ActiveStorage direct upload fails to sign content-length header for S3 service
业务逻辑 / Client-Side Enforcement of Server-Side Security / #789579
该报告还没有中文解读。
原文摘录
摘自原文（2920 字符中的一小部分）
When a user makes a direct upload using ActiveStorage, the browser makes a request to the DirectUploadsController containing the direct_upload parameters filename, content_type, byte_size, and checksum. These are used to generate a presigned url that is then passed back to the browser, allowing the …
原文中的代码
def url_for_direct_upload(key, expires_in:, content_type:, content_length:, checksum:)
instrument :url, key: key do |payload|
generated_url = object_for(key).presigned_url :put, expires_in: expires_in.to_i,
content_type: content_type, content_length: content_length, …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Ruby on Rails 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @travispew · 版权归作者与 Ruby on Rails 所有