• Markus Koller's avatar
    Reject parameters that override upload fields · 7c324521
    Markus Koller authored
    When Workhorse intercepts file uploads, we store the files and send the
    information about the temporary file in new multipart form values called
    `file.path`, `file.size` etc.
    
    Since we're also copying all other multipart form values from the
    original client request, it was possible to override the values we
    set in Workhorse, causing Rails to e.g. load the uploaded file from
    an injected `file.path` parameter.
    
    To avoid this, we check if client parameters have the same name as any
    of our own added fields and reject the request.
    7c324521
uploads.go 2.03 KB