aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack
diff options
context:
space:
mode:
authorAndrew White <andyw@pixeltrix.co.uk>2012-02-17 13:33:44 +0000
committerAndrew White <andyw@pixeltrix.co.uk>2012-02-17 14:07:48 +0000
commitceb288b8ce552a248f141bddbd16426641a4fd0d (patch)
treeb7f3fe70fa7c531e7520fd61cf3e08820d5369f6 /actionpack
parentce51edb73bce5e213568fd5a362fb3557a06aee1 (diff)
downloadrails-ceb288b8ce552a248f141bddbd16426641a4fd0d.tar.gz
rails-ceb288b8ce552a248f141bddbd16426641a4fd0d.tar.bz2
rails-ceb288b8ce552a248f141bddbd16426641a4fd0d.zip
Fix ActionDispatch::Static to serve files with unencoded PCHAR
RFC 3986[1] allows sub-delim characters in path segments unencoded, however Rack::File requires them to be encoded so we use URI's unescape method to leave them alone and then escape them again. Also since the path gets passed to Dir[] we need to escape any glob characters in the path. [1]: http://www.ietf.org/rfc/rfc3986.txt
Diffstat (limited to 'actionpack')
-rw-r--r--actionpack/lib/action_dispatch/middleware/static.rb11
-rw-r--r--actionpack/test/dispatch/static_test.rb28
-rw-r--r--actionpack/test/fixtures/public/foo/foo!bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo$bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo&bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo'bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo(bar).html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo*bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo+bar.html2
-rw-r--r--actionpack/test/fixtures/public/foo/foo,bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo:bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo;bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo=bar.html1
-rw-r--r--actionpack/test/fixtures/public/foo/foo@bar.html1
14 files changed, 48 insertions, 4 deletions
diff --git a/actionpack/lib/action_dispatch/middleware/static.rb b/actionpack/lib/action_dispatch/middleware/static.rb
index 11c346926c..cb251bca6f 100644
--- a/actionpack/lib/action_dispatch/middleware/static.rb
+++ b/actionpack/lib/action_dispatch/middleware/static.rb
@@ -1,4 +1,5 @@
require 'rack/utils'
+require 'active_support/core_ext/uri'
module ActionDispatch
class FileHandler
@@ -11,7 +12,7 @@ module ActionDispatch
def match?(path)
path = path.dup
- full_path = path.empty? ? @root : File.join(@root, ::Rack::Utils.unescape(path))
+ full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path)))
paths = "#{full_path}#{ext}"
matches = Dir[paths]
@@ -32,6 +33,14 @@ module ActionDispatch
"{,#{ext},/index#{ext}}"
end
end
+
+ def unescape_path(path)
+ URI.parser.unescape(path)
+ end
+
+ def escape_glob_chars(path)
+ path.gsub(/(\*|\?|\[|\]|\{|\})/, "\\\\\\1")
+ end
end
class Static
diff --git a/actionpack/test/dispatch/static_test.rb b/actionpack/test/dispatch/static_test.rb
index d91a857d18..e086d99b19 100644
--- a/actionpack/test/dispatch/static_test.rb
+++ b/actionpack/test/dispatch/static_test.rb
@@ -35,8 +35,32 @@ module StaticTests
assert_html "means hello in Japanese\n", get("/foo/#{Rack::Utils.escape("こんにちは.html")}")
end
- def test_serves_static_file_with_plus_in_filename
- assert_html "foo+bar\n", get('/foo/foo%2Bbar.html')
+ def test_serves_static_file_with_encoded_pchar
+ assert_html "/foo/foo!bar.html", get("/foo/foo%21bar.html")
+ assert_html "/foo/foo$bar.html", get("/foo/foo%24bar.html")
+ assert_html "/foo/foo&bar.html", get("/foo/foo%26bar.html")
+ assert_html "/foo/foo'bar.html", get("/foo/foo%27bar.html")
+ assert_html "/foo/foo(bar).html", get("/foo/foo%28bar%29.html")
+ assert_html "/foo/foo*bar.html", get("/foo/foo%2Abar.html")
+ assert_html "/foo/foo+bar.html", get("/foo/foo%2Bbar.html")
+ assert_html "/foo/foo,bar.html", get("/foo/foo%2Cbar.html")
+ assert_html "/foo/foo;bar.html", get("/foo/foo%3Bbar.html")
+ assert_html "/foo/foo:bar.html", get("/foo/foo%3Abar.html")
+ assert_html "/foo/foo@bar.html", get("/foo/foo%40bar.html")
+ end
+
+ def test_serves_static_file_with_unencoded_pchar
+ assert_html "/foo/foo!bar.html", get("/foo/foo!bar.html")
+ assert_html "/foo/foo$bar.html", get("/foo/foo$bar.html")
+ assert_html "/foo/foo&bar.html", get("/foo/foo&bar.html")
+ assert_html "/foo/foo'bar.html", get("/foo/foo'bar.html")
+ assert_html "/foo/foo(bar).html", get("/foo/foo(bar).html")
+ assert_html "/foo/foo*bar.html", get("/foo/foo*bar.html")
+ assert_html "/foo/foo+bar.html", get("/foo/foo+bar.html")
+ assert_html "/foo/foo,bar.html", get("/foo/foo,bar.html")
+ assert_html "/foo/foo;bar.html", get("/foo/foo;bar.html")
+ assert_html "/foo/foo:bar.html", get("/foo/foo:bar.html")
+ assert_html "/foo/foo@bar.html", get("/foo/foo@bar.html")
end
private
diff --git a/actionpack/test/fixtures/public/foo/foo!bar.html b/actionpack/test/fixtures/public/foo/foo!bar.html
new file mode 100644
index 0000000000..2928f2717f
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo!bar.html
@@ -0,0 +1 @@
+/foo/foo!bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo$bar.html b/actionpack/test/fixtures/public/foo/foo$bar.html
new file mode 100644
index 0000000000..4f837df01d
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo$bar.html
@@ -0,0 +1 @@
+/foo/foo$bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo&bar.html b/actionpack/test/fixtures/public/foo/foo&bar.html
new file mode 100644
index 0000000000..c194e8de87
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo&bar.html
@@ -0,0 +1 @@
+/foo/foo&bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo'bar.html b/actionpack/test/fixtures/public/foo/foo'bar.html
new file mode 100644
index 0000000000..25c3275736
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo'bar.html
@@ -0,0 +1 @@
+/foo/foo'bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo(bar).html b/actionpack/test/fixtures/public/foo/foo(bar).html
new file mode 100644
index 0000000000..94fa4cb944
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo(bar).html
@@ -0,0 +1 @@
+/foo/foo(bar).html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo*bar.html b/actionpack/test/fixtures/public/foo/foo*bar.html
new file mode 100644
index 0000000000..79d5194c8d
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo*bar.html
@@ -0,0 +1 @@
+/foo/foo*bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo+bar.html b/actionpack/test/fixtures/public/foo/foo+bar.html
index 92c0ad9ac9..0fdc2ecabc 100644
--- a/actionpack/test/fixtures/public/foo/foo+bar.html
+++ b/actionpack/test/fixtures/public/foo/foo+bar.html
@@ -1 +1 @@
-foo+bar
+/foo/foo+bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo,bar.html b/actionpack/test/fixtures/public/foo/foo,bar.html
new file mode 100644
index 0000000000..f040fce197
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo,bar.html
@@ -0,0 +1 @@
+/foo/foo,bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo:bar.html b/actionpack/test/fixtures/public/foo/foo:bar.html
new file mode 100644
index 0000000000..7900a2642b
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo:bar.html
@@ -0,0 +1 @@
+/foo/foo:bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo;bar.html b/actionpack/test/fixtures/public/foo/foo;bar.html
new file mode 100644
index 0000000000..2248376954
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo;bar.html
@@ -0,0 +1 @@
+/foo/foo;bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo=bar.html b/actionpack/test/fixtures/public/foo/foo=bar.html
new file mode 100644
index 0000000000..206f69e286
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo=bar.html
@@ -0,0 +1 @@
+/foo/foo=bar.html \ No newline at end of file
diff --git a/actionpack/test/fixtures/public/foo/foo@bar.html b/actionpack/test/fixtures/public/foo/foo@bar.html
new file mode 100644
index 0000000000..4e8e90f9b8
--- /dev/null
+++ b/actionpack/test/fixtures/public/foo/foo@bar.html
@@ -0,0 +1 @@
+/foo/foo@bar.html \ No newline at end of file
generated by cgit v1.2.3 (git 2.25.1) at 2025-03-29 03:08:30 +0000