Patch for CVE-2019-5418 where gem version upgrade in rails 4 is not possible due to compatibility issues. This file needs to be added as an initializer. Confirmed working on 4.1.x.

mime_types_patch.rb

require 'action_dispatch/http/mime_negotiation'
module ActionDispatch
  module Http
    module MimeNegotiation
      def formats
        @env["action_dispatch.request.formats"] ||=
          if parameters[:format]
            Array(Mime[parameters[:format]])
          elsif use_accept_header && valid_accept_header
            accepts
          elsif xhr?
            [Mime::JS]
          else
            [Mime::HTML]
          end.select do |format|
            format.symbol || format.ref == '*/*'
          end
      end
    end
  end
end