Security and User File Uploads and Downloads

Security Issues with User File Upload and Downloads

Need to ensure that:

• users can access only the particular file(s) (No one can access a file they shouldn't)
• URL to access a file cannot be guessed (ex: thru automation)

We should consider like this:

• Deliver Paperclip Attachments to Authorized Users Only
  • don't store files under public That way files can only be accessed by Rails: Users cannot access that part of the file system; Rails has to serve up the files to them
  • to the users (== in the URL), the file paths (path + name) are some weird randomized string. That way users (or automated bots) cannot 'guess' the file structure and try to get to them. Rails accomplishes this by turning file paths into a hashed string using something like Digest::MD5.hexdigest

Other References:

• more generally: Common mistakes when storing file uploads with Rails: #2 Publishing confidential files to the whole Internet

• generally, not using Paperclip: Brakeman: Fixing File Vulnerabilities in Ruby and Rails