Path components weren't being escaped before being used in a Regex. #41
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sporkmonger
added a commit
that referenced
this pull request
Jul 30, 2011
Path components weren't being escaped before being used in a Regex.
|
Good catch. Sloppy mistake on my part. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I found that normalize_path would throw a RegexpError while trying to handle something like '/path(/..' .. It wasn't escaping components of the path before inserting it into another regex. As a result, any regexy syntax could influence the outcome of the normalization, either by causing an exception or causing the normalization to fail to return what was expected.
If you take a look at my commit, you can see that I've added to the specs to demonstrate both the example I gave before, as well as normalizing something like '/(path)/..' .. I did each of these twice, with and without a trailing '/', in order to ensure that both paths in the regex were followed.