Skip to content
Browse files

Ensure render is case sensitive even on systems with case-insensitive…

… filesystems.

This fixes CVE-2011-0449
  • Loading branch information...
1 parent e3dd210 commit 6f80224057803f85b3f448936aae89e742452c3b @josevalim josevalim committed with NZKoz Nov 28, 2010
Showing with 19 additions and 3 deletions.
  1. +9 −3 actionpack/lib/action_view/template/resolver.rb
  2. +10 −0 actionpack/test/controller/render_test.rb
View
12 actionpack/lib/action_view/template/resolver.rb
@@ -72,14 +72,20 @@ def query(path, exts, formats)
query.gsub!(/\{\.html,/, "{.html,.text.html,")
query.gsub!(/\{\.text,/, "{.text,.text.plain,")
- Dir[query].reject { |p| File.directory?(p) }.map do |p|
- handler, format = extract_handler_and_format(p, formats)
+ templates = []
+ sanitizer = Hash.new { |h,k| h[k] = Dir["#{File.dirname(k)}/*"] }
+
+ Dir[query].each do |p|
+ next if File.directory?(p) || !sanitizer[p].include?(p)
+ handler, format = extract_handler_and_format(p, formats)
contents = File.open(p, "rb") {|io| io.read }
- Template.new(contents, File.expand_path(p), handler,
+ templates << Template.new(contents, File.expand_path(p), handler,
:virtual_path => path, :format => format)
end
+
+ templates
end
# Extract handler and formats from path. If a format cannot be a found neither
View
10 actionpack/test/controller/render_test.rb
@@ -130,6 +130,10 @@ def render_action_hello_world
render :action => "hello_world"
end
+ def render_action_upcased_hello_world
+ render :action => "Hello_world"
+ end
+
def render_action_hello_world_as_string
render "hello_world"
end
@@ -736,6 +740,12 @@ def test_render_action
assert_template "test/hello_world"
end
+ def test_render_action_upcased
+ assert_raise ActionView::MissingTemplate do
+ get :render_action_upcased_hello_world
+ end
+ end
+
# :ported:
def test_render_action_hello_world_as_string
get :render_action_hello_world_as_string

0 comments on commit 6f80224

Please sign in to comment.
Something went wrong with that request. Please try again.