diff options
author | Aaron Patterson <aaron.patterson@gmail.com> | 2014-10-30 11:37:33 -0700 |
---|---|---|
committer | Aaron Patterson <aaron.patterson@gmail.com> | 2014-10-30 11:37:33 -0700 |
commit | 03366b14d15aeebf255a54b2878dcc6206c0c372 (patch) | |
tree | b9bb34fdd8a46f057c1a5edd6aefd7f7609a0468 /actionpack/lib/action_dispatch | |
parent | 11fd052aa815ae0255ea5b2463e88138fb3fec61 (diff) | |
parent | 346acea281f048c853a6318429daac8d1a2e2d68 (diff) | |
download | rails-03366b14d15aeebf255a54b2878dcc6206c0c372.tar.gz rails-03366b14d15aeebf255a54b2878dcc6206c0c372.tar.bz2 rails-03366b14d15aeebf255a54b2878dcc6206c0c372.zip |
Merge branch '3.2.20' into 3-2-stable
* 3.2.20:
bumping version to 3.2.20
FileHandler should not be called for files outside the root
Diffstat (limited to 'actionpack/lib/action_dispatch')
-rw-r--r-- | actionpack/lib/action_dispatch/middleware/static.rb | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/actionpack/lib/action_dispatch/middleware/static.rb b/actionpack/lib/action_dispatch/middleware/static.rb index a8d176560c..7f1117009d 100644 --- a/actionpack/lib/action_dispatch/middleware/static.rb +++ b/actionpack/lib/action_dispatch/middleware/static.rb @@ -12,7 +12,7 @@ module ActionDispatch def match?(path) path = path.dup - full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path))) + full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(clean_path_info(unescape_path(path)))) paths = "#{full_path}#{ext}" matches = Dir[paths] @@ -42,6 +42,25 @@ module ActionDispatch path.force_encoding('binary') if path.respond_to? :force_encoding path.gsub(/[*?{}\[\]]/, "\\\\\\&") end + + private + + PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact) + + def clean_path_info(path_info) + parts = path_info.split PATH_SEPS + + clean = [] + + parts.each do |part| + next if part.empty? || part == '.' + part == '..' ? clean.pop : clean << part + end + + clean.unshift '/' if parts.empty? || parts.first.empty? + + ::File.join(*clean) + end end class Static |