3 ms·
The technical analysis (from the article), complete with a step by step trace walkthrough, is here: https://chybeta.github.io/2019/03/16/Analysis-for%E3%80%90C
by archgoon 8y ago
The technical analysis (from the article), complete with a step by step trace walkthrough, is here:
https://chybeta.github.io/2019/03/16/Analysis-for%E3%80%90CVE-2019-5418%E3%80%91File-Content-Disclosure-on-Rails/ https://chybeta.github.io/2019/03/16/Analysis-for%E3%80%90CV...
Also, if interested, direct link to patch fix:
https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f00af0c7fd632e26715 https://github.com/rails/rails/commit/f4c70c2222180b8d9d924f...
- anitil 8y agoThanks for that, I was missing the step that assets are named $filename.$mime-type.erb in Rails. I was missing the high-level view