From f2d2dfe9ca4a50bc88a5c3ff8242433f82ea7e75 Mon Sep 17 00:00:00 2001
From: shyouhei <shyouhei@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Sun, 10 Jan 2010 10:30:06 +0000
Subject: merge revision(s) 26267: 	* lib/webrick/accesslog.rb : Escape
 needed. 	* lib/webrick/httpstatus.rb : ditto. 	*
 lib/webrick/httprequest.rb : ditto. 	* lib/webrick/httputils.rb : ditto.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_7@26268 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 lib/webrick/accesslog.rb | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

(limited to 'lib/webrick/accesslog.rb')

diff --git a/lib/webrick/accesslog.rb b/lib/webrick/accesslog.rb
index f97769545e..75a3a3e694 100644
--- a/lib/webrick/accesslog.rb
+++ b/lib/webrick/accesslog.rb
@@ -53,15 +53,23 @@ module WEBrick
          when ?e, ?i, ?n, ?o
            raise AccessLogError,
              "parameter is required for \"#{spec}\"" unless param
-           params[spec][param] || "-"
+           param = params[spec][param] ? escape(param) : "-"
          when ?t
            params[spec].strftime(param || CLF_TIME_FORMAT)
          when ?%
            "%"
          else
-           params[spec]
+           escape(params[spec].to_s)
          end
       }
     end
+
+    def escape(data)
+      if data.tainted?
+        data.gsub(/[[:cntrl:]\\]+/) {$&.dump[1...-1]}.untaint
+      else
+        data
+      end
+    end
   end
 end
-- 
cgit v1.2.3