diff --git a/actionpack/lib/action_dispatch/middleware/static.rb b/actionpack/lib/action_dispatch/middleware/static.rb index 404943d720302..531edb27ba120 100644 --- a/actionpack/lib/action_dispatch/middleware/static.rb +++ b/actionpack/lib/action_dispatch/middleware/static.rb @@ -11,14 +11,14 @@ def initialize(root, cache_control) def match?(path) path = path.dup - full_path = path.empty? ? @root : File.join(@root, ::Rack::Utils.unescape(path)) + full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path))) paths = "#{full_path}#{ext}" matches = Dir[paths] match = matches.detect { |m| File.file?(m) } if match match.sub!(@compiled_root, '') - match + ::Rack::Utils.escape(match) end end @@ -32,6 +32,14 @@ def ext "{,#{ext},/index#{ext}}" end end + + def unescape_path(path) + URI.parser.unescape(path) + end + + def escape_glob_chars(path) + path.gsub(/(\*|\?|\[|\]|\{|\})/, "\\\\\\1") + end end class Static diff --git a/actionpack/test/dispatch/static_test.rb b/actionpack/test/dispatch/static_test.rb index 9f3cbd19efc2e..ec69d50d26d89 100644 --- a/actionpack/test/dispatch/static_test.rb +++ b/actionpack/test/dispatch/static_test.rb @@ -30,6 +30,34 @@ def test_serves_static_index_file_in_directory assert_html "/foo/index.html", get("/foo") end + def test_serves_static_file_with_encoded_pchar + assert_html "/foo/foo!bar.html", get("/foo/foo%21bar.html") + assert_html "/foo/foo$bar.html", get("/foo/foo%24bar.html") + assert_html "/foo/foo&bar.html", get("/foo/foo%26bar.html") + assert_html "/foo/foo'bar.html", get("/foo/foo%27bar.html") + assert_html "/foo/foo(bar).html", get("/foo/foo%28bar%29.html") + assert_html "/foo/foo*bar.html", get("/foo/foo%2Abar.html") + assert_html "/foo/foo+bar.html", get("/foo/foo%2Bbar.html") + assert_html "/foo/foo,bar.html", get("/foo/foo%2Cbar.html") + assert_html "/foo/foo;bar.html", get("/foo/foo%3Bbar.html") + assert_html "/foo/foo:bar.html", get("/foo/foo%3Abar.html") + assert_html "/foo/foo@bar.html", get("/foo/foo%40bar.html") + end + + def test_serves_static_file_with_unencoded_pchar + assert_html "/foo/foo!bar.html", get("/foo/foo!bar.html") + assert_html "/foo/foo$bar.html", get("/foo/foo$bar.html") + assert_html "/foo/foo&bar.html", get("/foo/foo&bar.html") + assert_html "/foo/foo'bar.html", get("/foo/foo'bar.html") + assert_html "/foo/foo(bar).html", get("/foo/foo(bar).html") + assert_html "/foo/foo*bar.html", get("/foo/foo*bar.html") + assert_html "/foo/foo+bar.html", get("/foo/foo+bar.html") + assert_html "/foo/foo,bar.html", get("/foo/foo,bar.html") + assert_html "/foo/foo;bar.html", get("/foo/foo;bar.html") + assert_html "/foo/foo:bar.html", get("/foo/foo:bar.html") + assert_html "/foo/foo@bar.html", get("/foo/foo@bar.html") + end + private def assert_html(body, response) diff --git a/actionpack/test/fixtures/public/foo/foo!bar.html b/actionpack/test/fixtures/public/foo/foo!bar.html new file mode 100644 index 0000000000000..2928f2717fafe --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo!bar.html @@ -0,0 +1 @@ +/foo/foo!bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo$bar.html b/actionpack/test/fixtures/public/foo/foo$bar.html new file mode 100644 index 0000000000000..4f837df01da85 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo$bar.html @@ -0,0 +1 @@ +/foo/foo$bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo&bar.html b/actionpack/test/fixtures/public/foo/foo&bar.html new file mode 100644 index 0000000000000..c194e8de87b84 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo&bar.html @@ -0,0 +1 @@ +/foo/foo&bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo'bar.html b/actionpack/test/fixtures/public/foo/foo'bar.html new file mode 100644 index 0000000000000..25c3275736bc7 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo'bar.html @@ -0,0 +1 @@ +/foo/foo'bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo(bar).html b/actionpack/test/fixtures/public/foo/foo(bar).html new file mode 100644 index 0000000000000..94fa4cb944cf4 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo(bar).html @@ -0,0 +1 @@ +/foo/foo(bar).html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo*bar.html b/actionpack/test/fixtures/public/foo/foo*bar.html new file mode 100644 index 0000000000000..79d5194c8d94f --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo*bar.html @@ -0,0 +1 @@ +/foo/foo*bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo+bar.html b/actionpack/test/fixtures/public/foo/foo+bar.html new file mode 100644 index 0000000000000..0fdc2ecabcfed --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo+bar.html @@ -0,0 +1 @@ +/foo/foo+bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo,bar.html b/actionpack/test/fixtures/public/foo/foo,bar.html new file mode 100644 index 0000000000000..f040fce197f45 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo,bar.html @@ -0,0 +1 @@ +/foo/foo,bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo:bar.html b/actionpack/test/fixtures/public/foo/foo:bar.html new file mode 100644 index 0000000000000..7900a2642bc49 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo:bar.html @@ -0,0 +1 @@ +/foo/foo:bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo;bar.html b/actionpack/test/fixtures/public/foo/foo;bar.html new file mode 100644 index 0000000000000..224837695476f --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo;bar.html @@ -0,0 +1 @@ +/foo/foo;bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo=bar.html b/actionpack/test/fixtures/public/foo/foo=bar.html new file mode 100644 index 0000000000000..206f69e286e26 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo=bar.html @@ -0,0 +1 @@ +/foo/foo=bar.html \ No newline at end of file diff --git a/actionpack/test/fixtures/public/foo/foo@bar.html b/actionpack/test/fixtures/public/foo/foo@bar.html new file mode 100644 index 0000000000000..4e8e90f9b8e78 --- /dev/null +++ b/actionpack/test/fixtures/public/foo/foo@bar.html @@ -0,0 +1 @@ +/foo/foo@bar.html \ No newline at end of file