actionpack-page_caching 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 92965e865a7dfa9dcb0c95f6ccbe2e6a67368eab493c5d6187ecf433cdade0d4
-  data.tar.gz: 5ac29afdd687929ae4a4d1d22b7f58f60663e71c9a07df415ca16fc863c38a2d
+  metadata.gz: e05a1101088109a89222cab310b3a204adc41ca807298071947a51e41f6d8094
+  data.tar.gz: d8072a7636a2810fc89b2b2aa3527fdc774b0d6d48a369c2557607c4fa2024f7
 SHA512:
-  metadata.gz: 8d854ecd63f9ac358593acc46915e2615e8681408dee8c04ee97b34f21d692c9200a6b249cb02f2d4e59a1258c7f030ca73ee700ca7d5c5f6d9156749fe08d79
-  data.tar.gz: b5c41eb6c92adb0ea3db3f1ac8b250b739e5119aa006a74dce7ab54ac9921be6d9437ed49ffec702c5fce8e78edb056f23f81b190b7d1bf36522549f1fbdc93b
+  metadata.gz: 419d93b05fa1dad596777d2b184d372605f37f56c24aa3641802dadf4edf610e9db0d2ac25b6704e4e805d0da02e3f43addd7513e4cb6e254a07b2daad6f9abb
+  data.tar.gz: 1a30d10500acd08de97b3e93a460e281a727acedb19b851a315a9b57b48da3c6ad105e55d4387ef6e42fb2a16fb3aaa0f5b2540df13762e20dbda98ace0ca2b7

data/actionpack-page_caching.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |gem|
   gem.name          = "actionpack-page_caching"
-  gem.version       = "1.2.0"
+  gem.version       = "1.2.1"
   gem.author        = "David Heinemeier Hansson"
   gem.email         = "david@loudthinking.com"
   gem.description   = "Static page caching for Action Pack (removed from core in Rails 4.0)"

data/lib/action_controller/caching/pages.rb

@@ -93,6 +93,10 @@ module ActionController
             end
           end
 
+          def normalized_cache_directory
+            File.expand_path(cache_directory)
+          end
+
           def handle_proc_cache_directory
             if @controller
               @controller.instance_exec(&@cache_directory)
@@ -153,15 +157,22 @@ module ActionController
           end
 
           def cache_path(path, extension = nil)
-            File.join(cache_directory, cache_file(path, extension))
+            unnormalized_path = File.join(normalized_cache_directory, cache_file(path, extension))
+            normalized_path = File.expand_path(unnormalized_path)
+
+            relative_path if normalized_path.start_with?(normalized_cache_directory)
           end
 
           def delete(path)
+            return unless path
+
             File.delete(path) if File.exist?(path)
             File.delete(path + ".gz") if File.exist?(path + ".gz")
           end
 
           def write(content, path, gzip)
+            return unless path
+
             FileUtils.makedirs(File.dirname(path))
             File.open(path, "wb+") { |f| f.write(content) }
 

data/test/caching_test.rb

@@ -1,11 +1,13 @@
 require "abstract_unit"
 require "mocha/setup"
+require "find"
 
 CACHE_DIR = "test_cache"
 # Don't change "../tmp" cavalierly or you might hose something you don't want hosed
 TEST_TMP_DIR = File.expand_path("../tmp", __FILE__)
 FILE_STORE_PATH = File.join(TEST_TMP_DIR, CACHE_DIR)
 
+
 module PageCachingTestHelpers
   def setup
     super
@@ -175,6 +177,25 @@ class PageCachingTest < ActionController::TestCase
   include PageCachingTestHelpers
   tests PageCachingTestController
 
+  def test_cache_does_not_escape
+    draw do
+      get "/page_caching_test/ok/:id", to: "page_caching_test#ok"
+    end
+
+    project_root = File.expand_path("../../", __FILE__)
+
+
+    # Make a path that escapes the cache directory
+    get_to_root = "../../../"
+
+    # Make sure this relative path points at the project root
+    assert_equal project_root, File.expand_path(File.join(FILE_STORE_PATH, get_to_root))
+
+    get :ok, params: { id: "#{get_to_root}../pwnd" }
+
+    assert_predicate Find.find(File.join(project_root, "test")).grep(/pwnd/), :empty?
+  end
+
   def test_page_caching_resources_saves_to_correct_path_with_extension_even_if_default_route
     draw do
       get "posts.:format", to: "posts#index", as: :formatted_posts

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack-page_caching
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-11 00:00:00.000000000 Z
+date: 2020-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: actionpack
@@ -85,7 +85,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.2.0.pre1
 signing_key: 
 specification_version: 4
 summary: Static page caching for Action Pack (removed from core in Rails 4.0)