8c91bd76a5
Before this commit, Simple Form was calling `#send` in the form object to check whether the resulting object was an attachment. That made the library open to DOS, information disclousure and execution of unintended action attacks if a form was built with user input. ```erb <%= simple_form_for @user do |f| %> <%= f.label @user_supplied_string %> ... <% end %> ``` The solution is try to figure out if an input is of type file by checking for methods present in the most popular Ruby Gems for file uploads. The current supported Gems are: `activestorage`, `carrierwave`, `paperclip`, `shrine` and `refile`. The code is relying on public APIs so it should be fine for now. It would be nice to have a single API to perform this check, so we'll suggest one for those libraries. Co-Authored-By: Felipe Renan <feelipe.renan@gmail.com> |
||
|---|---|---|
| .. | ||
| action_view_extensions | ||
| components | ||
| form_builder | ||
| generators | ||
| inputs | ||
| support | ||
| simple_form_test.rb | ||
| test_helper.rb | ||