Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fix ActionDispatch::Static to serve files with unencoded PCHAR

RFC 3986[1] allows sub-delim characters in path segments unencoded,
however Rack::File requires them to be encoded so we use URI's
unescape method to leave them alone and then escape them again.

Also since the path gets passed to Dir[] we need to escape any glob
characters in the path.

[1]: http://www.ietf.org/rfc/rfc3986.txt
  • Loading branch information...
commit 86d3bc37b8f302e8dbe5ad1095ea2723fc87f8c0 1 parent 1a0bc2a
@pixeltrix pixeltrix authored
View
12 actionpack/lib/action_dispatch/middleware/static.rb
@@ -11,14 +11,14 @@ def initialize(root, cache_control)
def match?(path)
path = path.dup
- full_path = path.empty? ? @root : File.join(@root, ::Rack::Utils.unescape(path))
+ full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path)))
paths = "#{full_path}#{ext}"
matches = Dir[paths]
match = matches.detect { |m| File.file?(m) }
if match
match.sub!(@compiled_root, '')
- match
+ ::Rack::Utils.escape(match)
end
end
@@ -32,6 +32,14 @@ def ext
"{,#{ext},/index#{ext}}"
end
end
+
+ def unescape_path(path)
+ URI.parser.unescape(path)
+ end
+
+ def escape_glob_chars(path)
+ path.gsub(/(\*|\?|\[|\]|\{|\})/, "\\\\\\1")
+ end
end
class Static
View
28 actionpack/test/dispatch/static_test.rb
@@ -30,6 +30,34 @@ def test_serves_static_index_file_in_directory
assert_html "/foo/index.html", get("/foo")
end
+ def test_serves_static_file_with_encoded_pchar
+ assert_html "/foo/foo!bar.html", get("/foo/foo%21bar.html")
+ assert_html "/foo/foo$bar.html", get("/foo/foo%24bar.html")
+ assert_html "/foo/foo&bar.html", get("/foo/foo%26bar.html")
+ assert_html "/foo/foo'bar.html", get("/foo/foo%27bar.html")
+ assert_html "/foo/foo(bar).html", get("/foo/foo%28bar%29.html")
+ assert_html "/foo/foo*bar.html", get("/foo/foo%2Abar.html")
+ assert_html "/foo/foo+bar.html", get("/foo/foo%2Bbar.html")
+ assert_html "/foo/foo,bar.html", get("/foo/foo%2Cbar.html")
+ assert_html "/foo/foo;bar.html", get("/foo/foo%3Bbar.html")
+ assert_html "/foo/foo:bar.html", get("/foo/foo%3Abar.html")
+ assert_html "/foo/foo@bar.html", get("/foo/foo%40bar.html")
+ end
+
+ def test_serves_static_file_with_unencoded_pchar
+ assert_html "/foo/foo!bar.html", get("/foo/foo!bar.html")
+ assert_html "/foo/foo$bar.html", get("/foo/foo$bar.html")
+ assert_html "/foo/foo&bar.html", get("/foo/foo&bar.html")
+ assert_html "/foo/foo'bar.html", get("/foo/foo'bar.html")
+ assert_html "/foo/foo(bar).html", get("/foo/foo(bar).html")
+ assert_html "/foo/foo*bar.html", get("/foo/foo*bar.html")
+ assert_html "/foo/foo+bar.html", get("/foo/foo+bar.html")
+ assert_html "/foo/foo,bar.html", get("/foo/foo,bar.html")
+ assert_html "/foo/foo;bar.html", get("/foo/foo;bar.html")
+ assert_html "/foo/foo:bar.html", get("/foo/foo:bar.html")
+ assert_html "/foo/foo@bar.html", get("/foo/foo@bar.html")
+ end
+
private
def assert_html(body, response)
View
1  actionpack/test/fixtures/public/foo/foo!bar.html
@@ -0,0 +1 @@
+/foo/foo!bar.html
View
1  actionpack/test/fixtures/public/foo/foo$bar.html
@@ -0,0 +1 @@
+/foo/foo$bar.html
View
1  actionpack/test/fixtures/public/foo/foo&bar.html
@@ -0,0 +1 @@
+/foo/foo&bar.html
View
1  actionpack/test/fixtures/public/foo/foo'bar.html
@@ -0,0 +1 @@
+/foo/foo'bar.html
View
1  actionpack/test/fixtures/public/foo/foo(bar).html
@@ -0,0 +1 @@
+/foo/foo(bar).html
View
1  actionpack/test/fixtures/public/foo/foo*bar.html
@@ -0,0 +1 @@
+/foo/foo*bar.html
View
1  actionpack/test/fixtures/public/foo/foo+bar.html
@@ -0,0 +1 @@
+/foo/foo+bar.html
View
1  actionpack/test/fixtures/public/foo/foo,bar.html
@@ -0,0 +1 @@
+/foo/foo,bar.html
View
1  actionpack/test/fixtures/public/foo/foo:bar.html
@@ -0,0 +1 @@
+/foo/foo:bar.html
View
1  actionpack/test/fixtures/public/foo/foo;bar.html
@@ -0,0 +1 @@
+/foo/foo;bar.html
View
1  actionpack/test/fixtures/public/foo/foo=bar.html
@@ -0,0 +1 @@
+/foo/foo=bar.html
View
1  actionpack/test/fixtures/public/foo/foo@bar.html
@@ -0,0 +1 @@
+/foo/foo@bar.html

4 comments on commit 86d3bc3

@tenderlove
Owner

Is there a ticket associated with this commit? Seems it breaks existing behavior as noted in #5337

@pixeltrix
Owner

Tickets #790 and #5058.

@pixeltrix
Owner

Also this is why we have to do this: rack/rack#265

@tenderlove
Owner

@pixeltrix makes sense. Thanks! :heart:

Please sign in to comment.
Something went wrong with that request. Please try again.