be9c272ce4
We're already using a custom controller to handle direct uploads. Besides, as mentioned by one of Active Storage co-authors [1], the Active Storage DirectUploadsController doesn't provide any authentication or validation at all, meaning anyone could create blobs in our database by posting to `/rails/active_storage/direct_uploads`. The response there could be then used to upload any file (again, without validation) to `/rails/active_storage/disk/`. For now, we're monkey-patching the controllers in order to send unauthorized responses, since we aren't using these routes. If we ever enable direct uploads with Active Storage, we'll have to add some sort of authentication. Similar upload solutions like CKEditor don't have this issue since their controllers inherit from `ApplicationController` (which includes authorization rules), while Active Storage controllers inherit from `ActionController::Base`. [1] https://discuss.rubyonrails.org/t/activestorage-direct-uploads-safe-by-default-how-to-make-it-safe/74863/2
15 lines
424 B
Ruby
15 lines
424 B
Ruby
require "rails_helper"
|
|
|
|
describe ActiveStorage::DirectUploadsController do
|
|
describe "POST create" do
|
|
it "doesn't allow anonymous users to upload files" do
|
|
blob_attributes = { filename: "logo.pdf", byte_size: 30000, checksum: SecureRandom.hex(32) }
|
|
|
|
post :create, params: { blob: blob_attributes }
|
|
|
|
expect(ActiveStorage::Blob.count).to eq 0
|
|
expect(response).to be_unauthorized
|
|
end
|
|
end
|
|
end
|