kotovalexarian-likes-github/ruby--ruby
1
0
Fork 0
mirror of https://github.com/ruby/ruby.git synced 2022-11-09 12:17:21 -05:00
Code Releases Activity

Make usable chars more strict

Browse source 
Remove other than alphanumeric and some punctuations considered
filesystem-safe, instead of removing some unsafe chars only.

https://hackerone.com/reports/1131465
This commit is contained in:
Nobuyoshi Nakada 2021-04-01 01:17:45 +09:00 committed by NARUSE, Yui
parent 0d8c9a7fe7
commit 3b97a6496f
2 changed files with 5 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/tmpdir.rb
View file

@ -115,7 +115,7 @@ class Dir
Dir.tmpdir
end
UNUSABLE_CHARS = [File::SEPARATOR, File::ALT_SEPARATOR, File::PATH_SEPARATOR, ":"].uniq.join("").freeze
UNUSABLE_CHARS = "^,-.0-9A-Z_a-z~"
class << (RANDOM = Random.new)
MAX = 36**6 # < 0x100000000

6
test/test_tmpdir.rb
View file

@ -97,8 +97,10 @@ class TestTmpdir < Test::Unit::TestCase
target = target.chomp('/') + '/'
traversal_path = target.sub(/\A\w:/, '') # for DOSISH
traversal_path = Array.new(target.count('/')-2, '..').join('/') + traversal_path
actual = yield traversal_path
assert_not_send([File.absolute_path(actual), :start_with?, target])
[File::SEPARATOR, File::ALT_SEPARATOR].compact.each do |separator|
actual = yield traversal_path.tr('/', separator)
assert_not_send([File.absolute_path(actual), :start_with?, target])
end
end
end
end