Fix ActionDispatch::Static to serve files with unencoded PCHAR

RFC 3986[1] allows sub-delim characters in path segments unencoded,
however Rack::File requires them to be encoded so we use URI's
unescape method to leave them alone and then escape them again.

Also since the path gets passed to Dir[] we need to escape any glob
characters in the path.

[1]: http://www.ietf.org/rfc/rfc3986.txt

1 files changed, 10 insertions, 2 deletions

diff --git a/actionpack/lib/action_dispatch/middleware/static.rb b/actionpack/lib/action_dispatch/middleware/static.rb
index 404943d720..531edb27ba 100644
--- a/actionpack/lib/action_dispatch/middleware/static.rb
+++ b/actionpack/lib/action_dispatch/middleware/static.rb
@@ -11,14 +11,14 @@ module ActionDispatch
     def match?(path)
       path = path.dup
 
-      full_path = path.empty? ? @root : File.join(@root, ::Rack::Utils.unescape(path))
+      full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path)))
       paths = "#{full_path}#{ext}"
 
       matches = Dir[paths]
       match = matches.detect { |m| File.file?(m) }
       if match
         match.sub!(@compiled_root, '')
-        match
+        ::Rack::Utils.escape(match)
       end
     end
 
@@ -32,6 +32,14 @@ module ActionDispatch
         "{,#{ext},/index#{ext}}"
       end
     end
+
+    def unescape_path(path)
+      URI.parser.unescape(path)
+    end
+
+    def escape_glob_chars(path)
+      path.gsub(/(\*|\?|\[|\]|\{|\})/, "\\\\\\1")
+    end
   end
 
   class Static