rails / rails fork watch download tarball
public
Forks668Right
Watchers3817Right
Description: Ruby on Rails
Homepage: http://rubyonrails.org
Clone URL: git://github.com/rails/rails.git 
Sanitize the URLs passed to redirect_to to prevent a potential response spli

CGI.rb and mongrel don't do any sanitization of the contents of HTTP headers
NZKoz (author)
Tue Oct 14 02:47:27 -0700 2008
commit  7282ed863ca7e6f928bae9162c9a63a98775a19d
tree    3b6538fbe789c28a6a452566517272105630f6fe
parent  e8577991dcc47bcb11f99fd6582ee2a3f8270498
0
actionpack/lib/action_controller/response.rb 
...
30
31
32
33
 
34
35
 
36
37
38
 
...
30
31
32
 
33
34
 
35
36
37
38
 
0
@@ -30,9 +30,9 @@ module ActionController
0
 
0
     def redirect(to_url, response_status)
0
       self.headers["Status"] = response_status
0
-      self.headers["Location"] = to_url
0
+      self.headers["Location"] = to_url.gsub(/[\r\n]/, '')
0
 
0
-      self.body = "<html><body>You are being <a href=\"#{to_url}\">redirected</a>.</body></html>"
0
+      self.body = "<html><body>You are being <a href=\"#{CGI.escapeHTML(to_url)}\">redirected</a>.</body></html>"
0
     end
0
 
0
     def prepare!

Comments