kotovalexarian-likes-github/sinatra
1
0
Fork 0
mirror of https://github.com/sinatra/sinatra synced 2023-03-27 23:18:01 -04:00
Code Releases Activity

Fix directory traversal vulnerability in static file route [#177]

Browse source
This commit is contained in:
Ryan Tomayko 2009-03-09 14:46:45 -07:00
parent 01b1f4945e
commit ed98aed36f
2 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/sinatra/base.rb
View file

@ -884,7 +884,9 @@ module Sinatra
# static files route # static files route
get(/.*[^\/]$/) do get(/.*[^\/]$/) do
pass unless options.static? && options.public? pass unless options.static? && options.public?
path = options.public + unescape(request.path_info) public_dir = File.expand_path(options.public)
path = File.expand_path(public_dir + unescape(request.path_info))
pass if path[0, public_dir.length] != public_dir
pass unless File.file?(path) pass unless File.file?(path)
send_file path, :disposition => nil send_file path, :disposition => nil
end end

15
test/static_test.rb
View file

@ -62,4 +62,19 @@ describe 'Static' do
get "/foobarbaz.txt" get "/foobarbaz.txt"
assert not_found? assert not_found?
end end
it 'serves files when .. path traverses within public directory' do
get "/data/../#{File.basename(__FILE__)}"
assert ok?
assert_equal File.read(__FILE__), body
end
it '404s when .. path traverses outside of public directory' do
mock_app {
set :static, true
set :public, File.dirname(__FILE__) + '/data'
}
get "/../#{File.basename(__FILE__)}"
assert not_found?
end
end end