Use Rack::Utils.clean_path_info instead of copy-pasted version.
This commit is contained in:
parent
f4ab02b12a
commit
29a68cc5bc
|
@ -22,7 +22,7 @@ class HelpController < ApplicationController
|
||||||
end
|
end
|
||||||
|
|
||||||
def show
|
def show
|
||||||
@path = clean_path_info(path_params[:path])
|
@path = Rack::Utils.clean_path_info(path_params[:path])
|
||||||
|
|
||||||
respond_to do |format|
|
respond_to do |format|
|
||||||
format.any(:markdown, :md, :html) do
|
format.any(:markdown, :md, :html) do
|
||||||
|
@ -75,35 +75,4 @@ class HelpController < ApplicationController
|
||||||
|
|
||||||
params
|
params
|
||||||
end
|
end
|
||||||
|
|
||||||
PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)
|
|
||||||
|
|
||||||
# Taken from ActionDispatch::FileHandler
|
|
||||||
# Cleans up the path, to prevent directory traversal outside the doc folder.
|
|
||||||
def clean_path_info(path_info)
|
|
||||||
parts = path_info.split(PATH_SEPS)
|
|
||||||
|
|
||||||
clean = []
|
|
||||||
|
|
||||||
# Walk over each part of the path
|
|
||||||
parts.each do |part|
|
|
||||||
# Turn `one//two` or `one/./two` into `one/two`.
|
|
||||||
next if part.empty? || part == '.'
|
|
||||||
|
|
||||||
if part == '..'
|
|
||||||
# Turn `one/two/../` into `one`
|
|
||||||
clean.pop
|
|
||||||
else
|
|
||||||
# Add simple folder names to the clean path.
|
|
||||||
clean << part
|
|
||||||
end
|
|
||||||
end
|
|
||||||
|
|
||||||
# If the path was an absolute path (i.e. `/` or `/one/two`),
|
|
||||||
# add `/` to the front of the clean path.
|
|
||||||
clean.unshift '/' if parts.empty? || parts.first.empty?
|
|
||||||
|
|
||||||
# Join all the clean path parts by the path separator.
|
|
||||||
::File.join(*clean)
|
|
||||||
end
|
|
||||||
end
|
end
|
||||||
|
|
Loading…
Reference in New Issue