From 096db35abad5e9288b2563c29a98fcf7ebce7715 Mon Sep 17 00:00:00 2001 From: nagachika Date: Thu, 14 Dec 2017 13:14:12 +0000 Subject: merge revision(s) 61197: [Backport #14184] webrick: compile RE correctly for beginning and end match Using ^ and $ in regexps means we can accidentally get fooled by "%0a" in HTTP request paths being decoded to newline characters. Use \A and \z to match beginning and end-of-string respectively, instead. Thanks to mame and hsbt for reporting. * lib/webrick/httpserver.rb (MountTable#compile): use \A and \z instead of ^ and $ * lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $ * test/webrick/test_httpserver.rb (test_cntrl_in_path): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_4@61238 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- lib/webrick/httpserver.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/webrick/httpserver.rb b/lib/webrick/httpserver.rb index b27f2311bd..e46b3bd1ad 100644 --- a/lib/webrick/httpserver.rb +++ b/lib/webrick/httpserver.rb @@ -267,12 +267,12 @@ module WEBrick k.sort! k.reverse! k.collect!{|path| Regexp.escape(path) } - @scanner = Regexp.new("^(" + k.join("|") +")(?=/|$)") + @scanner = Regexp.new("\\A(" + k.join("|") +")(?=/|\\z)") end def normalize(dir) ret = dir ? dir.dup : "" - ret.sub!(%r|/+$|, "") + ret.sub!(%r|/+\z|, "") ret end end -- cgit v1.2.3