rack-combobot 0.0.2 → 0.0.3

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    rack-combobot (0.0.1)
+    rack-combobot (0.0.2)
       rack
       rake
 

data/lib/rack/combobot.rb

@@ -1,6 +1,6 @@
 require "rack/combobot/config"
 require "pathname"
-require 'uri'
+require "uri"
 
 module Rack
   class Combobot
@@ -24,25 +24,42 @@ module Rack
       file_names  = params.split("&")
       extention   = file_names[0].split(".").last
 
-      # TODO: create a simple key value hash with the query string as key
-      combo = Combination.new(@config.root, file_names).combine
+      begin
+        combo = Combination.new(@config.root, file_names).combine
+        [200, {"Content-Type" => MIME_TYPES[extention]}, [combo]]
+      rescue Combination::PathError
+        not_found
+      end
+    end
 
-      [200, {"Content-Type" => MIME_TYPES[extention]}, combo]
+    def not_found
+      [404, {'Content-Type' => 'text/html'}, ['File not found']]
     end
 
     class Combination
       def initialize(root, file_names)
-        @file_contents = []
+        @file_contents = combine_files(root, file_names)
+      end
+
+      def combine_files(root, file_names = [])
+        file_names.map do |file_name|
+
+          raise PathError if file_name.include?('..') || file_name.include?("~")
 
-        file_names.each do |file_name|
-          @file_contents << ::File.open("#{root}/#{file_name}", 'r') { |f| f.read }
+          root_prefix = ::File.expand_path(".", root) + "/"
+          file_path   = ::File.expand_path(file_name, root)
+
+          raise PathError unless file_path.start_with?(root_prefix) && ::File.exist?(file_path)
+
+          file_content = ::File.open(file_path, 'r') { |f| f.read }
         end
       end
 
       def combine
         @combo ||= @file_contents.join
       end
-    end
 
+      class PathError < ArgumentError; end
+    end
   end
 end

data/rack-combobot.gemspec

@@ -4,7 +4,7 @@ $:.push File.expand_path("../lib", __FILE__)
 
 Gem::Specification.new do |s|
   s.name        = "rack-combobot"
-  s.version     = "0.0.2"
+  s.version     = "0.0.3"
   s.authors     = ["Simon Højberg", "Christopher Meiklejohn"]
   s.email       = ["r.hackr@gmail.com", "christopher.meiklejohn@gmail.com"]
   s.homepage    = "https://github.com/hojberg/rack-combobot"

data/spec/rack_combobot_spec.rb

@@ -13,7 +13,7 @@ describe "combing assets from query string" do
     }).must_equal([
       200,
       {"Content-Type" => "text/javascript"},
-      "function lorem() { return \"a\"; }\nfunction ipsum() { return \"b\"; }\n"
+      ["function lorem() { return \"a\"; }\nfunction ipsum() { return \"b\"; }\n"]
     ])
   end
 
@@ -23,7 +23,27 @@ describe "combing assets from query string" do
     }).must_equal([
       200,
       {"Content-Type" => "text/css"},
-      ".lorem { background: blue; }\n#lipsum { border: 1px solid red }\n"
+      [".lorem { background: blue; }\n#lipsum { border: 1px solid red }\n"]
+    ])
+  end
+
+  it "returns 404 when it can't find files" do
+    @app.call({
+      "QUERY_STRING" => "js3.js&js4.js"
+    }).must_equal([
+      404,
+      {'Content-Type' => 'text/html'},
+      ['File not found']
+    ])
+  end
+
+  it 'returns 404 when trying to move up from the root dir' do
+    @app.call({
+      "QUERY_STRING" => "js3.js&../../js4.js"
+    }).must_equal([
+      404,
+      {'Content-Type' => 'text/html'},
+      ['File not found']
     ])
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-combobot
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.3
   prerelease: 
 platform: ruby
 authors:
@@ -10,11 +10,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-01-06 00:00:00.000000000 Z
+date: 2012-03-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &2152913280 !ruby/object:Gem::Requirement
+  requirement: &2154066720 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -22,10 +22,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2152913280
+  version_requirements: *2154066720
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: &2152912480 !ruby/object:Gem::Requirement
+  requirement: &2154066280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -33,10 +33,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2152912480
+  version_requirements: *2154066280
 - !ruby/object:Gem::Dependency
   name: minitest
-  requirement: &2152910980 !ruby/object:Gem::Requirement
+  requirement: &2154065860 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -44,10 +44,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152910980
+  version_requirements: *2154065860
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: &2152902700 !ruby/object:Gem::Requirement
+  requirement: &2154065440 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -55,10 +55,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152902700
+  version_requirements: *2154065440
 - !ruby/object:Gem::Dependency
   name: guard
-  requirement: &2152901820 !ruby/object:Gem::Requirement
+  requirement: &2154065020 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -66,10 +66,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152901820
+  version_requirements: *2154065020
 - !ruby/object:Gem::Dependency
   name: guard-minitest
-  requirement: &2152900400 !ruby/object:Gem::Requirement
+  requirement: &2154064600 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -77,7 +77,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2152900400
+  version_requirements: *2154064600
 description: combines assets to server 1 file
 email:
 - r.hackr@gmail.com