From b93c590297ba65a6c5b18655a7790163abcb06f1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Valim?= Date: Sun, 28 Nov 2010 22:26:16 +0100 Subject: Ensure render is case sensitive even on systems with case-insensitive filesystems. This fixes CVE-2011-0449 --- actionpack/lib/action_view/template/resolver.rb | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) (limited to 'actionpack/lib/action_view') diff --git a/actionpack/lib/action_view/template/resolver.rb b/actionpack/lib/action_view/template/resolver.rb index d23aa5ef85..5bf928c62e 100644 --- a/actionpack/lib/action_view/template/resolver.rb +++ b/actionpack/lib/action_view/template/resolver.rb @@ -113,14 +113,23 @@ module ActionView query << '{' << ext.map {|e| e && ".#{e}" }.join(',') << ',}' end - Dir[query].reject { |p| File.directory?(p) }.map do |p| - handler, format = extract_handler_and_format(p, formats) + query.gsub!(/\{\.html,/, "{.html,.text.html,") + query.gsub!(/\{\.text,/, "{.text,.text.plain,") + + templates = [] + sanitizer = Hash.new { |h,k| h[k] = Dir["#{File.dirname(k)}/*"] } + + Dir[query].each do |p| + next if File.directory?(p) || !sanitizer[p].include?(p) + handler, format = extract_handler_and_format(p, formats) contents = File.open(p, "rb") {|io| io.read } - Template.new(contents, File.expand_path(p), handler, + templates << Template.new(contents, File.expand_path(p), handler, :virtual_path => path, :format => format, :updated_at => mtime(p)) end + + templates end # Returns the file mtime from the filesystem. -- cgit v1.2.3