Sha256: 659d3ae4bc0133f33ecb4fa1fc3481dd01196547b53b8c1eca57b52c8ed401df
Contents?: true
Size: 1009 Bytes
Versions: 10
Compression:
Stored size: 1009 Bytes
Contents
require 'rack/protection'
module Rack
module Protection
##
# Prevented attack:: Directory traversal
# Supported browsers:: all
# More infos:: http://en.wikipedia.org/wiki/Directory_traversal
#
# Unescapes '/' and '.', expands +path_info+.
# Thus <tt>GET /foo/%2e%2e%2fbar</tt> becomes <tt>GET /bar</tt>.
class PathTraversal < Base
def call(env)
path_was = env["PATH_INFO"]
env["PATH_INFO"] = cleanup path_was if path_was && !path_was.empty?
app.call env
ensure
env["PATH_INFO"] = path_was
end
def cleanup(path)
parts = []
unescaped = path.gsub('%2e', '.').gsub('%2f', '/')
unescaped.split('/').each do |part|
next if part.empty? or part == '.'
part == '..' ? parts.pop : parts << part
end
cleaned = '/' << parts.join('/')
cleaned << '/' if parts.any? and unescaped =~ /\/\.{0,2}$/
cleaned
end
end
end
end
Version data entries
10 entries across 8 versions & 2 rubygems