Merge pull request #1844 from Nyangawa/fix-file-validator

fix: enforce tempfile to be a Tempfile object

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 * Your contribution here.
 * [#1833](https://github.com/ruby-grape/grape/pull/1833): Allows to set the `ParamBuilder` globally - [@myxoh](https://github.com/myxoh).
+* [#1844](https://github.com/ruby-grape/grape/pull/1844): Fix: enforce `:tempfile` to be a `Tempfile` object in `File` validator - [@Nyangawa](https://github.com/Nyangawa).
 
 #### Fixes
 

lib/grape/validations/types/file.rb

@@ -19,7 +19,7 @@ def value_coerced?(value)
           # Rack::Request creates a Hash with filename,
           # content type and an IO object. Do a bit of basic
           # duck-typing.
-          value.is_a?(::Hash) && value.key?(:tempfile)
+          value.is_a?(::Hash) && value.key?(:tempfile) && value[:tempfile].is_a?(Tempfile)
         end
       end
     end

spec/grape/validations/validators/coerce_spec.rb

@@ -397,6 +397,10 @@ def self.parsed?(value)
         post '/upload', file: 'not a file'
         expect(last_response.status).to eq(400)
         expect(last_response.body).to eq('file is invalid')
+
+        post '/upload', file: { filename: 'fake file', tempfile: '/etc/passwd' }
+        expect(last_response.status).to eq(400)
+        expect(last_response.body).to eq('file is invalid')
       end
 
       it 'Nests integers' do