archive/ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2025-09-18 01:54:00 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

merge from trunk (r28354)

Browse source 
* lib/webrick/httpservlet/filehandler.rb
	  (prevent_directory_traversal): apply filesystem encoding to path
	  only during calling File.expand_path.  [ruby-dev:41423]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_2@28372 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
tarui 2010-06-21 16:34:42 +00:00
parent 79aa744a5e
commit b808fcae8f
2 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
ChangeLog
View file

@ -1,3 +1,9 @@
Tue Jun 22 00:57:57 2010 Yusuke Endoh <mame@tsg.ne.jp>
* lib/webrick/httpservlet/filehandler.rb
(prevent_directory_traversal): apply filesystem encoding to path
only during calling File.expand_path. [ruby-dev:41423]
Mon Jun 21 23:41:08 2010 wanabe <s.wanabe@gmail.com> Mon Jun 21 23:41:08 2010 wanabe <s.wanabe@gmail.com>
* eval_error.c (error_print): clear raised_flag while error-printing * eval_error.c (error_print): clear raised_flag while error-printing

8
lib/webrick/httpservlet/filehandler.rb
View file

@ -214,16 +214,20 @@ module WEBrick
# character in URI notation. So the value of path_info should be # character in URI notation. So the value of path_info should be
# normalize before accessing to the filesystem. # normalize before accessing to the filesystem.
# dirty hack for filesystem encoding; in nature, File.expand_path
# should not be used for path normalization. [Bug #3345]
path = req.path_info.dup.force_encoding(Encoding.find("filesystem"))
if trailing_pathsep?(req.path_info) if trailing_pathsep?(req.path_info)
# File.expand_path removes the trailing path separator. # File.expand_path removes the trailing path separator.
# Adding a character is a workaround to save it. # Adding a character is a workaround to save it.
# File.expand_path("/aaa/") #=> "/aaa" # File.expand_path("/aaa/") #=> "/aaa"
# File.expand_path("/aaa/" + "x") #=> "/aaa/x" # File.expand_path("/aaa/" + "x") #=> "/aaa/x"
expanded = File.expand_path(req.path_info + "x") expanded = File.expand_path(path + "x")
expanded.chop! # remove trailing "x" expanded.chop! # remove trailing "x"
else else
expanded = File.expand_path(req.path_info) expanded = File.expand_path(path)
end end
expanded.force_encoding(req.path_info.encoding)
req.path_info = expanded req.path_info = expanded
end end