I am performing White Box testing on Rails application with static code analyzing tools like brakeman, I came across an instance where the developer is loading images using file.open.
file = File.open("#{Rails.root}/app/assets/path/image.jpg")
Due to my limited knowledge in rails, I am wondering if that's vulnerable to LFI Issue or not. According to my knowledge if we use File.open([:path])
user-defined parameter then it will be vulnerable to LFI. But have confusion in case of rails.root.
Thanks