Usually when you upload the file into Rails application you get the IO object in params[:file]. This IO object is of type StringIO for files less than 10k size or Tempfile for larger files.

This is fine, but with recent Safari (3.0 beta or Webkit) you sometimes can get String in params[:file]. For example, for uploaded CSV files Safari will not send content-type. Rails runs its own parameter parser after CGI.rb. For uploaded files CGI.rb will create StringIO or Tempfile object. Normally, Rails parameter parser would keep it as is, however in the problematic case Rails parser gets confused, invokes IO#read on this object and ends up storing file contents as a String.

So if your application does not expect params[:file] to be String, you'd better fix it ;) Another options would be using Edge Rails which already has a fix committed or applying the patch below:

Index: actionpack/lib/action_controller/cgi_ext/cgi_methods.rb

--- actionpack/lib/action_controller/cgi_ext/cgi_methods.rb (revision 3589) +++ actionpack/lib/action_controller/cgi_ext/cgi_methods.rb (working copy) @@ -73,9 +73,7 @@ value.map { |v| get_typed_value(v) } else # Uploaded file provides content type and filename. - if value.respond_to?(:content_type) && - !value.content_type.blank? && - !value.original_filename.blank? + if value.respond_to?(:original_filename) && !value.original_filename.blank? unless value.respond_to?(:full_original_filename) class << value alias_method :full_original_filename, :original_filename