Rails 5.2 feature for managing image/file uploads. The talk recommends using it to generate multiple image output for... → Rails 5.2 feature for managing image/file uploads. The talk recommends using it to generate multiple image output for...

Edges (66)

update Janko Marohnic → authored → Handling file uploads for modern developer

context (empty) → Speaker of the wroclove.rb 2019 talk.

update Handling file uploads for modern developer → presented_at → wroclove.rb 2019

context (empty) → Delivered at wroclove.rb 2019.

create Janko Marohnic → works_on → Shrine

attrs (empty) → {"role" => "creator"}

context (empty) → Creator of the Shrine file-attachment library.

relation (empty) → works_on

source_node_id (empty) → e82a1b94-3739-416d-ac98-21837af1e1e0

target_node_id (empty) → 5444b3f9-97b9-43d8-8b17-416d0aca2bef

create Janko Marohnic → works_on → image_processing gem

attrs (empty) → {"role" => "creator"}

context (empty) → Created the image_processing gem to avoid another homegrown in-gem solution.

relation (empty) → works_on

source_node_id (empty) → e82a1b94-3739-416d-ac98-21837af1e1e0

target_node_id (empty) → b826040d-1049-42c8-a688-1d422943537b

create Janko Marohnic → works_on → Refile

attrs (empty) → {"role" => "former core maintainer"}

context (empty) → Was accepted as a core maintainer of Refile before forking off to build Shrine.

relation (empty) → works_on

source_node_id (empty) → e82a1b94-3739-416d-ac98-21837af1e1e0

target_node_id (empty) → a6722382-f5e1-4649-b3cc-3de24fcfd760

create Janko Marohnic → uses → Paperclip

context (empty) → First file-attachment library he used before switching away.

relation (empty) → uses

source_node_id (empty) → e82a1b94-3739-416d-ac98-21837af1e1e0

target_node_id (empty) → 0beca60d-2b1e-4b91-af46-62bbefeae00e

create Janko Marohnic → uses → CarrierWave

context (empty) → Switched to CarrierWave from Paperclip to move upload logic out of the model.

relation (empty) → uses

source_node_id (empty) → e82a1b94-3739-416d-ac98-21837af1e1e0

target_node_id (empty) → e67c4ddf-6686-464e-a1f7-e6eb5823e969

create Handling file uploads for modern developer → about → Shrine

context (empty) → The talk centers on file-upload best practices as implemented in Shrine.

relation (empty) → about