You can also capture sessions using .svg files.
You can prevent any sort of scripting using a Content-Security-Policy header.
When using send_file in a Rails controller, the { disposition: :attachment } option is a default.

Rails Long Term Support

Rails LTS provides security patches for old versions of Ruby on Rails (2.3, 3.2, 4.2 and 5.2)

Updated: Preventing users from uploading malicious content