rails/rails — pull request #16888 by jejacks0n (2014-09-12 04:13:08+00:00)
Title: Changes default render behavior from file to template.

Currently as the default behavior of `render "foo/bar"` is to expand to `render file: "foo/bar"`.

That means that the file being looked up is not restricted to the view paths, or the rails root path, and can lead to potentially vulnerable leaks from the filesystem.

This pull request changes the default behavior to `render template: "foo/bar"` instead of `render file: "foo/bar"`, which is restricted to the view paths, as exposing a high level of access to the file system outside of rails views should potentially be explicitly opt-in and not the default.

This may result in a more secure system without having to know the low level underpinnings of the ActionView::Rendering implementation, and I'm submitting this to open a conversation about it. When I first came across this it appeared to be a security issue, and reached out to the security team before looking into it and realizing it was the behavior as designed.