3 ms·
It requires a specific usage of `render` that is extremely rare. I've never seen it in a real application.
by mbell 8y ago
It requires a specific usage of `render` that is extremely rare. I've never seen it in a real application.
- tptacek 8y agoAll it requires is "render :file" without the optional format argument. We found it immediately in applications, and other people on our Slack found it in theirs as well (though not necessarily exploitable, situationally).
- mbell 8y agoI'm aware of the trigger, `render file:` is, in my experience, extremely rare. I can't recall ever wanting to render a template file located outside the application directory.