Sanitize directory traversal in middleware

rswag · Jun 30, 2023 · fc353ef · fc353ef
1 parent 6c07c71
commit fc353ef
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/rswag-api/lib/rswag/api/middleware.rb b/rswag-api/lib/rswag/api/middleware.rb
@@ -13,7 +13,11 @@ def initialize(app, config)
 
       def call(env)
         path = env['PATH_INFO']
-        filename = "#{@config.resolve_swagger_root(env)}/#{path}"
+        # Sanitize the filename for directory traversal by expanding, and matching the swagger root directory
+        filename = File.expand_path(File.join(@config.resolve_swagger_root(env), path))
+        unless filename.match Regexp.new('^' + Regexp.escape(@config.resolve_swagger_root(env)))
+          return @app.call(env)
+        end
 
         if env['REQUEST_METHOD'] == 'GET' && File.file?(filename)
           swagger = parse_file(filename)