From d17aa95f5056c52daf5d7c3170fbfd831dc96381 Mon Sep 17 00:00:00 2001 From: Orange Tsai Date: Mon, 8 Jan 2018 20:48:01 -0800 Subject: [PATCH 1/2] enhanced path validation in Windows --- lib/sinatra/base.rb | 1 + rack-protection/lib/rack/protection/path_traversal.rb | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb index 308d9419..5c47f0d6 100644 --- a/lib/sinatra/base.rb +++ b/lib/sinatra/base.rb @@ -1061,6 +1061,7 @@ module Sinatra def static!(options = {}) return if (public_dir = settings.public_folder).nil? path = File.expand_path("#{public_dir}#{URI_INSTANCE.unescape(request.path_info)}" ) + return unless path.start_with?(public_dir) return unless File.file?(path) env['sinatra.static_file'] = path diff --git a/rack-protection/lib/rack/protection/path_traversal.rb b/rack-protection/lib/rack/protection/path_traversal.rb index 0f58a643..a6ca87f0 100644 --- a/rack-protection/lib/rack/protection/path_traversal.rb +++ b/rack-protection/lib/rack/protection/path_traversal.rb @@ -24,14 +24,17 @@ module Rack encoding = path.encoding dot = '.'.encode(encoding) slash = '/'.encode(encoding) + backslash = '\\'.encode(encoding) else # Ruby 1.8 dot = '.' slash = '/' + backslash = '\\' end parts = [] - unescaped = path.gsub(/%2e/i, dot).gsub(/%2f/i, slash) + unescaped = path.gsub(/%2e/i, dot).gsub(/%2f/i, slash).gsub(/%5c/i, backslash) + unescaped = unescaped.gsub(backslash, slash) unescaped.split(slash).each do |part| next if part.empty? or part == dot From ba7af51bd713267910078d055d01469e836fd64f Mon Sep 17 00:00:00 2001 From: Orange Tsai Date: Sun, 11 Feb 2018 02:29:14 +0800 Subject: [PATCH 2/2] Removed the double check line! Removed the double check line! --- lib/sinatra/base.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb index 5c47f0d6..308d9419 100644 --- a/lib/sinatra/base.rb +++ b/lib/sinatra/base.rb @@ -1061,7 +1061,6 @@ module Sinatra def static!(options = {}) return if (public_dir = settings.public_folder).nil? path = File.expand_path("#{public_dir}#{URI_INSTANCE.unescape(request.path_info)}" ) - return unless path.start_with?(public_dir) return unless File.file?(path) env['sinatra.static_file'] = path