FogBugz import attachment full SSRF requiring vulnerability in *.fogbugz.com

Hi Team, a bit of a odd one here. The FogBugz import code uses `CarrierWave::Uploader::Base:download!` to download attachments from fogbugz.com when importing a FogBugz repository. `CarrierWave::Uploader::Base:download!` ultimately uses `Kernel.Open` to download the provided attachment URL. …

   
WHITELIST = [
  /^[^.]+\.fogbugz.com$/
].freeze

...
    
def valid_url?(url)
  url && http?(url) && valid_domain?(url)
end

def http?(url)
  url =~ /\A#{URI::DEFAULT_PARSER.make_regexp(%w(http https))}\z/
end

def valid_domain?(url)
  host = URI.parse(url).host
  WHITELIST.any? { |entry| entry …