diff options
author | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-12-14 13:36:50 +0000 |
---|---|---|
committer | usa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-12-14 13:36:50 +0000 |
commit | ccbe964c1f5ecb54a21473bd27f255ee12120fdf (patch) | |
tree | cf9d33240e7ac2874f713d946e01d18b260917e8 | |
parent | 1beda2970b1c17daf34c15a1ee1c551b29080bdd (diff) |
merge revision(s) 61197: [Backport #14184]
webrick: compile RE correctly for beginning and end match
Using ^ and $ in regexps means we can accidentally get fooled
by "%0a" in HTTP request paths being decoded to newline
characters. Use \A and \z to match beginning and end-of-string
respectively, instead.
Thanks to mame and hsbt for reporting.
* lib/webrick/httpserver.rb (MountTable#compile):
use \A and \z instead of ^ and $
* lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $
* test/webrick/test_httpserver.rb (test_cntrl_in_path): new test
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@61241 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
-rw-r--r-- | ChangeLog | 16 | ||||
-rw-r--r-- | lib/webrick/httpserver.rb | 4 | ||||
-rw-r--r-- | test/webrick/test_httpserver.rb | 25 | ||||
-rw-r--r-- | version.h | 2 |
4 files changed, 44 insertions, 3 deletions
@@ -1,3 +1,19 @@ +Thu Dec 14 22:35:19 2017 Eric Wong <normalperson@yhbt.net> + + webrick: compile RE correctly for beginning and end match + + Using ^ and $ in regexps means we can accidentally get fooled + by "%0a" in HTTP request paths being decoded to newline + characters. Use \A and \z to match beginning and end-of-string + respectively, instead. + + Thanks to mame and hsbt for reporting. + + * lib/webrick/httpserver.rb (MountTable#compile): + use \A and \z instead of ^ and $ + * lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $ + * test/webrick/test_httpserver.rb (test_cntrl_in_path): new test + Thu Dec 14 22:29:04 2017 Eric Wong <normalperson@yhbt.net> webrick: do not hang acceptor on slow TLS connections diff --git a/lib/webrick/httpserver.rb b/lib/webrick/httpserver.rb index b27f2311bd..e46b3bd1ad 100644 --- a/lib/webrick/httpserver.rb +++ b/lib/webrick/httpserver.rb @@ -267,12 +267,12 @@ module WEBrick k.sort! k.reverse! k.collect!{|path| Regexp.escape(path) } - @scanner = Regexp.new("^(" + k.join("|") +")(?=/|$)") + @scanner = Regexp.new("\\A(" + k.join("|") +")(?=/|\\z)") end def normalize(dir) ret = dir ? dir.dup : "" - ret.sub!(%r|/+$|, "") + ret.sub!(%r|/+\z|, "") ret end end diff --git a/test/webrick/test_httpserver.rb b/test/webrick/test_httpserver.rb index 5adf617fa5..a9b5bcc351 100644 --- a/test/webrick/test_httpserver.rb +++ b/test/webrick/test_httpserver.rb @@ -410,4 +410,29 @@ class TestWEBrickHTTPServer < Test::Unit::TestCase } assert_equal(0, requested, "Server responded to #{requested} requests after shutdown") end + + def test_cntrl_in_path + log_ary = [] + access_log_ary = [] + config = { + :Port => 0, + :BindAddress => '127.0.0.1', + :Logger => WEBrick::Log.new(log_ary, WEBrick::BasicLog::WARN), + :AccessLog => [[access_log_ary, '']], + } + s = WEBrick::HTTPServer.new(config) + s.mount('/foo', WEBrick::HTTPServlet::FileHandler, __FILE__) + th = Thread.new { s.start } + addr = s.listeners[0].addr + + http = Net::HTTP.new(addr[3], addr[1]) + req = Net::HTTP::Get.new('/notexist%0a/foo') + http.request(req) { |res| assert_equal('404', res.code) } + exp = %Q(ERROR `/notexist\\n/foo' not found.\n) + assert_equal 1, log_ary.size + assert log_ary[0].include?(exp) + ensure + s&.shutdown + th&.join + end end @@ -1,6 +1,6 @@ #define RUBY_VERSION "2.3.6" #define RUBY_RELEASE_DATE "2017-12-14" -#define RUBY_PATCHLEVEL 381 +#define RUBY_PATCHLEVEL 382 #define RUBY_RELEASE_YEAR 2017 #define RUBY_RELEASE_MONTH 12 |