Changeset 927

Show
Ignore:
Timestamp:
12/28/07 21:55:04 (8 months ago)
Author:
wayneeseguin
Message:

Applied Zed's patch to fix a vulnerability recently introduced whereby url's like "/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/.%252e/etc/passwd" could serve the password file.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • branches/stable_1-1/lib/mongrel/handlers.rb

    r826 r927  
    133133      req_path = File.join(@path, req_path) if @path 
    134134      req_path = File.expand_path req_path 
    135        
    136       if File.exist? req_path 
     135      
     136      # do not remove the check for @path at the beginning, it's what prevents 
     137      # the serving of arbitrary files (and good programmer Rule #1 Says: If 
     138      # you don't understand something, it's not because I'm stupid, it's 
     139      # because you are). 
     140      if req_path.index(@path) == 0 and File.exist? req_path 
    137141        # It exists and it's in the right location 
    138142        if File.directory? req_path 
     
    154158        end 
    155159      else 
    156         # does not exist or isn't in the right spot 
     160        # does not exist or isn't in the right spot or isn't valid because not start with @path 
    157161        return nil 
    158162      end