Remote arbitrary file read/write via ImageMagick argument injection

Argument injection in the Dragonfly Ruby gem before 1.4.0 allows remote attackers to read and write arbitrary files through crafted URLs when verify_url is disabled. The generate and process features pass attacker-controlled job arguments into ImageMagick's convert command, allowing injected options such as file reads and writes. The attack is unauthenticated over the network when the affected URL handlers are exposed; arbitrary file access can enable code execution depending on writable paths and application configuration.