rack 0.9.0 → 0.9.1

data/RDOX

@@ -103,6 +103,7 @@
 * sets Last-Modified header
 * serves files with URL encoded filenames
 * does not allow directory traversal
+* does not allow directory traversal with encoded periods
 * 404s if it can't find the file
 * detects SystemCallErrors
 
@@ -320,4 +321,4 @@
 * should correctly set cookies
 * should provide a .run
 
-243 specifications, 4 empty (1008 requirements), 0 failures
+244 specifications, 4 empty (1004 requirements), 0 failures

data/README

@@ -224,6 +224,9 @@ run on port 11211) and memcache-client installed.
   * Made HeaderHash case-preserving.
   * Many bugfixes and small improvements.
 
+* January 9th, 2009: Sixth public release 0.9.1.
+  * Fix directory traversal exploits in Rack::File and Rack::Directory.
+
 == Contact
 
 Please mail bugs, suggestions and patches to
@@ -258,8 +261,9 @@ would like to thank:
 * Tim Fletcher, for the HTTP authentication code.
 * Luc Heinrich for the Cookie sessions, the static file handler and bugfixes.
 * Armin Ronacher, for the logo and racktools.
-* Aredridel, Ben Alpert, Dan Kubb, Daniel Roethlisberger, Matt Todd, and
-  Phil Hagelberg for bug fixing and other improvements.
+* Aredridel, Ben Alpert, Dan Kubb, Daniel Roethlisberger, Matt Todd,
+  Tom Robinson, and Phil Hagelberg for bug fixing and other
+  improvements.
 * Stephen Bannasch, for bug reports and documentation.
 * Gary Wright, for proposing a better Rack::Response interface.
 * Jonathan Buch, for improvements regarding Rack::Response.

data/Rakefile

@@ -134,14 +134,14 @@ Also see http://rack.rubyforge.org.
     s.homepage        = 'http://rack.rubyforge.org'
     s.rubyforge_project = 'rack'
 
-    s.add_development_dependency 'test-spec'
-
-    s.add_development_dependency 'camping'
-    s.add_development_dependency 'fcgi'
-    s.add_development_dependency 'memcache-client'
-    s.add_development_dependency 'mongrel'
-    s.add_development_dependency 'ruby-openid', '~> 2.0.0'
-    s.add_development_dependency 'thin'
+    #s.add_development_dependency 'test-spec'
+
+    #s.add_development_dependency 'camping'
+    #s.add_development_dependency 'fcgi'
+    #s.add_development_dependency 'memcache-client'
+    #s.add_development_dependency 'mongrel'
+    #s.add_development_dependency 'ruby-openid', '~> 2.0.0'
+    #s.add_development_dependency 'thin'
   end
 
   Rake::GemPackageTask.new(spec) do |p|

data/lib/rack/directory.rb

@@ -54,12 +54,13 @@ table { width:100%%; }
 
     def _call(env)
       @env = env
-      @path_info, @script_name = env.values_at('PATH_INFO', 'SCRIPT_NAME')
+      @script_name = env['SCRIPT_NAME']
+      @path_info = Utils.unescape(env['PATH_INFO'])
 
       if forbidden = check_forbidden
         forbidden
       else
-        @path = F.join(@root, Utils.unescape(@path_info))
+        @path = F.join(@root, @path_info)
         list_path
       end
     end

data/lib/rack/file.rb

@@ -23,9 +23,9 @@ module Rack
     F = ::File
 
     def _call(env)
-      return forbidden  if env["PATH_INFO"].include? ".."
-
       @path_info = Utils.unescape(env["PATH_INFO"])
+      return forbidden  if @path_info.include? ".."
+
       @path = F.join(@root, @path_info)
 
       begin

data/test/spec_rack_directory.rb

@@ -45,6 +45,11 @@ context "Rack::Directory" do
       get("/cgi/../test")
 
     res.should.be.forbidden
+
+    res = Rack::MockRequest.new(Rack::Lint.new(app)).
+      get("/cgi/%2E%2E/test")
+
+    res.should.be.forbidden
   end
 
   specify "404s if it can't find the file" do

data/test/spec_rack_file.rb

@@ -41,6 +41,13 @@ context "Rack::File" do
     res.should.be.forbidden
   end
 
+  specify "does not allow directory traversal with encoded periods" do
+    res = Rack::MockRequest.new(Rack::Lint.new(Rack::File.new(DOCROOT))).
+      get("/%2E%2E/README")
+
+    res.should.be.forbidden
+  end
+
   specify "404s if it can't find the file" do
     res = Rack::MockRequest.new(Rack::Lint.new(Rack::File.new(DOCROOT))).
       get("/cgi/blubb")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: rack
 version: !ruby/object:Gem::Version 
-  version: 0.9.0
+  version: 0.9.1
 platform: ruby
 authors: 
 - Christian Neukirchen
@@ -9,79 +9,10 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-01-06 00:00:00 +01:00
+date: 2009-01-09 00:00:00 +01:00
 default_executable: 
-dependencies: 
-- !ruby/object:Gem::Dependency 
-  name: test-spec
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        version: "0"
-    version: 
-- !ruby/object:Gem::Dependency 
-  name: camping
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        version: "0"
-    version: 
-- !ruby/object:Gem::Dependency 
-  name: fcgi
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        version: "0"
-    version: 
-- !ruby/object:Gem::Dependency 
-  name: memcache-client
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        version: "0"
-    version: 
-- !ruby/object:Gem::Dependency 
-  name: mongrel
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        version: "0"
-    version: 
-- !ruby/object:Gem::Dependency 
-  name: ruby-openid
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
-    requirements: 
-    - - ~>
-      - !ruby/object:Gem::Version 
-        version: 2.0.0
-    version: 
-- !ruby/object:Gem::Dependency 
-  name: thin
-  type: :development
-  version_requirement: 
-  version_requirements: !ruby/object:Gem::Requirement 
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        version: "0"
-    version: 
+dependencies: []
+
 description: Rack provides minimal, modular and adaptable interface for developing web applications in Ruby.  By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.  Also see http://rack.rubyforge.org.
 email: chneukirchen@gmail.com
 executables: