archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-09-17 01:23:57 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

merge from trunk (r28354)

Browse source 
* lib/webrick/httpservlet/filehandler.rb
	  (prevent_directory_traversal): apply filesystem encoding to path
	  only during calling File.expand_path.  [ruby-dev:41423]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_2@28372 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
tarui 2010-06-21 16:34:42 +00:00
parent 79aa744a5e
commit b808fcae8f
2 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
lib/webrick/httpservlet/filehandler.rb
View file

@ -214,16 +214,20 @@ module WEBrick
# character in URI notation. So the value of path_info should be
# normalize before accessing to the filesystem.
# dirty hack for filesystem encoding; in nature, File.expand_path
# should not be used for path normalization. [Bug #3345]
path = req.path_info.dup.force_encoding(Encoding.find("filesystem"))
if trailing_pathsep?(req.path_info)
# File.expand_path removes the trailing path separator.
# Adding a character is a workaround to save it.
# File.expand_path("/aaa/") #=> "/aaa"
# File.expand_path("/aaa/" + "x") #=> "/aaa/x"
expanded = File.expand_path(req.path_info + "x")
expanded = File.expand_path(path + "x")
expanded.chop! # remove trailing "x"
else
expanded = File.expand_path(req.path_info)
expanded = File.expand_path(path)
end
expanded.force_encoding(req.path_info.encoding)
req.path_info = expanded
end