mirror of
https://github.com/rails/rails.git
synced 2022-11-09 12:12:34 -05:00
Fix ActionDispatch::Static to serve files with unencoded PCHAR
RFC 3986[1] allows sub-delim characters in path segments unencoded, however Rack::File requires them to be encoded so we use URI's unescape method to leave them alone and then escape them again. Also since the path gets passed to Dir[] we need to escape any glob characters in the path. [1]: http://www.ietf.org/rfc/rfc3986.txt
This commit is contained in:
parent
ce51edb73b
commit
ceb288b8ce
14 changed files with 48 additions and 4 deletions
|
@ -1,4 +1,5 @@
|
|||
require 'rack/utils'
|
||||
require 'active_support/core_ext/uri'
|
||||
|
||||
module ActionDispatch
|
||||
class FileHandler
|
||||
|
@ -11,7 +12,7 @@ module ActionDispatch
|
|||
def match?(path)
|
||||
path = path.dup
|
||||
|
||||
full_path = path.empty? ? @root : File.join(@root, ::Rack::Utils.unescape(path))
|
||||
full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path)))
|
||||
paths = "#{full_path}#{ext}"
|
||||
|
||||
matches = Dir[paths]
|
||||
|
@ -32,6 +33,14 @@ module ActionDispatch
|
|||
"{,#{ext},/index#{ext}}"
|
||||
end
|
||||
end
|
||||
|
||||
def unescape_path(path)
|
||||
URI.parser.unescape(path)
|
||||
end
|
||||
|
||||
def escape_glob_chars(path)
|
||||
path.gsub(/(\*|\?|\[|\]|\{|\})/, "\\\\\\1")
|
||||
end
|
||||
end
|
||||
|
||||
class Static
|
||||
|
|
|
@ -35,8 +35,32 @@ module StaticTests
|
|||
assert_html "means hello in Japanese\n", get("/foo/#{Rack::Utils.escape("こんにちは.html")}")
|
||||
end
|
||||
|
||||
def test_serves_static_file_with_plus_in_filename
|
||||
assert_html "foo+bar\n", get('/foo/foo%2Bbar.html')
|
||||
def test_serves_static_file_with_encoded_pchar
|
||||
assert_html "/foo/foo!bar.html", get("/foo/foo%21bar.html")
|
||||
assert_html "/foo/foo$bar.html", get("/foo/foo%24bar.html")
|
||||
assert_html "/foo/foo&bar.html", get("/foo/foo%26bar.html")
|
||||
assert_html "/foo/foo'bar.html", get("/foo/foo%27bar.html")
|
||||
assert_html "/foo/foo(bar).html", get("/foo/foo%28bar%29.html")
|
||||
assert_html "/foo/foo*bar.html", get("/foo/foo%2Abar.html")
|
||||
assert_html "/foo/foo+bar.html", get("/foo/foo%2Bbar.html")
|
||||
assert_html "/foo/foo,bar.html", get("/foo/foo%2Cbar.html")
|
||||
assert_html "/foo/foo;bar.html", get("/foo/foo%3Bbar.html")
|
||||
assert_html "/foo/foo:bar.html", get("/foo/foo%3Abar.html")
|
||||
assert_html "/foo/foo@bar.html", get("/foo/foo%40bar.html")
|
||||
end
|
||||
|
||||
def test_serves_static_file_with_unencoded_pchar
|
||||
assert_html "/foo/foo!bar.html", get("/foo/foo!bar.html")
|
||||
assert_html "/foo/foo$bar.html", get("/foo/foo$bar.html")
|
||||
assert_html "/foo/foo&bar.html", get("/foo/foo&bar.html")
|
||||
assert_html "/foo/foo'bar.html", get("/foo/foo'bar.html")
|
||||
assert_html "/foo/foo(bar).html", get("/foo/foo(bar).html")
|
||||
assert_html "/foo/foo*bar.html", get("/foo/foo*bar.html")
|
||||
assert_html "/foo/foo+bar.html", get("/foo/foo+bar.html")
|
||||
assert_html "/foo/foo,bar.html", get("/foo/foo,bar.html")
|
||||
assert_html "/foo/foo;bar.html", get("/foo/foo;bar.html")
|
||||
assert_html "/foo/foo:bar.html", get("/foo/foo:bar.html")
|
||||
assert_html "/foo/foo@bar.html", get("/foo/foo@bar.html")
|
||||
end
|
||||
|
||||
private
|
||||
|
|
1
actionpack/test/fixtures/public/foo/foo!bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo!bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo!bar.html
|
1
actionpack/test/fixtures/public/foo/foo$bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo$bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo$bar.html
|
1
actionpack/test/fixtures/public/foo/foo&bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo&bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo&bar.html
|
1
actionpack/test/fixtures/public/foo/foo'bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo'bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo'bar.html
|
1
actionpack/test/fixtures/public/foo/foo(bar).html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo(bar).html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo(bar).html
|
1
actionpack/test/fixtures/public/foo/foo*bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo*bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo*bar.html
|
|
@ -1 +1 @@
|
|||
foo+bar
|
||||
/foo/foo+bar.html
|
1
actionpack/test/fixtures/public/foo/foo,bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo,bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo,bar.html
|
1
actionpack/test/fixtures/public/foo/foo:bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo:bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo:bar.html
|
1
actionpack/test/fixtures/public/foo/foo;bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo;bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo;bar.html
|
1
actionpack/test/fixtures/public/foo/foo=bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo=bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo=bar.html
|
1
actionpack/test/fixtures/public/foo/foo@bar.html
vendored
Normal file
1
actionpack/test/fixtures/public/foo/foo@bar.html
vendored
Normal file
|
@ -0,0 +1 @@
|
|||
/foo/foo@bar.html
|
Loading…
Reference in a new issue