Fix ActionDispatch::Static to serve files with unencoded PCHAR

RFC 3986[1] allows sub-delim characters in path segments unencoded,
however Rack::File requires them to be encoded so we use URI's
unescape method to leave them alone and then escape them again.

Also since the path gets passed to Dir[] we need to escape any glob
characters in the path.

[1]: http://www.ietf.org/rfc/rfc3986.txt

13 files changed, 40 insertions, 0 deletions

diff --git a/actionpack/test/dispatch/static_test.rb b/actionpack/test/dispatch/static_test.rb
index 9f3cbd19ef..ec69d50d26 100644
--- a/actionpack/test/dispatch/static_test.rb
+++ b/actionpack/test/dispatch/static_test.rb
@@ -30,6 +30,34 @@ module StaticTests
     assert_html "/foo/index.html", get("/foo")
   end
 
+  def test_serves_static_file_with_encoded_pchar
+    assert_html "/foo/foo!bar.html", get("/foo/foo%21bar.html")
+    assert_html "/foo/foo$bar.html", get("/foo/foo%24bar.html")
+    assert_html "/foo/foo&bar.html", get("/foo/foo%26bar.html")
+    assert_html "/foo/foo'bar.html", get("/foo/foo%27bar.html")
+    assert_html "/foo/foo(bar).html", get("/foo/foo%28bar%29.html")
+    assert_html "/foo/foo*bar.html", get("/foo/foo%2Abar.html")
+    assert_html "/foo/foo+bar.html", get("/foo/foo%2Bbar.html")
+    assert_html "/foo/foo,bar.html", get("/foo/foo%2Cbar.html")
+    assert_html "/foo/foo;bar.html", get("/foo/foo%3Bbar.html")
+    assert_html "/foo/foo:bar.html", get("/foo/foo%3Abar.html")
+    assert_html "/foo/foo@bar.html", get("/foo/foo%40bar.html")
+  end
+
+  def test_serves_static_file_with_unencoded_pchar
+    assert_html "/foo/foo!bar.html", get("/foo/foo!bar.html")
+    assert_html "/foo/foo$bar.html", get("/foo/foo$bar.html")
+    assert_html "/foo/foo&bar.html", get("/foo/foo&bar.html")
+    assert_html "/foo/foo'bar.html", get("/foo/foo'bar.html")
+    assert_html "/foo/foo(bar).html", get("/foo/foo(bar).html")
+    assert_html "/foo/foo*bar.html", get("/foo/foo*bar.html")
+    assert_html "/foo/foo+bar.html", get("/foo/foo+bar.html")
+    assert_html "/foo/foo,bar.html", get("/foo/foo,bar.html")
+    assert_html "/foo/foo;bar.html", get("/foo/foo;bar.html")
+    assert_html "/foo/foo:bar.html", get("/foo/foo:bar.html")
+    assert_html "/foo/foo@bar.html", get("/foo/foo@bar.html")
+  end
+
   private
 
     def assert_html(body, response)
diff --git a/actionpack/test/fixtures/public/foo/foo!bar.html b/actionpack/test/fixtures/public/foo/foo!bar.html
new file mode 100644
index 0000000000..2928f2717f
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo!bar.html
@@ -0,0 +1 @@
+/foo/foo!bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo$bar.html b/actionpack/test/fixtures/public/foo/foo$bar.html
new file mode 100644
index 0000000000..4f837df01d
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo$bar.html
@@ -0,0 +1 @@
+/foo/foo$bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo&bar.html b/actionpack/test/fixtures/public/foo/foo&bar.html
new file mode 100644
index 0000000000..c194e8de87
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo&bar.html
@@ -0,0 +1 @@
+/foo/foo&bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo'bar.html b/actionpack/test/fixtures/public/foo/foo'bar.html
new file mode 100644
index 0000000000..25c3275736
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo'bar.html
@@ -0,0 +1 @@
+/foo/foo'bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo(bar).html b/actionpack/test/fixtures/public/foo/foo(bar).html
new file mode 100644
index 0000000000..94fa4cb944
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo(bar).html
@@ -0,0 +1 @@
+/foo/foo(bar).html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo*bar.html b/actionpack/test/fixtures/public/foo/foo*bar.html
new file mode 100644
index 0000000000..79d5194c8d
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo*bar.html
@@ -0,0 +1 @@
+/foo/foo*bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo+bar.html b/actionpack/test/fixtures/public/foo/foo+bar.html
new file mode 100644
index 0000000000..0fdc2ecabc
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo+bar.html
@@ -0,0 +1 @@
+/foo/foo+bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo,bar.html b/actionpack/test/fixtures/public/foo/foo,bar.html
new file mode 100644
index 0000000000..f040fce197
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo,bar.html
@@ -0,0 +1 @@
+/foo/foo,bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo:bar.html b/actionpack/test/fixtures/public/foo/foo:bar.html
new file mode 100644
index 0000000000..7900a2642b
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo:bar.html
@@ -0,0 +1 @@
+/foo/foo:bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo;bar.html b/actionpack/test/fixtures/public/foo/foo;bar.html
new file mode 100644
index 0000000000..2248376954
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo;bar.html
@@ -0,0 +1 @@
+/foo/foo;bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo=bar.html b/actionpack/test/fixtures/public/foo/foo=bar.html
new file mode 100644
index 0000000000..206f69e286
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo=bar.html
@@ -0,0 +1 @@
+/foo/foo=bar.html
\ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo@bar.html b/actionpack/test/fixtures/public/foo/foo@bar.html
new file mode 100644
index 0000000000..4e8e90f9b8
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo@bar.html
@@ -0,0 +1 @@
+/foo/foo@bar.html
\ No newline at end of file