123456789_123456789_123456789_123456789_123456789_

Class: Rack::Protection::PathTraversal

Relationships & Source Files
Super Chains via Extension / Inclusion / Inheritance
Class Chain:
self, Base
Instance Chain:
self, Base
Inherits: Rack::Protection::Base
Defined in: rack-protection/lib/rack/protection/path_traversal.rb

Overview

Prevented attack:: Directory traversal Supported browsers:: all More infos:: http://en.wikipedia.org/wiki/Directory_traversal

Unescapes '/' and '.', expands path_info. Thus GET /foo/%2e%2e%2fbar becomes GET /bar.

Constant Summary

Base - Inherited

DEFAULT_OPTIONS

Class Method Summary

Base - Inherited

.default_options, .default_reaction, .new

Instance Attribute Summary

Base - Inherited

#app, #options

Instance Method Summary

Base - Inherited

#accepts?, #call, #default_options,
#default_reaction

Alias for Base#deny.
#deny, #drop_session, #encrypt, #html?, #instrument, #origin, #random_string, #react, #referrer, #report, #safe?, #secure_compare, #session, #session?, #warn

Constructor Details

This class inherits a constructor from Rack::Protection::Base

Instance Method Details

#call(env)

[ GitHub ] 

  


# File 'rack-protection/lib/rack/protection/path_traversal.rb', line 15



def call(env)
  path_was         = env['PATH_INFO']
  env['PATH_INFO'] = cleanup path_was if path_was && !path_was.empty?
  app.call env
ensure
  env['PATH_INFO'] = path_was
end


  








  

    #cleanup(path)  
  

  [ GitHub ]


  

  


# File 'rack-protection/lib/rack/protection/path_traversal.rb', line 23



def cleanup(path)
  encoding = path.encoding
  dot   = '.'.encode(encoding)
  slash = '/'.encode(encoding)
  backslash = '\\'.encode(encoding)

  parts     = []
  unescaped = path.gsub(/%2e/i, dot).gsub(/%2f/i, slash).gsub(/%5c/i, backslash)
  unescaped = unescaped.gsub(backslash, slash)

  unescaped.split(slash).each do |part|
    next if part.empty? || (part == dot)

    part == '..' ? parts.pop : parts << part
  end

  cleaned = slash + parts.join(slash)
  cleaned << slash if parts.any? && unescaped =~ (%r{/\.{0,2}$})
  cleaned
end