From 3896b48678145db3e831566f6c752acd3517dd90 Mon Sep 17 00:00:00 2001 From: usa Date: Thu, 14 Sep 2017 11:26:53 +0000 Subject: merge revision(s) 59897: lib/webrick/log.rb: sanitize any type of logs It had failed to sanitize some type of exception messages. Reported and patched by Yusuke Endoh (mame) at https://hackerone.com/reports/223363 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_3@59900 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- lib/webrick/httpstatus.rb | 4 ---- lib/webrick/log.rb | 4 ++-- 2 files changed, 2 insertions(+), 6 deletions(-) (limited to 'lib') diff --git a/lib/webrick/httpstatus.rb b/lib/webrick/httpstatus.rb index 8664da26d0..ff9f18203c 100644 --- a/lib/webrick/httpstatus.rb +++ b/lib/webrick/httpstatus.rb @@ -23,10 +23,6 @@ module WEBrick ## # Root of the HTTP status class hierarchy class Status < StandardError - def initialize(*args) # :nodoc: - args[0] = AccessLog.escape(args[0]) unless args.empty? - super(*args) - end class << self attr_reader :code, :reason_phrase # :nodoc: end diff --git a/lib/webrick/log.rb b/lib/webrick/log.rb index 7542d8f79a..41e907cd3b 100644 --- a/lib/webrick/log.rb +++ b/lib/webrick/log.rb @@ -118,10 +118,10 @@ module WEBrick # * Otherwise it will return +arg+.inspect. def format(arg) if arg.is_a?(Exception) - "#{arg.class}: #{arg.message}\n\t" << + "#{arg.class}: #{AccessLog.escape(arg.message)}\n\t" << arg.backtrace.join("\n\t") << "\n" elsif arg.respond_to?(:to_str) - arg.to_str + AccessLog.escape(arg.to_str) else arg.inspect end -- cgit v1.2.3