SECURITY: Add FinalDestination::FastImage that's SSRF safe

lib/cooked_processor_mixin.rb

@@ -193,7 +193,7 @@ module CookedProcessorMixin
     if upload && upload.width && upload.width > 0
       @size_cache[url] = [upload.width, upload.height]
     else
-      @size_cache[url] = FastImage.size(absolute_url)
+      @size_cache[url] = FinalDestination::FastImage.size(absolute_url)
     end
   rescue Zlib::BufError, URI::Error, OpenSSL::SSL::SSLError
     # FastImage.size raises BufError for some gifs, leave it.

lib/final_destination/fast_image.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class FinalDestination::FastImage < ::FastImage
+  def initialize(url, options = {})
+    uri = URI(normalized_url(url))
+    options.merge!(http_header: { "Host" => uri.hostname })
+    uri.hostname = resolved_ip(uri)
+
+    super(uri.to_s, options)
+  rescue FinalDestination::SSRFDetector::DisallowedIpError, SocketError, Timeout::Error
+    super("")
+  end
+
+  private
+
+  def resolved_ip(uri)
+    FinalDestination::SSRFDetector.lookup_and_filter_ips(uri.hostname).first
+  end
+
+  def normalized_url(uri)
+    UrlHelper.normalized_encode(uri)
+  end
+end