From d1123f2056eff3696ae76e5116a6ab53e6c33f57 Mon Sep 17 00:00:00 2001 From: Aaron Patterson Date: Fri, 10 Oct 2014 16:00:03 -0700 Subject: FileHandler should not be called for files outside the root FileHandler#matches? should return false for files that are outside the "root" path. --- actionpack/lib/action_dispatch/middleware/static.rb | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) (limited to 'actionpack/lib/action_dispatch/middleware') diff --git a/actionpack/lib/action_dispatch/middleware/static.rb b/actionpack/lib/action_dispatch/middleware/static.rb index e66c21ef85..002bf8b11a 100644 --- a/actionpack/lib/action_dispatch/middleware/static.rb +++ b/actionpack/lib/action_dispatch/middleware/static.rb @@ -24,9 +24,19 @@ module ActionDispatch path = URI.parser.unescape(path) return false unless path.valid_encoding? - paths = [path, "#{path}#{ext}", "#{path}/index#{ext}"] + paths = [path, "#{path}#{ext}", "#{path}/index#{ext}"].map { |v| + Rack::Utils.clean_path_info v + } - if match = paths.detect {|p| File.file?(File.join(@root, p)) } + if match = paths.detect { |p| + path = File.join(@root, p) + begin + File.file?(path) && File.readable?(path) + rescue SystemCallError + false + end + + } return ::Rack::Utils.escape(match) end end -- cgit v1.2.3