aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib
diff options
context:
space:
mode:
authorAaron Patterson <aaron.patterson@gmail.com>2014-10-30 11:37:33 -0700
committerAaron Patterson <aaron.patterson@gmail.com>2014-10-30 11:37:33 -0700
commit03366b14d15aeebf255a54b2878dcc6206c0c372 (patch)
treeb9bb34fdd8a46f057c1a5edd6aefd7f7609a0468 /actionpack/lib
parent11fd052aa815ae0255ea5b2463e88138fb3fec61 (diff)
parent346acea281f048c853a6318429daac8d1a2e2d68 (diff)
downloadrails-03366b14d15aeebf255a54b2878dcc6206c0c372.tar.gz
rails-03366b14d15aeebf255a54b2878dcc6206c0c372.tar.bz2
rails-03366b14d15aeebf255a54b2878dcc6206c0c372.zip
Merge branch '3.2.20' into 3-2-stable
* 3.2.20: bumping version to 3.2.20 FileHandler should not be called for files outside the root
Diffstat (limited to 'actionpack/lib')
-rw-r--r--actionpack/lib/action_dispatch/middleware/static.rb21
-rw-r--r--actionpack/lib/action_pack/version.rb2
2 files changed, 21 insertions, 2 deletions
diff --git a/actionpack/lib/action_dispatch/middleware/static.rb b/actionpack/lib/action_dispatch/middleware/static.rb
index a8d176560c..7f1117009d 100644
--- a/actionpack/lib/action_dispatch/middleware/static.rb
+++ b/actionpack/lib/action_dispatch/middleware/static.rb
@@ -12,7 +12,7 @@ module ActionDispatch
def match?(path)
path = path.dup
- full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path)))
+ full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(clean_path_info(unescape_path(path))))
paths = "#{full_path}#{ext}"
matches = Dir[paths]
@@ -42,6 +42,25 @@ module ActionDispatch
path.force_encoding('binary') if path.respond_to? :force_encoding
path.gsub(/[*?{}\[\]]/, "\\\\\\&")
end
+
+ private
+
+ PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)
+
+ def clean_path_info(path_info)
+ parts = path_info.split PATH_SEPS
+
+ clean = []
+
+ parts.each do |part|
+ next if part.empty? || part == '.'
+ part == '..' ? clean.pop : clean << part
+ end
+
+ clean.unshift '/' if parts.empty? || parts.first.empty?
+
+ ::File.join(*clean)
+ end
end
class Static
diff --git a/actionpack/lib/action_pack/version.rb b/actionpack/lib/action_pack/version.rb
index 3dc00b99fe..94af30d8ad 100644
--- a/actionpack/lib/action_pack/version.rb
+++ b/actionpack/lib/action_pack/version.rb
@@ -2,7 +2,7 @@ module ActionPack
module VERSION #:nodoc:
MAJOR = 3
MINOR = 2
- TINY = 19
+ TINY = 20
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')