mongrel 1.1.2 → 1.1.3

data/CHANGELOG

@@ -1,4 +1,6 @@
 
+v1.1.3. Fix security flaw of DirHandler; reported on mailing list.
+
 v1.1.2. Fix worker termination bug; fix JRuby 1.0.3 load order issue; fix require issue on systems without Rubygems.
 
 v1.1.1. Fix mongrel_rails restart bug; fix bug with Rack status codes.

data/ext/http11/http11.c

@@ -384,7 +384,7 @@ void Init_http11()
   DEF_GLOBAL(server_protocol, "SERVER_PROTOCOL");
   DEF_GLOBAL(server_protocol_value, "HTTP/1.1");
   DEF_GLOBAL(http_host, "HTTP_HOST");
-  DEF_GLOBAL(mongrel_version, "Mongrel 1.1.2"); /* XXX Why is this defined here? */
+  DEF_GLOBAL(mongrel_version, "Mongrel 1.1.3"); /* XXX Why is this defined here? */
   DEF_GLOBAL(server_software, "SERVER_SOFTWARE");
   DEF_GLOBAL(port_80, "80");
 

data/ext/http11_java/org/jruby/mongrel/Http11.java

@@ -215,7 +215,7 @@ public class Http11 extends RubyObject {
 
                 req.setInstanceVariable("@http_body", RubyString.newString(runtime, new ByteList(hp.parser.buffer, at, length)));
                 req.aset(runtime.newString("SERVER_PROTOCOL"),runtime.newString("HTTP/1.1"));
-                req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.2"));
+                req.aset(runtime.newString("SERVER_SOFTWARE"),runtime.newString("Mongrel 1.1.3"));
             }
         };
 

data/lib/mongrel/const.rb

@@ -65,7 +65,7 @@ module Mongrel
     REQUEST_URI='REQUEST_URI'.freeze
     REQUEST_PATH='REQUEST_PATH'.freeze
 
-    MONGREL_VERSION="1.1.2".freeze
+    MONGREL_VERSION="1.1.3".freeze
 
     MONGREL_TMP_BASE="mongrel".freeze
 

data/lib/mongrel/handlers.rb

@@ -132,8 +132,12 @@ module Mongrel
       # Add the drive letter or root path
       req_path = File.join(@path, req_path) if @path
       req_path = File.expand_path req_path
-      
-      if File.exist? req_path
+     
+      # do not remove the check for @path at the beginning, it's what prevents
+      # the serving of arbitrary files (and good programmer Rule #1 Says: If
+      # you don't understand something, it's not because I'm stupid, it's
+      # because you are).
+      if req_path.index(@path) == 0 and File.exist? req_path
         # It exists and it's in the right location
         if File.directory? req_path
           # The request is for a directory
@@ -153,7 +157,7 @@ module Mongrel
           return req_path
         end
       else
-        # does not exist or isn't in the right spot
+        # does not exist or isn't in the right spot or isn't valid because not start with @path
         return nil
       end
     end

data/mongrel.gemspec

@@ -1,27 +1,27 @@
 
-# Gem::Specification for Mongrel-1.1.2
+# Gem::Specification for Mongrel-1.1.3
 # Originally generated by Echoe
 
 Gem::Specification.new do |s|
   s.name = %q{mongrel}
-  s.version = "1.1.2"
+  s.version = "1.1.3"
 
   s.specification_version = 2 if s.respond_to? :specification_version=
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Zed A. Shaw"]
-  s.date = %q{2007-12-15}
+  s.date = %q{2008-01-01}
   s.default_executable = %q{mongrel_rails}
   s.description = %q{A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps.}
   s.email = %q{}
   s.executables = ["mongrel_rails"]
   s.extensions = ["ext/http11/extconf.rb"]
   s.has_rdoc = true
-  s.homepage = %q{}
+  s.homepage = %q{http://mongrel.rubyforge.org}
   s.require_paths = ["lib", "ext"]
   s.required_ruby_version = Gem::Requirement.new(">= 1.8.4")
   s.rubyforge_project = %q{mongrel}
-  s.rubygems_version = %q{0.9.5}
+  s.rubygems_version = %q{1.0.1}
   s.summary = %q{A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps.}
   s.test_files = ["test/test_cgi_wrapper.rb", "test/test_command.rb", "test/test_conditional.rb", "test/test_configurator.rb", "test/test_debug.rb", "test/test_handlers.rb", "test/test_http11.rb", "test/test_redirect_handler.rb", "test/test_request_progress.rb", "test/test_response.rb", "test/test_stats.rb", "test/test_uriclassifier.rb", "test/test_ws.rb"]
 
@@ -43,20 +43,22 @@ end
 #   p.summary = "A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps."
 #   p.author ="Zed A. Shaw"
 #   p.clean_pattern = ['ext/http11/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'lib/*.{bundle,so,o,obj,pdb,lib,def,exp}', 'ext/http11/Makefile', 'pkg', 'lib/*.bundle', '*.gem', 'site/output', '.config', 'lib/http11.jar', 'ext/http11_java/classes', 'coverage']
+#   p.url = "http://mongrel.rubyforge.org"
 #   p.rdoc_pattern = ['README', 'LICENSE', 'CHANGELOG', 'COPYING', 'lib/**/*.rb', 'doc/**/*.rdoc']
 #   p.ignore_pattern = /^(pkg|site|projects|doc|log)|CVS|\.log/
-#   p.ruby_version = '>= 1.8.4'
+#   p.ruby_version = '>=1.8.4'
 #   p.dependencies = ['gem_plugin >=0.2.3']  
 #   p.extension_pattern = nil
 #   
+#     when 'eweaver' 
+#     when 'luislavena'
+#   end
+#   
 #   p.need_tar_gz = false
 #   p.need_tgz = true
 # 
-#   case RUBY_PLATFORM
-#     when /mswin/
-#     when /java/
-#     else
-#       p.extension_pattern = ["ext/**/extconf.rb"]
+#   if RUBY_PLATFORM !~ /mswin|java/
+#     p.extension_pattern = ["ext/**/extconf.rb"]
 #   end
 # 
 #   p.eval = proc do
@@ -67,7 +69,7 @@ end
 #       add_dependency('cgi_multipart_eof_fix', '>= 2.4')
 #     when /java/
 #       self.files += ['lib/http11.jar']
-#       self.platform = 'jruby'
+#       self.platform = 'jruby' # XXX Is this right?
 #     else
 #       add_dependency('daemons', '>= 1.0.3')
 #       add_dependency('fastthread', '>= 1.0.1')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: mongrel
 version: !ruby/object:Gem::Version 
-  version: 1.1.2
+  version: 1.1.3
 platform: ruby
 authors: 
 - Zed A. Shaw
@@ -52,7 +52,7 @@ cert_chain:
   ALN3mi/9z0Mf1YroliUgF0v5Yw==
   -----END CERTIFICATE-----
 
-date: 2007-12-15 00:00:00 -05:00
+date: 2008-01-01 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -170,7 +170,7 @@ files:
 - TODO
 - tools/trickletest.rb
 has_rdoc: true
-homepage: ""
+homepage: http://mongrel.rubyforge.org
 post_install_message: 
 rdoc_options: []
 
@@ -192,7 +192,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: mongrel
-rubygems_version: 0.9.5
+rubygems_version: 1.0.1
 signing_key: 
 specification_version: 2
 summary: A small fast HTTP library and server that runs Rails, Camping, Nitro and Iowa apps.