From b808fcae8f9af5e4df622674e5692c6c416ac6d4 Mon Sep 17 00:00:00 2001 From: tarui Date: Mon, 21 Jun 2010 16:34:42 +0000 Subject: merge from trunk (r28354) * lib/webrick/httpservlet/filehandler.rb (prevent_directory_traversal): apply filesystem encoding to path only during calling File.expand_path. [ruby-dev:41423] git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_1_9_2@28372 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- lib/webrick/httpservlet/filehandler.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) (limited to 'lib') diff --git a/lib/webrick/httpservlet/filehandler.rb b/lib/webrick/httpservlet/filehandler.rb index 32c19651e7..daad8abd27 100644 --- a/lib/webrick/httpservlet/filehandler.rb +++ b/lib/webrick/httpservlet/filehandler.rb @@ -214,16 +214,20 @@ module WEBrick # character in URI notation. So the value of path_info should be # normalize before accessing to the filesystem. + # dirty hack for filesystem encoding; in nature, File.expand_path + # should not be used for path normalization. [Bug #3345] + path = req.path_info.dup.force_encoding(Encoding.find("filesystem")) if trailing_pathsep?(req.path_info) # File.expand_path removes the trailing path separator. # Adding a character is a workaround to save it. # File.expand_path("/aaa/") #=> "/aaa" # File.expand_path("/aaa/" + "x") #=> "/aaa/x" - expanded = File.expand_path(req.path_info + "x") + expanded = File.expand_path(path + "x") expanded.chop! # remove trailing "x" else - expanded = File.expand_path(req.path_info) + expanded = File.expand_path(path) end + expanded.force_encoding(req.path_info.encoding) req.path_info = expanded end -- cgit v1.2.3