Update CarrierWave to 2.1.1 (#12714)

.travis.yml

@@ -84,7 +84,7 @@ jobs:
       script:
         - yarn test --colors
         - bundle exec rails db:create db:schema:load assets:precompile
-        - bundle exec bundle-audit check --update --ignore CVE-2015-9284 CVE-2021-21288 CVE-2021-21305
+        - bundle exec bundle-audit check --update --ignore CVE-2015-9284
         - bin/test-console-check
         - yarn build-storybook
         - bundle exec rake data_updates:run # required for at least creating the first admin user in e2e tests.

Gemfile.lock

@@ -164,13 +164,14 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    carrierwave (2.1.0)
+    carrierwave (2.1.1)
       activemodel (>= 5.0.0)
       activesupport (>= 5.0.0)
       addressable (~> 2.6)
       image_processing (~> 1.1)
       mimemagic (>= 0.3.0)
       mini_mime (>= 0.1.3)
+      ssrf_filter (~> 1.0)
     carrierwave-bombshelter (0.2.2)
       activesupport (>= 3.2.0)
       carrierwave
@@ -387,7 +388,7 @@ GEM
     httpclient (2.8.3)
     hypershield (0.2.2)
       activerecord (>= 5)
-    i18n (1.8.8)
+    i18n (1.8.9)
       concurrent-ruby (~> 1.0)
     ice_nine (0.11.2)
     image_processing (1.12.1)
@@ -744,6 +745,7 @@ GEM
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
+    ssrf_filter (1.0.7)
     staccato (0.5.3)
     stackprof (0.2.16)
     store_attribute (0.8.1)

spec/rails_helper.rb

@@ -101,6 +101,12 @@ RSpec.configure do |config|
   config.before do
     # Worker jobs shouldn't linger around between tests
     Sidekiq::Worker.clear_all
+    # Disable SSRF protection for CarrierWave specs
+    # See: https://github.com/carrierwaveuploader/carrierwave/issues/2531
+    # rubocop:disable Rspec/AnyInstance
+    allow_any_instance_of(CarrierWave::Downloader::Base)
+      .to receive(:skip_ssrf_protection?).and_return(true)
+    # rubocop:enable Rspec/AnyInstance
   end
 
   config.before(:each, stub_elasticsearch: true) do |_example|