Paperclip: Content Type Spoof trying to upload .gpx files

Question

Apologies if this has been answered and I failed to find it. Any direction would be greatly appreciated.

Using Rails 4.1.4, Paperclip 4.2.0 and Simple Form 3.0.2.

After Submit, I get has an extension that does not match its contents output in the form error message.

In the server window:

Started POST "/routes" for 127.0.0.1 at 2014-08-28 15:18:25 +0700
Processing by RoutesController#create as HTML
Parameters: {"utf8"=>"✓", "authenticity_token"=>"5BCHGBkwQH4mlnTVjy/PpD53mJKJpSmBXwXT/oul7yY=", "route"=>{"track_attributes"=>{"gpx"=>#<ActionDispatch::Http::UploadedFile:0x007fa89c9cd348 @tempfile=#<Tempfile:/var/folders/_g/6shs5yrj36n960wpt880ysl80000gn/T/RackMultipart20140828-42106-vi71nb>, @original_filename="Serge's tracks.gpx", @content_type="application/octet-stream", @headers="Content-Disposition: form-data; name=\"route[track_attributes][gpx]\"; filename=\"Serge's tracks.gpx\"\r\nContent-Type: application/octet-stream\r\n">}, "title"=>"Serge track", "description"=>"loop of hang dong", "distance"=>"", "total_ascent"=>""}, "commit"=>"Create Route"}
Command :: file -b --mime '/var/folders/_g/6shs5yrj36n960wpt880ysl80000gn/T/f55fe48e09c9cc3ee6c6271fe94f407520140828-42106-1hgpby7.gpx'
[paperclip] Content Type Spoof: Filename Serge's_tracks.gpx ([]), content type discovered from file command: application/xml. See documentation to allow this combination.
(0.3ms)  BEGIN
Command :: file -b --mime '/var/folders/_g/6shs5yrj36n960wpt880ysl80000gn/T/f55fe48e09c9cc3ee6c6271fe94f407520140828-42106-62bkvh.gpx'
[paperclip] Content Type Spoof: Filename Serge's_tracks.gpx ([]), content type discovered from file command: application/xml. See documentation to allow this combination.
(0.8ms)  ROLLBACK

I haven't been able to find said documentation in the Paperclip docs. Running file Serge\'s\ tracks.gpx --mime-type -b produces application/xml

My MVC looks like this:

class Track < ActiveRecord::Base
  belongs_to :route
  has_attached_file :gpx
  validates_attachment_content_type :gpx, :content_type => /application\/xml/
end

class Route < ActiveRecord::Base
  has_one :track, dependent: :destroy
  accepts_nested_attributes_for :track
  validates :title, presence: true
end

Inside RoutesController

def new
  @route       = Route.new
  @route.track = Track.new
end

def create
  @route = Route.new(route_params)
end

def route_params
  params.require(:route).permit(:title, :description, :distance, :total_ascent, track_attributes: [:gpx])
end

The simple_form:

= simple_form_for @route do |r|
  = r.simple_fields_for :track do |t|
    = t.input :gpx
  = r.input :title
  = r.input :description
  = r.input :distance
  = r.input :total_ascent
  = r.button :submit

Answer 1

As mentioned in this post: Paperclip gem spoofing error? and this article http://robots.thoughtbot.com/prevent-spoofing-with-paperclip, the problem was solved by apparently bypassing the command file -b --mime-type that is called by Paperclip.

To do this I created a paperclip.rb file in config/initializers.

Paperclip.options[:content_type_mappings] = {
  :gpx => 'application/xml'
}

While the problem is solved, I am still confused as to why the problem existed when the file command was returning a correct result, and also curious where the @content_type="application/octet-stream" in the params is coming from.