diff options
author | Andrew White <andyw@pixeltrix.co.uk> | 2012-02-17 13:33:44 +0000 |
---|---|---|
committer | Andrew White <andyw@pixeltrix.co.uk> | 2012-02-17 14:07:48 +0000 |
commit | ceb288b8ce552a248f141bddbd16426641a4fd0d (patch) | |
tree | b7f3fe70fa7c531e7520fd61cf3e08820d5369f6 /actionpack/lib | |
parent | ce51edb73bce5e213568fd5a362fb3557a06aee1 (diff) | |
download | rails-ceb288b8ce552a248f141bddbd16426641a4fd0d.tar.gz rails-ceb288b8ce552a248f141bddbd16426641a4fd0d.tar.bz2 rails-ceb288b8ce552a248f141bddbd16426641a4fd0d.zip |
Fix ActionDispatch::Static to serve files with unencoded PCHAR
RFC 3986[1] allows sub-delim characters in path segments unencoded,
however Rack::File requires them to be encoded so we use URI's
unescape method to leave them alone and then escape them again.
Also since the path gets passed to Dir[] we need to escape any glob
characters in the path.
[1]: http://www.ietf.org/rfc/rfc3986.txt
Diffstat (limited to 'actionpack/lib')
-rw-r--r-- | actionpack/lib/action_dispatch/middleware/static.rb | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/actionpack/lib/action_dispatch/middleware/static.rb b/actionpack/lib/action_dispatch/middleware/static.rb index 11c346926c..cb251bca6f 100644 --- a/actionpack/lib/action_dispatch/middleware/static.rb +++ b/actionpack/lib/action_dispatch/middleware/static.rb @@ -1,4 +1,5 @@ require 'rack/utils' +require 'active_support/core_ext/uri' module ActionDispatch class FileHandler @@ -11,7 +12,7 @@ module ActionDispatch def match?(path) path = path.dup - full_path = path.empty? ? @root : File.join(@root, ::Rack::Utils.unescape(path)) + full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path))) paths = "#{full_path}#{ext}" matches = Dir[paths] @@ -32,6 +33,14 @@ module ActionDispatch "{,#{ext},/index#{ext}}" end end + + def unescape_path(path) + URI.parser.unescape(path) + end + + def escape_glob_chars(path) + path.gsub(/(\*|\?|\[|\]|\{|\})/, "\\\\\\1") + end end class Static |