{"record":{"id":"10e026cbd8ae29d7","repo":"heartcombo/simple_form","slug":"simple-form-simpleform-file-methods-is-deprecate","errorCode":null,"errorMessage":"[SIMPLE_FORM] SimpleForm.file_methods is deprecated and has no effect.\n\nSince version 5, Simple Form now supports automatically discover of file inputs for the following Gems: activestorage, carrierwave, paperclip, refile and shrine.\nIf you are using a custom method that is not from one of the supported Gems, please change your forms to pass the input type explicitly:\n\n    <%= form.input :avatar, as: :file %>\n\nSee http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676 for more information.","messagePattern":"\\[SIMPLE_FORM\\] SimpleForm\\.file_methods is deprecated and has no effect\\.\n\nSince version 5, Simple Form now supports automatically discover of file inputs for the following Gems: activestorage, carrierwave, paperclip, refile and shrine\\.\nIf you are using a custom method that is not from one of the supported Gems, please change your forms to pass the input type explicitly:\n\n    <%= form\\.input :avatar, as: :file %>\n\nSee http://blog\\.plataformatec\\.com\\.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676 for more information\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"lib/simple_form.rb","lineNumber":280,"sourceCode":"  end\n\n  def self.additional_classes_for(component)\n    generate_additional_classes_for.include?(component) ? yield : []\n  end\n\n  ## SETUP\n\n  def self.default_input_size=(*)\n    SimpleForm.deprecator.warn \"[SIMPLE_FORM] SimpleForm.default_input_size= is deprecated and has no effect\", caller\n  end\n\n  def self.form_class=(value)\n    SimpleForm.deprecator.warn \"[SIMPLE_FORM] SimpleForm.form_class= is deprecated and will be removed in 4.x. Use SimpleForm.default_form_class= instead\", caller\n    @@form_class = value\n  end\n\n  def self.file_methods=(file_methods)\n    SimpleForm.deprecator.warn(FILE_METHODS_DEPRECATION_WARN, caller)\n    @@file_methods = file_methods\n  end\n\n  def self.file_methods\n    SimpleForm.deprecator.warn(FILE_METHODS_DEPRECATION_WARN, caller)\n    @@file_methods\n  end\n\n  # Default way to setup Simple Form. Run rails generate simple_form:install\n  # to create a fresh initializer with all configuration values.\n  def self.setup\n    @@configured = true\n    yield self\n  end\n\n  # Includes a component to be used by Simple Form. Methods defined in a\n  # component will be exposed to be used in the wrapper as Simple::Components\n  #","sourceCodeStart":262,"sourceCodeEnd":298,"githubUrl":"https://github.com/heartcombo/simple_form/blob/18f38aad0bdeca2ba1815043b94d96fdbbe6a325/lib/simple_form.rb#L262-L298","documentation":"Before v5, SimpleForm.file_methods listed methods (avatar?, avatar_changed?) used to guess that an attribute should render as a file input. That guess enabled an HTML-injection vulnerability (CVE-2019-16676), so it was removed: file inputs are auto-detected only for activestorage, carrierwave, paperclip, refile and shrine. The setter now only emits this deprecation warning — the assigned value has no effect (lib/simple_form.rb:279-282).","triggerScenarios":"A pre-5.0 initializer containing config.file_methods = [/^.+(_cache|_changed|\\?)$/] running under simple_form 5+; application code or a gem assigning SimpleForm.file_methods = ... at boot.","commonSituations":"Upgrading an app from simple_form 3.x/4.x to 5+ without regenerating the initializer; copy-pasted initializer content from old blog posts; custom file-detection methods that silently stop working after the upgrade.","solutions":["Delete the config.file_methods = ... line from config/initializers/simple_form.rb","For attributes that were detected by custom methods, pass the type explicitly in the form: <%= form.input :avatar, as: :file %>","Regenerate the initializer with `rails generate simple_form:install` and diff against the old one to sweep every removed setting"],"exampleFix":"# before (config/initializers/simple_form.rb)\nconfig.file_methods = [/^.+(_cache|_changed|\\?)$/]\n\n# after\n# line deleted: file inputs are auto-detected for activestorage, carrierwave,\n# paperclip, refile and shrine. Custom detection becomes explicit:\n#   <%= form.input :avatar, as: :file %>","handlingStrategy":"fallback","validationCode":"# boot check for stale initializer keys\ninitializer = Rails.root.join('config/initializers/simple_form.rb')\nif File.exist?(initializer) && File.read(initializer) =~ /\\bfile_methods\\b/\n  Rails.logger.warn('simple_form: file_methods has no effect since v5 — pass `as: :file` explicitly')\nend","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Delete all file_methods lines from the initializer after upgrading to v5+","Mark non-standard file columns explicitly with as: :file at the call site","Regenerate the initializer after major upgrades and diff it against the old one","Grep for removed APIs (file_methods, default_input_size=, form_class=) as part of the upgrade checklist"],"tags":["simple-form","deprecation","file-methods","file-upload","cve"],"backgroundTag":"deprecated-config-no-op","analyzedSha":"18f38aad0bdeca2ba1815043b94d96fdbbe6a325","analyzedAt":"2026-08-21T18:23:08.988Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}