Discovered 4 months ago
Source: static code analysis
Category: File Access
Confidence level: High

Problem

Parameter value used in file name

Location

app/controllers/theme_javascripts_controller.rb:34

send_file("#{"#{Rails.root}/tmp/javascript-cache"}/#{params[:digest]}.js", :disposition => :inline)

Category description: When user-supplied input can contain ".." or similar characters that are passed through to file access APIs, causing access to files outside of an intended subdirectory.

Solution: fix the issue in app/controllers/theme_javascripts_controller.rb or mark it as false positive.