From aac91cb762e20519aca6190345641d27e5991a75 Mon Sep 17 00:00:00 2001
From: normal <normal@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Wed, 13 Dec 2017 00:38:08 +0000
Subject: [PATCH] webrick: compile RE correctly for beginning and end match

Using ^ and $ in regexps means we can accidentally get fooled
by "%0a" in HTTP request paths being decoded to newline
characters.  Use \A and \z to match beginning and end-of-string
respectively, instead.

Thanks to mame and hsbt for reporting.

* lib/webrick/httpserver.rb (MountTable#compile):
  use \A and \z instead of ^ and $
* lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $
* test/webrick/test_httpserver.rb (test_cntrl_in_path): new test

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61197 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 lib/webrick/httpserver.rb       |  4 ++--
 test/webrick/test_httpserver.rb | 25 +++++++++++++++++++++++++
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/lib/webrick/httpserver.rb b/lib/webrick/httpserver.rb
index b27f2311bd..e46b3bd1ad 100644
--- a/lib/webrick/httpserver.rb
+++ b/lib/webrick/httpserver.rb
@@ -267,12 +267,12 @@ module WEBrick
         k.sort!
         k.reverse!
         k.collect!{|path| Regexp.escape(path) }
-        @scanner = Regexp.new("^(" + k.join("|") +")(?=/|$)")
+        @scanner = Regexp.new("\\A(" + k.join("|") +")(?=/|\\z)")
       end
 
       def normalize(dir)
         ret = dir ? dir.dup : ""
-        ret.sub!(%r|/+$|, "")
+        ret.sub!(%r|/+\z|, "")
         ret
       end
     end
diff --git a/test/webrick/test_httpserver.rb b/test/webrick/test_httpserver.rb
index 5aa94637ba..daeb7b955e 100644
--- a/test/webrick/test_httpserver.rb
+++ b/test/webrick/test_httpserver.rb
@@ -415,4 +415,29 @@ class TestWEBrickHTTPServer < Test::Unit::TestCase
     }
     assert_equal(0, requested, "Server responded to #{requested} requests after shutdown")
   end
+
+  def test_cntrl_in_path
+    log_ary = []
+    access_log_ary = []
+    config = {
+      :Port => 0,
+      :BindAddress => '127.0.0.1',
+      :Logger => WEBrick::Log.new(log_ary, WEBrick::BasicLog::WARN),
+      :AccessLog => [[access_log_ary, '']],
+    }
+    s = WEBrick::HTTPServer.new(config)
+    s.mount('/foo', WEBrick::HTTPServlet::FileHandler, __FILE__)
+    th = Thread.new { s.start }
+    addr = s.listeners[0].addr
+
+    http = Net::HTTP.new(addr[3], addr[1])
+    req = Net::HTTP::Get.new('/notexist%0a/foo')
+    http.request(req) { |res| assert_equal('404', res.code) }
+    exp = %Q(ERROR `/notexist\\n/foo' not found.\n)
+    assert_equal 1, log_ary.size
+    assert log_ary[0].include?(exp)
+  ensure
+    s&.shutdown
+    th&.join
+  end
 end