Always reject files external to app

Previously, when using `render file:`, it was possible to render files
not only at an absolute path or relative to the current directory, but
relative to ANY view paths. This was probably done for absolutely
maximum compatibility when addressing CVE-2016-0752, but I think is
unlikely to be used in practice.

Tihs commit removes the ability to `render file:` with a path relative
to a non-fallback view path.

Make FallbackResolver.new private

To ensure nobody is making FallbackResolvers other than "/" and "".

Make reject_files_external_... no-op for fallbacks

Because there are only two values used for path: "" and "/", and
File.join("", "") == File.join("/", "") == "/", this method was only
testing that the absolute paths started at "/" (which of course all do).

This commit doesn't change any behaviour, but it makes it explicit that
the FallbackFileSystemResolver works this way.

Remove outside_app_allowed argument

Deprecate find_all_anywhere

This is now equivalent to find_all

Remove outside_app argument

Deprecate find_file for find

Both LookupContext#find_file and PathSet#find_file are now equivalent to
their respective #find methods.

1 files changed, 15 insertions, 14 deletions

diff --git a/actionview/lib/action_view/template/resolver.rb b/actionview/lib/action_view/template/resolver.rb
index 095e6cc3a1..d5cb3c823a 100644
--- a/actionview/lib/action_view/template/resolver.rb
+++ b/actionview/lib/action_view/template/resolver.rb
@@ -118,17 +118,12 @@ module ActionView
       locals = locals.map(&:to_s).sort!.freeze
 
       cached(key, [name, prefix, partial], details, locals) do
-        find_templates(name, prefix, partial, details, false, locals)
+        find_templates(name, prefix, partial, details, locals)
       end
     end
 
-    def find_all_anywhere(name, prefix, partial = false, details = {}, key = nil, locals = [])
-      locals = locals.map(&:to_s).sort!.freeze
-
-      cached(key, [name, prefix, partial], details, locals) do
-        find_templates(name, prefix, partial, details, true, locals)
-      end
-    end
+    alias :find_all_anywhere :find_all
+    deprecate :find_all_anywhere
 
     def find_all_with_query(query) # :nodoc:
       @cache.cache_query(query) { find_template_paths(File.join(@path, query)) }
@@ -141,8 +136,8 @@ module ActionView
     # This is what child classes implement. No defaults are needed
     # because Resolver guarantees that the arguments are present and
     # normalized.
-    def find_templates(name, prefix, partial, details, outside_app_allowed = false, locals = [])
-      raise NotImplementedError, "Subclasses must implement a find_templates(name, prefix, partial, details, outside_app_allowed = false, locals = []) method"
+    def find_templates(name, prefix, partial, details, locals = [])
+      raise NotImplementedError, "Subclasses must implement a find_templates(name, prefix, partial, details, locals = []) method"
     end
 
     # Handles templates caching. If a key is given and caching is on
@@ -179,14 +174,14 @@ module ActionView
 
     private
 
-      def find_templates(name, prefix, partial, details, outside_app_allowed = false, locals)
+      def find_templates(name, prefix, partial, details, locals)
         path = Path.build(name, prefix, partial)
-        query(path, details, details[:formats], outside_app_allowed, locals)
+        query(path, details, details[:formats], locals)
       end
 
-      def query(path, details, formats, outside_app_allowed, locals)
+      def query(path, details, formats, locals)
         template_paths = find_template_paths_from_details(path, details)
-        template_paths = reject_files_external_to_app(template_paths) unless outside_app_allowed
+        template_paths = reject_files_external_to_app(template_paths)
 
         template_paths.map do |template|
           build_template(template, path.virtual, locals)
@@ -360,6 +355,8 @@ module ActionView
   # The same as FileSystemResolver but does not allow templates to store
   # a virtual path since it is invalid for such resolvers.
   class FallbackFileSystemResolver < FileSystemResolver #:nodoc:
+    private_class_method :new
+
     def self.instances
       [new(""), new("/")]
     end
@@ -367,5 +364,9 @@ module ActionView
     def build_template(template, virtual_path, locals)
       super(template, nil, locals)
     end
+
+    def reject_files_external_to_app(files)
+      files
+    end
   end
 end