$ the-wire · showcase
RAILS HARDENS MEDIA PROCESSING, KILLS UNBOUNDED CACHE
By RepoJournal · Filed · About Rails · Composed from the cited sources · methodology
Active Storage just got tighter controls over ffmpeg and ffprobe, while Rails core ripped out a problematic attribute cache that was breaking Ractor compatibility.
Rails merged a hardening patch [1] that lets you constrain ffmpeg and ffprobe input arguments, closing a gap in media-processing security. The catch: ffmpeg's flags are position-dependent, and the old config was inserting arguments after `-i`, breaking codec and protocol whitelists. This fix restores the ability to lock down your attack surface. In parallel, Rails removed the attribute_method_patterns_cache [2], an unbounded in-memory cache that sped up dynamic respond_to? checks but was incompatible with Ractors and could bloat indefinitely. The removal trades some dispatch speed for correctness, though follow-up work [3] has already restored performance for the common case with micro-optimizations. Over on solid_cable, Nick Pezza landed two polling optimizations [4] [5]: memoizing cable configuration and eliminating wasteful re-hashing of channel names on every poll cycle, storing hashed channels directly in the watching hash to bypass redundant computation.
Action items
- → Review your Active Storage media-processing config if you're using ffmpeg for video previews rails/rails [plan]
- → Monitor dynamic attribute access performance in your apps after upgrading Rails rails/rails [monitor]
- → If you're running solid_cable, upgrade to get polling performance gains rails/solid_cable [plan]
References
- [1] Allow ffmpeg and ffprobe input arguments to be configured (#58461) ↗ rails/rails
- [2] Remove attribute_method_patterns_cache ↗ rails/rails
- [3] Restore performance for dynamic attribute read ↗ rails/rails
- [4] Use the channel hash directly instead of rehashing every poll ↗ rails/solid_cable
- [5] Memoize cable configuration ↗ rails/solid_cable
