From 4fc6b25289fe83e4cede024d9fea83217bffdc7e Mon Sep 17 00:00:00 2001 From: gotoyuzo Date: Tue, 20 May 2008 16:35:25 +0000 Subject: * lib/webrick/httpservlet/filehandler.rb: should normalize path name in path_info to prevent script disclosure vulnerability on DOSISH filesystems. (fix: CVE-2008-1891) Note: NTFS/FAT filesystem should not be published by the platforms other than Windows. Pathname interpretation (including short filename) is less than perfect. * lib/webrick/httpservlet/abstract.rb (WEBrick::HTTPServlet::AbstracServlet#redirect_to_directory_uri): should escape the value of Location: header. * lib/webrick/httpservlet/cgi_runner.rb: accept interpreter command line arguments. git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_8_6@16495 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- lib/webrick/httpservlet/cgi_runner.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'lib/webrick/httpservlet/cgi_runner.rb') diff --git a/lib/webrick/httpservlet/cgi_runner.rb b/lib/webrick/httpservlet/cgi_runner.rb index 1069a68d58..006abd458e 100644 --- a/lib/webrick/httpservlet/cgi_runner.rb +++ b/lib/webrick/httpservlet/cgi_runner.rb @@ -39,7 +39,9 @@ dir = File::dirname(ENV["SCRIPT_FILENAME"]) Dir::chdir dir if interpreter = ARGV[0] - exec(interpreter, ENV["SCRIPT_FILENAME"]) + argv = ARGV.dup + argv << ENV["SCRIPT_FILENAME"] + exec(*argv) # NOTREACHED end exec ENV["SCRIPT_FILENAME"] -- cgit v1.2.3