diff options
| author | mame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-09-14 11:16:23 +0000 |
|---|---|---|
| committer | mame <mame@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2017-09-14 11:16:23 +0000 |
| commit | 6617c41292b7d1e097abb8fdb0cab9ddd83c77e7 (patch) | |
| tree | 66ea01a46fb9b4dda48f5c367dfc0b1fb28d43c1 /lib/webrick/log.rb | |
| parent | 7df1e45bb6b4326da5c799dcf58d38f0a14362af (diff) | |
lib/webrick/log.rb: sanitize any type of logs
It had failed to sanitize some type of exception messages. Reported and
patched by Yusuke Endoh (mame) at https://hackerone.com/reports/223363
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@59897 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib/webrick/log.rb')
| -rw-r--r-- | lib/webrick/log.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/webrick/log.rb b/lib/webrick/log.rb index 7542d8f79a..41e907cd3b 100644 --- a/lib/webrick/log.rb +++ b/lib/webrick/log.rb @@ -118,10 +118,10 @@ module WEBrick # * Otherwise it will return +arg+.inspect. def format(arg) if arg.is_a?(Exception) - "#{arg.class}: #{arg.message}\n\t" << + "#{arg.class}: #{AccessLog.escape(arg.message)}\n\t" << arg.backtrace.join("\n\t") << "\n" elsif arg.respond_to?(:to_str) - arg.to_str + AccessLog.escape(arg.to_str) else arg.inspect end |