sprockets 2.1.3 → 2.1.4

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of sprockets might be problematic. Click here for more details.

Files changed (4) hide show
  1. checksums.yaml +7 -0
  2. data/lib/sprockets/server.rb +7 -7
  3. data/lib/sprockets/version.rb +1 -1
  4. metadata +145 -174
checksums.yaml ADDED
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA1:
3
+ metadata.gz: b51e06b67ce29e2f81d65f3ab796288e530749f2
4
+ data.tar.gz: bf24d81285d0f2e2c69b6669bba9213f7c038e57
5
+ SHA512:
6
+ metadata.gz: fabae91920a5939f2bc995f144917bf962646f9ae11fc030a1e953fbe5ca44fe7bf9f1ee6994424a726400f9cbae2d8e279b961f2c9a4867bed92bca70461c55
7
+ data.tar.gz: f1926792b20cccc35f1af2c635bea28d55d5f9893b3efa5da36e854184f82f84292d03ad26a82fc70b0219629012993b1b260c2bbac233dab7490eea17bc1174
data/lib/sprockets/server.rb CHANGED
@@ -33,16 +33,16 @@ module Sprockets
33
33
  # Extract the path from everything after the leading slash
34
34
  path = unescape(env['PATH_INFO'].to_s.sub(/^\//, ''))
35
35
 
36
- # URLs containing a `".."` are rejected for security reasons.
37
- if forbidden_request?(path)
38
- return forbidden_response
39
- end
40
-
41
36
  # Strip fingerprint
42
37
  if fingerprint = path_fingerprint(path)
43
38
  path = path.sub("-#{fingerprint}", '')
44
39
  end
45
40
 
41
+ # URLs containing a `".."` are rejected for security reasons.
42
+ if forbidden_request?(path)
43
+ return forbidden_response
44
+ end
45
+
46
46
  # Look up the asset.
47
47
  asset = find_asset(path, :bundle => !body_only?(env))
48
48
 
@@ -90,7 +90,7 @@ module Sprockets
90
90
  #
91
91
  # http://example.org/assets/../../../etc/passwd
92
92
  #
93
- path.include?("..")
93
+ path.include?("..") || Pathname.new(path).absolute?
94
94
  end
95
95
 
96
96
  # Returns a 403 Forbidden response tuple
@@ -222,7 +222,7 @@ module Sprockets
222
222
  # # => "0aa2105d29558f3eb790d411d7d8fb66"
223
223
  #
224
224
  def path_fingerprint(path)
225
- path[/-([0-9a-f]{7,40})\.[^.]+$/, 1]
225
+ path[/-([0-9a-f]{7,40})\.[^.]+\z/, 1]
226
226
  end
227
227
 
228
228
  # URI.unescape is deprecated on 1.9. We need to use URI::Parser
data/lib/sprockets/version.rb CHANGED
@@ -1,3 +1,3 @@
1
1
  module Sprockets
2
- VERSION = "2.1.3"
2
+ VERSION = "2.1.4"
3
3
  end
metadata CHANGED
@@ -1,191 +1,174 @@
1
- --- !ruby/object:Gem::Specification
1
+ --- !ruby/object:Gem::Specification
2
2
  name: sprockets
3
- version: !ruby/object:Gem::Version
4
- hash: 13
5
- prerelease:
6
- segments:
7
- - 2
8
- - 1
9
- - 3
10
- version: 2.1.3
3
+ version: !ruby/object:Gem::Version
4
+ version: 2.1.4
11
5
  platform: ruby
12
- authors:
6
+ authors:
13
7
  - Sam Stephenson
14
8
  - Joshua Peek
15
9
  autorequire:
16
10
  bindir: bin
17
11
  cert_chain: []
18
-
19
- date: 2012-04-26 00:00:00 Z
20
- dependencies:
21
- - !ruby/object:Gem::Dependency
12
+ date: 2014-10-28 00:00:00.000000000 Z
13
+ dependencies:
14
+ - !ruby/object:Gem::Dependency
22
15
  name: hike
23
- prerelease: false
24
- requirement: &id001 !ruby/object:Gem::Requirement
25
- none: false
26
- requirements:
27
- - - ~>
28
- - !ruby/object:Gem::Version
29
- hash: 11
30
- segments:
31
- - 1
32
- - 2
33
- version: "1.2"
16
+ requirement: !ruby/object:Gem::Requirement
17
+ requirements:
18
+ - - "~>"
19
+ - !ruby/object:Gem::Version
20
+ version: '1.2'
34
21
  type: :runtime
35
- version_requirements: *id001
36
- - !ruby/object:Gem::Dependency
37
- name: rack
38
22
  prerelease: false
39
- requirement: &id002 !ruby/object:Gem::Requirement
40
- none: false
41
- requirements:
42
- - - ~>
43
- - !ruby/object:Gem::Version
44
- hash: 15
45
- segments:
46
- - 1
47
- - 0
48
- version: "1.0"
23
+ version_requirements: !ruby/object:Gem::Requirement
24
+ requirements:
25
+ - - "~>"
26
+ - !ruby/object:Gem::Version
27
+ version: '1.2'
28
+ - !ruby/object:Gem::Dependency
29
+ name: rack
30
+ requirement: !ruby/object:Gem::Requirement
31
+ requirements:
32
+ - - "~>"
33
+ - !ruby/object:Gem::Version
34
+ version: '1.0'
49
35
  type: :runtime
50
- version_requirements: *id002
51
- - !ruby/object:Gem::Dependency
52
- name: tilt
53
36
  prerelease: false
54
- requirement: &id003 !ruby/object:Gem::Requirement
55
- none: false
56
- requirements:
57
- - - ~>
58
- - !ruby/object:Gem::Version
59
- hash: 13
60
- segments:
61
- - 1
62
- - 1
63
- version: "1.1"
37
+ version_requirements: !ruby/object:Gem::Requirement
38
+ requirements:
39
+ - - "~>"
40
+ - !ruby/object:Gem::Version
41
+ version: '1.0'
42
+ - !ruby/object:Gem::Dependency
43
+ name: tilt
44
+ requirement: !ruby/object:Gem::Requirement
45
+ requirements:
46
+ - - "~>"
47
+ - !ruby/object:Gem::Version
48
+ version: '1.1'
64
49
  - - "!="
65
- - !ruby/object:Gem::Version
66
- hash: 27
67
- segments:
68
- - 1
69
- - 3
70
- - 0
50
+ - !ruby/object:Gem::Version
71
51
  version: 1.3.0
72
52
  type: :runtime
73
- version_requirements: *id003
74
- - !ruby/object:Gem::Dependency
75
- name: coffee-script
76
53
  prerelease: false
77
- requirement: &id004 !ruby/object:Gem::Requirement
78
- none: false
79
- requirements:
80
- - - ~>
81
- - !ruby/object:Gem::Version
82
- hash: 3
83
- segments:
84
- - 2
85
- - 0
86
- version: "2.0"
54
+ version_requirements: !ruby/object:Gem::Requirement
55
+ requirements:
56
+ - - "~>"
57
+ - !ruby/object:Gem::Version
58
+ version: '1.1'
59
+ - - "!="
60
+ - !ruby/object:Gem::Version
61
+ version: 1.3.0
62
+ - !ruby/object:Gem::Dependency
63
+ name: coffee-script
64
+ requirement: !ruby/object:Gem::Requirement
65
+ requirements:
66
+ - - "~>"
67
+ - !ruby/object:Gem::Version
68
+ version: '2.0'
87
69
  type: :development
88
- version_requirements: *id004
89
- - !ruby/object:Gem::Dependency
90
- name: eco
91
70
  prerelease: false
92
- requirement: &id005 !ruby/object:Gem::Requirement
93
- none: false
94
- requirements:
95
- - - ~>
96
- - !ruby/object:Gem::Version
97
- hash: 15
98
- segments:
99
- - 1
100
- - 0
101
- version: "1.0"
71
+ version_requirements: !ruby/object:Gem::Requirement
72
+ requirements:
73
+ - - "~>"
74
+ - !ruby/object:Gem::Version
75
+ version: '2.0'
76
+ - !ruby/object:Gem::Dependency
77
+ name: eco
78
+ requirement: !ruby/object:Gem::Requirement
79
+ requirements:
80
+ - - "~>"
81
+ - !ruby/object:Gem::Version
82
+ version: '1.0'
102
83
  type: :development
103
- version_requirements: *id005
104
- - !ruby/object:Gem::Dependency
105
- name: ejs
106
84
  prerelease: false
107
- requirement: &id006 !ruby/object:Gem::Requirement
108
- none: false
109
- requirements:
110
- - - ~>
111
- - !ruby/object:Gem::Version
112
- hash: 15
113
- segments:
114
- - 1
115
- - 0
116
- version: "1.0"
85
+ version_requirements: !ruby/object:Gem::Requirement
86
+ requirements:
87
+ - - "~>"
88
+ - !ruby/object:Gem::Version
89
+ version: '1.0'
90
+ - !ruby/object:Gem::Dependency
91
+ name: ejs
92
+ requirement: !ruby/object:Gem::Requirement
93
+ requirements:
94
+ - - "~>"
95
+ - !ruby/object:Gem::Version
96
+ version: '1.0'
117
97
  type: :development
118
- version_requirements: *id006
119
- - !ruby/object:Gem::Dependency
120
- name: execjs
121
98
  prerelease: false
122
- requirement: &id007 !ruby/object:Gem::Requirement
123
- none: false
124
- requirements:
125
- - - ~>
126
- - !ruby/object:Gem::Version
127
- hash: 15
128
- segments:
129
- - 1
130
- - 0
131
- version: "1.0"
99
+ version_requirements: !ruby/object:Gem::Requirement
100
+ requirements:
101
+ - - "~>"
102
+ - !ruby/object:Gem::Version
103
+ version: '1.0'
104
+ - !ruby/object:Gem::Dependency
105
+ name: execjs
106
+ requirement: !ruby/object:Gem::Requirement
107
+ requirements:
108
+ - - "~>"
109
+ - !ruby/object:Gem::Version
110
+ version: '1.0'
132
111
  type: :development
133
- version_requirements: *id007
134
- - !ruby/object:Gem::Dependency
135
- name: json
136
112
  prerelease: false
137
- requirement: &id008 !ruby/object:Gem::Requirement
138
- none: false
139
- requirements:
113
+ version_requirements: !ruby/object:Gem::Requirement
114
+ requirements:
115
+ - - "~>"
116
+ - !ruby/object:Gem::Version
117
+ version: '1.0'
118
+ - !ruby/object:Gem::Dependency
119
+ name: json
120
+ requirement: !ruby/object:Gem::Requirement
121
+ requirements:
140
122
  - - ">="
141
- - !ruby/object:Gem::Version
142
- hash: 3
143
- segments:
144
- - 0
145
- version: "0"
123
+ - !ruby/object:Gem::Version
124
+ version: '0'
146
125
  type: :development
147
- version_requirements: *id008
148
- - !ruby/object:Gem::Dependency
149
- name: rack-test
150
126
  prerelease: false
151
- requirement: &id009 !ruby/object:Gem::Requirement
152
- none: false
153
- requirements:
127
+ version_requirements: !ruby/object:Gem::Requirement
128
+ requirements:
154
129
  - - ">="
155
- - !ruby/object:Gem::Version
156
- hash: 3
157
- segments:
158
- - 0
159
- version: "0"
130
+ - !ruby/object:Gem::Version
131
+ version: '0'
132
+ - !ruby/object:Gem::Dependency
133
+ name: rack-test
134
+ requirement: !ruby/object:Gem::Requirement
135
+ requirements:
136
+ - - ">="
137
+ - !ruby/object:Gem::Version
138
+ version: '0'
160
139
  type: :development
161
- version_requirements: *id009
162
- - !ruby/object:Gem::Dependency
163
- name: rake
164
140
  prerelease: false
165
- requirement: &id010 !ruby/object:Gem::Requirement
166
- none: false
167
- requirements:
141
+ version_requirements: !ruby/object:Gem::Requirement
142
+ requirements:
143
+ - - ">="
144
+ - !ruby/object:Gem::Version
145
+ version: '0'
146
+ - !ruby/object:Gem::Dependency
147
+ name: rake
148
+ requirement: !ruby/object:Gem::Requirement
149
+ requirements:
168
150
  - - ">="
169
- - !ruby/object:Gem::Version
170
- hash: 3
171
- segments:
172
- - 0
173
- version: "0"
151
+ - !ruby/object:Gem::Version
152
+ version: '0'
174
153
  type: :development
175
- version_requirements: *id010
176
- description: Sprockets is a Rack-based asset packaging system that concatenates and serves JavaScript, CoffeeScript, CSS, LESS, Sass, and SCSS.
177
- email:
154
+ prerelease: false
155
+ version_requirements: !ruby/object:Gem::Requirement
156
+ requirements:
157
+ - - ">="
158
+ - !ruby/object:Gem::Version
159
+ version: '0'
160
+ description: Sprockets is a Rack-based asset packaging system that concatenates and
161
+ serves JavaScript, CoffeeScript, CSS, LESS, Sass, and SCSS.
162
+ email:
178
163
  - sstephenson@gmail.com
179
164
  - josh@joshpeek.com
180
165
  executables: []
181
-
182
166
  extensions: []
183
-
184
167
  extra_rdoc_files: []
185
-
186
- files:
187
- - README.md
168
+ files:
188
169
  - LICENSE
170
+ - README.md
171
+ - lib/sprockets.rb
189
172
  - lib/sprockets/asset.rb
190
173
  - lib/sprockets/asset_attributes.rb
191
174
  - lib/sprockets/base.rb
@@ -212,39 +195,27 @@ files:
212
195
  - lib/sprockets/trail.rb
213
196
  - lib/sprockets/utils.rb
214
197
  - lib/sprockets/version.rb
215
- - lib/sprockets.rb
216
198
  homepage: http://getsprockets.org/
217
199
  licenses: []
218
-
200
+ metadata: {}
219
201
  post_install_message:
220
202
  rdoc_options: []
221
-
222
- require_paths:
203
+ require_paths:
223
204
  - lib
224
- required_ruby_version: !ruby/object:Gem::Requirement
225
- none: false
226
- requirements:
205
+ required_ruby_version: !ruby/object:Gem::Requirement
206
+ requirements:
227
207
  - - ">="
228
- - !ruby/object:Gem::Version
229
- hash: 3
230
- segments:
231
- - 0
232
- version: "0"
233
- required_rubygems_version: !ruby/object:Gem::Requirement
234
- none: false
235
- requirements:
208
+ - !ruby/object:Gem::Version
209
+ version: '0'
210
+ required_rubygems_version: !ruby/object:Gem::Requirement
211
+ requirements:
236
212
  - - ">="
237
- - !ruby/object:Gem::Version
238
- hash: 3
239
- segments:
240
- - 0
241
- version: "0"
213
+ - !ruby/object:Gem::Version
214
+ version: '0'
242
215
  requirements: []
243
-
244
216
  rubyforge_project: sprockets
245
- rubygems_version: 1.8.15
217
+ rubygems_version: 2.2.2
246
218
  signing_key:
247
- specification_version: 3
219
+ specification_version: 4
248
220
  summary: Rack-based asset packaging system
249
221
  test_files: []
250
-