mongrel 1.1.2-java → 1.1.3-java

data.tar.gz.sig

@@ -1 +1 @@
-�� �P��J�������#n�	��N_���mv`�7���@�6�p��2$(�w��j�\_��c��qvPG��|���c�96|�OY�����}6v��I=9����6Oh��(��a��޷
+���n�@�@݇ϖU0�	H�f&ΪRY�.5jr[�r���$=o��M	�ֹ�(�J�'P���Q0��d>��"L��N���0�}�`OѬ')cE>T;wx��O[G��)ـ����iU'�r뱠}Fk�׵���k͍0��=IO�Ӎ�Q���
�:"�ܾ�'�����#D�I-�D���V����v;/}��V��ȧZ>�`Ԟ��r�1D�v�
'aY8����*d�g�m�i�O�_�g�

data/CHANGELOG

@@ -1,4 +1,6 @@
 
+v1.1.3. Fix security flaw of DirHandler; reported on mailing list.
+
 v1.1.2. Fix worker termination bug; fix JRuby 1.0.3 load order issue; fix require issue on systems without Rubygems.
 
 v1.1.1. Fix mongrel_rails restart bug; fix bug with Rack status codes.

data/ext/http11/http11.c

@@ -384,7 +384,7 @@ void Init_http11()
   DEF_GLOBAL(server_protocol, "SERVER_PROTOCOL");
   DEF_GLOBAL(server_protocol_value, "HTTP/1.1");
   DEF_GLOBAL(http_host, "HTTP_HOST");
-  DEF_GLOBAL(mongrel_version, "Mongrel 1.1.2"); /* XXX Why is this defined here? */
+  DEF_GLOBAL(mongrel_version, "Mongrel 1.1.3"); /* XXX Why is this defined here? */
   DEF_GLOBAL(server_software, "SERVER_SOFTWARE");
   DEF_GLOBAL(port_80, "80");
 

data/ext/http11_java/org/jruby/mongrel/Http11.java

@@ -215,7 +215,7 @@ public class Http11 extends RubyObject {
 
                 req.setInstanceVariable("@http_body", RubyString.newString(runtime, new ByteList(hp.parser.buffer, at, length)));
                 req.aset(runtime.newString("SERVER_PROTOCOL"),runtime.newString("HTTP/1.1"));
-                req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.2"));
+                req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.3"));
             }
         };
 

data/lib/mongrel/const.rb

@@ -65,7 +65,7 @@ module Mongrel
     REQUEST_URI='REQUEST_URI'.freeze
     REQUEST_PATH='REQUEST_PATH'.freeze
 
-    MONGREL_VERSION="1.1.2".freeze
+    MONGREL_VERSION="1.1.3".freeze
 
     MONGREL_TMP_BASE="mongrel".freeze
 

data/lib/mongrel/handlers.rb

@@ -132,8 +132,12 @@ module Mongrel
       # Add the drive letter or root path
       req_path = File.join(@path, req_path) if @path
       req_path = File.expand_path req_path
-      
-      if File.exist? req_path
+     
+      # do not remove the check for @path at the beginning, it's what prevents
+      # the serving of arbitrary files (and good programmer Rule #1 Says: If
+      # you don't understand something, it's not because I'm stupid, it's
+      # because you are).
+      if req_path.index(@path) == 0 and File.exist? req_path
         # It exists and it's in the right location
         if File.directory? req_path
           # The request is for a directory
@@ -153,7 +157,7 @@ module Mongrel
           return req_path
         end
       else
-        # does not exist or isn't in the right spot
+        # does not exist or isn't in the right spot or isn't valid because not start with @path
         return nil
       end
     end

data/mongrel.gemspec

@@ -1,23 +1,23 @@
 
-# Gem::Specification for Mongrel-1.1.2
+# Gem::Specification for Mongrel-1.1.3
 # Originally generated by Echoe
 
 Gem::Specification.new do |s|
   s.name = %q{mongrel}
-  s.version = "1.1.2"
+  s.version = "1.1.3"
   s.platform = %q{java}
 
   s.specification_version = 2 if s.respond_to? :specification_version=
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Zed A. Shaw"]
-  s.date = %q{2007-12-22}
+  s.date = %q{2008-01-02}
   s.default_executable = %q{mongrel_rails}
   s.description = %q{A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps.}
   s.email = %q{}
   s.executables = ["mongrel_rails"]
   s.has_rdoc = true
-  s.homepage = %q{}
+  s.homepage = %q{http://mongrel.rubyforge.org}
   s.require_paths = ["lib", "ext"]
   s.required_ruby_version = Gem::Requirement.new(">= 1.8.4")
   s.rubyforge_project = %q{mongrel}
@@ -40,20 +40,22 @@ end
 #   p.summary = "A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps."
 #   p.author ="Zed A. Shaw"
 #   p.clean_pattern = ['ext/http11/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'lib/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'ext/http11/Makefile', 'pkg', 'lib/*.bundle', '*.gem', 'site/output', '.config', 'lib/http11.jar', 'ext/http11_java/classes', 'coverage']
+#   p.url = "http://mongrel.rubyforge.org"
 #   p.rdoc_pattern = ['README', 'LICENSE', 'CHANGELOG', 'COPYING', 'lib/**/*.rb', 'doc/**/*.rdoc']
 #   p.ignore_pattern = /^(pkg|site|projects|doc|log)|CVS|\.log/
-#   p.ruby_version = '>= 1.8.4'
+#   p.ruby_version = '>=1.8.4'
 #   p.dependencies = ['gem_plugin >=0.2.3']  
 #   p.extension_pattern = nil
 #   
+#     when 'eweaver' 
+#     when 'luislavena'
+#   end
+#   
 #   p.need_tar_gz = false
 #   p.need_tgz = true
 # 
-#   case RUBY_PLATFORM
-#     when /mswin/
-#     when /java/
-#     else
-#       p.extension_pattern = ["ext/**/extconf.rb"]
+#   if RUBY_PLATFORM !~ /mswin|java/
+#     p.extension_pattern = ["ext/**/extconf.rb"]
 #   end
 # 
 #   p.eval = proc do
@@ -64,7 +66,7 @@ end
 #       add_dependency('cgi_multipart_eof_fix', '>= 2.4')
 #     when /java/
 #       self.files += ['lib/http11.jar']
-#       self.platform = 'jruby'
+#       self.platform = 'jruby' # XXX Is this right?
 #     else
 #       add_dependency('daemons', '>= 1.0.3')
 #       add_dependency('fastthread', '>= 1.0.1')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: mongrel
 version: !ruby/object:Gem::Version 
-  version: 1.1.2
+  version: 1.1.3
 platform: java
 authors: 
 - Zed A. Shaw
@@ -52,7 +52,7 @@ cert_chain:
   ALN3mi/9z0Mf1YroliUgF0v5Yw==
   -----END CERTIFICATE-----
 
-date: 2007-12-22 00:00:00 -05:00
+date: 2008-01-02 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -144,7 +144,7 @@ files:
 - tools/trickletest.rb
 - lib/http11.jar
 has_rdoc: true
-homepage: ""
+homepage: http://mongrel.rubyforge.org
 post_install_message: 
 rdoc_options: []
 

metadata.gz.sig

@@ -1,4 +1 @@
-O�<�c����,5x�"�~d��ӌ����l����� �'�G D��u=f����(k��*�}���V�Ϫ�
-����*u�[w�4CfS�V����].a��!c,���e���&�[�C
�79
-���Z���h�BJw,
X�(�P������
-1��-�r����`l����%K�#�B��|��'G�q��X��
+S	Q[~of�G~L��(v�e�=�=G����������n�1��=b2��G��ZT�߱��ѥ�d������ŴP�LȊ4o��0vB(Ö$�Z�)�a2t'�]��A�r�K��'���P�z)�Vm��=X������e^��qq�*�$FJ����jKMJt8DN�	&��Ka�s
�l��1�	��N���i�u�.�K`T��H��h�5�@�4�x^�01�w�K�-�����2$�L�/(9��Q��.��