rswag-api 2.9.0 → 2.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2f6a479873bdc22b8568bf5918bd56380c40dabb9b45577bc2b0ce3a439a226c
-  data.tar.gz: d20109c13e90ab97c31fd8ae3a60a8e5c20a3be0598405ee4bcfccf71c6b1648
+  metadata.gz: 24a46129ae1192485e1d09b1c2930afd78c229007981af3e4ac14d2087f9bd37
+  data.tar.gz: 86aa96d20b65e8a7d4f739dc6eaad415e6b75bc57ca197ac402344949922bd5e
 SHA512:
-  metadata.gz: 41b18aa4dd83c021d3b3a9135c7564d085eac48d909f4bf20cfc20cc174e1341f4216a9902384ab79ca7107e9112ea56bec30f80139aa67e269e38975d61f5b3
-  data.tar.gz: 3801e309323ec05e77ac47bcd6bd33ef682b979481723d32d063b419af75201667e362ab01df8ecfd06cda165c96123191820a127cb0690af8b5d6d450f3b79c
+  metadata.gz: a7a8332ce317746707b505bd660e6c6a078e1f07170656324fa764cd436d565256f627e47a9ce7a8608f7d0bb8ba1a8e7c5a5da2066d439fc2db6ed96934d474
+  data.tar.gz: 9c94264f402db5fd0f936975b85dfd3e3a43aa1e47ab744d960a7f26d37f657ae09b3e9e2d30edcdf2542bbee01de347af07aa56367b5c252bbc7e689fd33ecc

data/lib/rswag/api/middleware.rb

@@ -13,7 +13,12 @@ module Rswag
 
       def call(env)
         path = env['PATH_INFO']
-        filename = "#{@config.resolve_swagger_root(env)}/#{path}"
+        # Sanitize the filename for directory traversal by expanding, and ensuring
+        # its starts with the root directory.
+        filename = File.expand_path(path, @config.resolve_swagger_root(env))
+        unless filename.start_with? @config.resolve_swagger_root(env)
+          return @app.call(env)
+        end
 
         if env['REQUEST_METHOD'] == 'GET' && File.file?(filename)
           swagger = parse_file(filename)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rswag-api
 version: !ruby/object:Gem::Version
-  version: 2.9.0
+  version: 2.10.0
 platform: ruby
 authors:
 - Richie Morris
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-04-24 00:00:00.000000000 Z
+date: 2023-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties