diff options
| author | tarui <tarui@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2010-06-21 16:34:42 +0000 |
|---|---|---|
| committer | tarui <tarui@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2010-06-21 16:34:42 +0000 |
| commit | b808fcae8f9af5e4df622674e5692c6c416ac6d4 (patch) | |
| tree | 8f408ac5bc8f93eea9472106e2bca8b8880356cb /lib | |
| parent | 79aa744a5ecfd2d279fd7c749e1805d221708316 (diff) | |
merge from trunk (r28354)
* lib/webrick/httpservlet/filehandler.rb
(prevent_directory_traversal): apply filesystem encoding to path
only during calling File.expand_path. [ruby-dev:41423]
git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_2@28372 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/webrick/httpservlet/filehandler.rb | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/lib/webrick/httpservlet/filehandler.rb b/lib/webrick/httpservlet/filehandler.rb index 32c19651e7..daad8abd27 100644 --- a/lib/webrick/httpservlet/filehandler.rb +++ b/lib/webrick/httpservlet/filehandler.rb @@ -214,16 +214,20 @@ module WEBrick # character in URI notation. So the value of path_info should be # normalize before accessing to the filesystem. + # dirty hack for filesystem encoding; in nature, File.expand_path + # should not be used for path normalization. [Bug #3345] + path = req.path_info.dup.force_encoding(Encoding.find("filesystem")) if trailing_pathsep?(req.path_info) # File.expand_path removes the trailing path separator. # Adding a character is a workaround to save it. # File.expand_path("/aaa/") #=> "/aaa" # File.expand_path("/aaa/" + "x") #=> "/aaa/x" - expanded = File.expand_path(req.path_info + "x") + expanded = File.expand_path(path + "x") expanded.chop! # remove trailing "x" else - expanded = File.expand_path(req.path_info) + expanded = File.expand_path(path) end + expanded.force_encoding(req.path_info.encoding) req.path_info = expanded end |