summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorusa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2017-09-14 11:37:47 +0000
committerusa <usa@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>2017-09-14 11:37:47 +0000
commit8a81d04d2588d9c7a898473b431a0dabcab39fbd (patch)
treeb70c1ce5b7060265233acedd249d5b848d7151ad /lib
parent4fdfb28e7d2e3eefc0df1e1d034fbfc932c0d2a1 (diff)
merge revision(s) 59897:
lib/webrick/log.rb: sanitize any type of logs It had failed to sanitize some type of exception messages. Reported and patched by Yusuke Endoh (mame) at https://hackerone.com/reports/223363 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_2@59902 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib')
-rw-r--r--lib/webrick/httpstatus.rb4
-rw-r--r--lib/webrick/log.rb4
2 files changed, 2 insertions, 6 deletions
diff --git a/lib/webrick/httpstatus.rb b/lib/webrick/httpstatus.rb
index 7ffda64cf0..5dc136f88f 100644
--- a/lib/webrick/httpstatus.rb
+++ b/lib/webrick/httpstatus.rb
@@ -22,10 +22,6 @@ module WEBrick
##
# Root of the HTTP status class hierarchy
class Status < StandardError
- def initialize(*args) # :nodoc:
- args[0] = AccessLog.escape(args[0]) unless args.empty?
- super(*args)
- end
class << self
attr_reader :code, :reason_phrase # :nodoc:
end
diff --git a/lib/webrick/log.rb b/lib/webrick/log.rb
index 41cde4a740..4f069ac0c5 100644
--- a/lib/webrick/log.rb
+++ b/lib/webrick/log.rb
@@ -117,10 +117,10 @@ module WEBrick
# * Otherwise it will return +arg+.inspect.
def format(arg)
if arg.is_a?(Exception)
- "#{arg.class}: #{arg.message}\n\t" <<
+ "#{arg.class}: #{AccessLog.escape(arg.message)}\n\t" <<
arg.backtrace.join("\n\t") << "\n"
elsif arg.respond_to?(:to_str)
- arg.to_str
+ AccessLog.escape(arg.to_str)
else
arg.inspect
end