* lib/webrick/httpservlet/filehandler.rb

  (prevent_directory_traversal): apply filesystem encoding to path
  only during calling File.expand_path.  [ruby-dev:41423]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@28354 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 6 insertions, 2 deletions

diff --git a/lib/webrick/httpservlet/filehandler.rb b/lib/webrick/httpservlet/filehandler.rb
index 32c19651e7..daad8abd27 100644
--- a/lib/webrick/httpservlet/filehandler.rb
+++ b/lib/webrick/httpservlet/filehandler.rb
@@ -214,16 +214,20 @@ module WEBrick
         # character in URI notation. So the value of path_info should be
         # normalize before accessing to the filesystem.
 
+        # dirty hack for filesystem encoding; in nature, File.expand_path
+        # should not be used for path normalization.  [Bug #3345]
+        path = req.path_info.dup.force_encoding(Encoding.find("filesystem"))
         if trailing_pathsep?(req.path_info)
           # File.expand_path removes the trailing path separator.
           # Adding a character is a workaround to save it.
           #  File.expand_path("/aaa/")        #=> "/aaa"
           #  File.expand_path("/aaa/" + "x")  #=> "/aaa/x"
-          expanded = File.expand_path(req.path_info + "x")
+          expanded = File.expand_path(path + "x")
           expanded.chop!  # remove trailing "x"
         else
-          expanded = File.expand_path(req.path_info)
+          expanded = File.expand_path(path)
         end
+        expanded.force_encoding(req.path_info.encoding)
         req.path_info = expanded
       end