diff options
author | Douwe Maan <douwe@gitlab.com> | 2015-04-10 19:16:46 +0300 |
---|---|---|
committer | Douwe Maan <douwe@gitlab.com> | 2015-04-10 19:18:37 +0300 |
commit | edd05fc48c748ba0945652c8c83e7617ccc029fc (patch) | |
tree | 53c9629c75938e954e4a8423596bd7d7df6a92a5 /app/controllers/help_controller.rb | |
parent | 93133f4da9d950f47ca0ba2e437f9c004567e6f7 (diff) |
Fix directory traversal vulnerability around help pages.
Diffstat (limited to 'app/controllers/help_controller.rb')
-rw-r--r-- | app/controllers/help_controller.rb | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/app/controllers/help_controller.rb b/app/controllers/help_controller.rb index fbd9e67e6df..0010caad773 100644 --- a/app/controllers/help_controller.rb +++ b/app/controllers/help_controller.rb @@ -3,7 +3,7 @@ class HelpController < ApplicationController end def show - @filepath = params[:filepath] + @filepath = clean_path_info(params[:filepath]) @format = params[:format] respond_to do |format| @@ -36,4 +36,22 @@ class HelpController < ApplicationController def ui end + + # Taken from ActionDispatch::FileHandler + PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact) + + def clean_path_info(path_info) + parts = path_info.split PATH_SEPS + + clean = [] + + parts.each do |part| + next if part.empty? || part == '.' + part == '..' ? clean.pop : clean << part + end + + clean.unshift '/' if parts.empty? || parts.first.empty? + + ::File.join(*clean) + end end |