fix(ssrf): close safe fetch tempfiles explicitly

2026-04-23 14:50:30 +05:30
parent 1838f07814
commit 45c4119c7d
9 changed files with 76 additions and 3 deletions
@@ -21,6 +21,8 @@ class Api::V1::Accounts::UploadController < Api::V1::Accounts::BaseController
  def create_from_url
    SafeFetch.fetch(params[:external_url].to_s) do |result|
      create_and_save_blob(result.tempfile, result.filename, result.content_type)
+    ensure
+      result.close!
    end
  rescue SafeFetch::HttpError => e
    render_error(I18n.t('errors.upload.fetch_failed_with_message', message: e.message), :unprocessable_entity)