Skip to content

Remove UploadedFile path prefix validation

Jacob Vosmaer requested to merge jv-uploaded-file-remove-validation into master

What does this MR do and why?

The UploadedFile.from_params function contained a check that allow-listed the paths of files we were building handles for. Over time this has grown into a list of all possible directories where Workhorse may drop temporary files for Rails. Because the paths are now passed from Workhorse to Rails in signed messages, we do not really need this path check anymore.

This change removes the check because the signature check provides enough validation.

While we are here, also remove the legacy code in Workhorse that sends the parameters in unsigned form. These unsigned parameters are being ignored by Rails anyway.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Jacob Vosmaer

Merge request reports