actionpack-page_caching 1.2.0 → 1.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92965e865a7dfa9dcb0c95f6ccbe2e6a67368eab493c5d6187ecf433cdade0d4
-  data.tar.gz: 5ac29afdd687929ae4a4d1d22b7f58f60663e71c9a07df415ca16fc863c38a2d
+  metadata.gz: b3c84b38d08e6b8ec36bf104688be7f8a9a1de1c05bdf10796289cb27a8e9883
+  data.tar.gz: 9b05d100d1820f6a0b480b015d8123ce4d0bae52229ac16d6d5833d787e265c7
 SHA512:
-  metadata.gz: 8d854ecd63f9ac358593acc46915e2615e8681408dee8c04ee97b34f21d692c9200a6b249cb02f2d4e59a1258c7f030ca73ee700ca7d5c5f6d9156749fe08d79
-  data.tar.gz: b5c41eb6c92adb0ea3db3f1ac8b250b739e5119aa006a74dce7ab54ac9921be6d9437ed49ffec702c5fce8e78edb056f23f81b190b7d1bf36522549f1fbdc93b
+  metadata.gz: 9583f9359843f6fa8b86cf3db2d46a5597cc7bc9c96fef71d741e30c01d04efda3b7f78642bf7d4a67f7421b3c1630c17099897381139573bb0500c41a824fb5
+  data.tar.gz: cb7f51ee9ce237b63ea2a5e8ecd88b1d33cc83483660939608c62b8ea8d1804fdd854cbd11c914010963b0fa7f8b5f25d06926444ba10164819b8b3fe6f0ed14

data/actionpack-page_caching.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |gem|
   gem.name          = "actionpack-page_caching"
-  gem.version       = "1.2.0"
+  gem.version       = "1.2.3"
   gem.author        = "David Heinemeier Hansson"
   gem.email         = "david@loudthinking.com"
   gem.description   = "Static page caching for Action Pack (removed from core in Rails 4.0)"

data/lib/action_controller/caching/pages.rb

@@ -93,6 +93,10 @@ module ActionController
             end
           end
 
+          def normalized_cache_directory
+            File.expand_path(cache_directory)
+          end
+
           def handle_proc_cache_directory
             if @controller
               @controller.instance_exec(&@cache_directory)
@@ -153,15 +157,22 @@ module ActionController
           end
 
           def cache_path(path, extension = nil)
-            File.join(cache_directory, cache_file(path, extension))
+            unnormalized_path = File.join(normalized_cache_directory, cache_file(path, extension))
+            normalized_path = File.expand_path(unnormalized_path)
+
+            normalized_path if normalized_path.start_with?(normalized_cache_directory)
           end
 
           def delete(path)
+            return unless path
+
             File.delete(path) if File.exist?(path)
             File.delete(path + ".gz") if File.exist?(path + ".gz")
           end
 
           def write(content, path, gzip)
+            return unless path
+
             FileUtils.makedirs(File.dirname(path))
             File.open(path, "wb+") { |f| f.write(content) }
 

data/lib/action_controller/page_caching.rb

@@ -2,12 +2,8 @@ require "action_controller/caching/pages"
 
 module ActionController
   module Caching
-    eager_autoload do
-      autoload :Pages
-    end
-
     include Pages
   end
 end
 
-ActionController::Base.send(:include, ActionController::Caching::Pages)
+ActionController::Base.include(ActionController::Caching::Pages)

data/test/caching_test.rb

@@ -1,11 +1,13 @@
 require "abstract_unit"
 require "mocha/setup"
+require "find"
 
 CACHE_DIR = "test_cache"
 # Don't change "../tmp" cavalierly or you might hose something you don't want hosed
 TEST_TMP_DIR = File.expand_path("../tmp", __FILE__)
 FILE_STORE_PATH = File.join(TEST_TMP_DIR, CACHE_DIR)
 
+
 module PageCachingTestHelpers
   def setup
     super
@@ -175,6 +177,25 @@ class PageCachingTest < ActionController::TestCase
   include PageCachingTestHelpers
   tests PageCachingTestController
 
+  def test_cache_does_not_escape
+    draw do
+      get "/page_caching_test/ok/:id", to: "page_caching_test#ok"
+    end
+
+    project_root = File.expand_path("../../", __FILE__)
+
+
+    # Make a path that escapes the cache directory
+    get_to_root = "../../../"
+
+    # Make sure this relative path points at the project root
+    assert_equal project_root, File.expand_path(File.join(FILE_STORE_PATH, get_to_root))
+
+    get :ok, params: { id: "#{get_to_root}../pwnd" }
+
+    assert_predicate Find.find(File.join(project_root, "test")).grep(/pwnd/), :empty?
+  end
+
   def test_page_caching_resources_saves_to_correct_path_with_extension_even_if_default_route
     draw do
       get "posts.:format", to: "posts#index", as: :formatted_posts

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack-page_caching
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.3
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-11 00:00:00.000000000 Z
+date: 2020-06-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -85,7 +85,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Static page caching for Action Pack (removed from core in Rails 4.0)