sprockets 3.0.0.beta.2 → 3.0.0.beta.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2dcb1bab6dcd806bd08e5f467aa057cd75004be8
-  data.tar.gz: 86037ea057923f8b2afd7dbffdea6d72f3596d02
+  metadata.gz: d80e59406f8e4f42c73b61fc3aa9a8e7b6cd6b37
+  data.tar.gz: fb62b74a69585406a2a5b0628d668ca5e2d50467
 SHA512:
-  metadata.gz: ce12f8ec442a3d4a3cef5352f12a6c83151ff4dd717ce0fb94d31811ca9f3c80953a3f52e3f582eb5ecb42d0af05d2e5320fe925c3c55e4b8b61fd6280ff4ef8
-  data.tar.gz: fbe0b9468d6e81a596517d4b4ecda0faf34ef84027ac7340ea2b603bc7635585ed2f93fa7e215e9c1062df1990c46222aefefd97caa4ba54a2dfcafa68c21811
+  metadata.gz: 2b1ba31c1909eba6bb44ad66959b731cd1cef3b8d3c6775ba522da5bf0b825407c0c74587aa8810fffb1df34ec2e696def2990b48e0dcfae4ffac9dfd6270ea7
+  data.tar.gz: a4d49277f457e15d2f9562654a7dcd9e9cda745d867f36446f3a649bafda9d2f017ba05c0e30acadbb5f6006c7f97990dbeb8b613eb33b8f6a6333723aa8d97b

data/README.md

@@ -399,6 +399,10 @@ submit a pull request.
 * Rename Asset#digest to Asset#hexdigest. Asset#digest is deprecated and will
   return a raw byte String in 4.x.
 
+**2.12.3** (October 28, 2014)
+
+* Security: Fix directory traversal bug in development mode server.
+
 **2.12.2** (September 5, 2014)
 
 * Ensure internal asset lookups calls are still restricted to load paths within

data/lib/sprockets/asset.rb

@@ -127,7 +127,7 @@ module Sprockets
         @source
       else
         # File is read everytime to avoid memory bloat of large binary files
-        File.open(filename, 'rb') { |f| f.read }
+        File.binread(filename)
       end
     end
 

data/lib/sprockets/asset_uri.rb

@@ -14,16 +14,21 @@ module Sprockets
     #
     # Returns String path and Hash of symbolized parameters.
     def self.parse(str)
-      uri = URI(str)
+      scheme, _, host, port, _, path, _, query, _ = URI.split(str)
 
-      unless uri.scheme == 'file'
+      unless scheme == 'file'
         raise URI::InvalidURIError, "expected file:// scheme: #{str}"
       end
 
-      path = URI::Generic::DEFAULT_PARSER.unescape(uri.path)
+      path = URI::Generic::DEFAULT_PARSER.unescape(path)
       path.force_encoding(Encoding::UTF_8)
 
-      params = uri.query.to_s.split('&').reduce({}) do |h, p|
+      # Hack for parsing Windows "file://C:/Users/IEUser" paths
+      if host && port == ""
+        path = "#{host}:#{path}"
+      end
+
+      params = query.to_s.split('&').reduce({}) do |h, p|
         k, v = p.split('=', 2)
         h.merge(k.to_sym => v || true)
       end

data/lib/sprockets/base.rb

@@ -176,7 +176,9 @@ module Sprockets
         processors = bundled_processors.any? ? bundled_processors : processed_processors
         processors += unwrap_encoding_processors(params[:encoding])
 
-        if processors.any?
+        # Read into memory and process if theres a processor pipeline or the
+        # content type is text.
+        if processors.any? || mime_type_charset_detecter(type)
           asset.merge!(process(
             [method(:read_input)] + processors,
             asset[:uri],

data/lib/sprockets/digest_utils.rb

@@ -52,6 +52,9 @@ module Sprockets
         elsif klass == Fixnum
           digest << 'Fixnum'
           digest << obj.to_s
+        elsif klass == Bignum
+          digest << 'Bignum'
+          digest << obj.to_s
         elsif klass == TrueClass
           digest << 'TrueClass'
         elsif klass == FalseClass

data/lib/sprockets/mime.rb

@@ -64,6 +64,19 @@ module Sprockets
       end
     end
 
+    # Internal: Get detecter function for MIME type.
+    #
+    # mime_type - String MIME type
+    #
+    # Returns Proc detector or nil if none is available.
+    def mime_type_charset_detecter(mime_type)
+      if type = mime_types[mime_type]
+        if detect = type[:charset]
+          return detect
+        end
+      end
+    end
+
     # Public: Read file on disk with MIME type specific encoding.
     #
     # filename     - String path
@@ -72,15 +85,13 @@ module Sprockets
     # Returns String file contents transcoded to UTF-8 or in its external
     # encoding.
     def read_file(filename, content_type = nil)
-      data = File.open(filename, 'rb') { |f| f.read }
+      data = File.binread(filename)
 
-      if type = mime_types[content_type]
-        if charset = type[:charset]
-          data = charset.call(data).encode(Encoding::UTF_8)
-        end
+      if detect = mime_type_charset_detecter(content_type)
+        detect.call(data).encode(Encoding::UTF_8, :universal_newline => true)
+      else
+        data
       end
-
-      data
     end
 
     # Public: Mapping of supported HTTP Content/Transfer encodings

data/lib/sprockets/path_utils.rb

@@ -42,7 +42,7 @@ module Sprockets
     # Returns an empty `Array` if the directory does not exist.
     def entries(path)
       if File.directory?(path)
-        Dir.entries(path).reject { |entry| entry =~ /^\.|~$|^\#.*\#$/ }.sort
+        Dir.entries(path, :encoding => Encoding.default_internal).reject { |entry| entry =~ /^\.|~$|^\#.*\#$/ }.sort
       else
         []
       end
@@ -54,9 +54,12 @@ module Sprockets
     #
     # Returns true if path is absolute, otherwise false.
     if File::ALT_SEPARATOR
+      require 'pathname'
+
       # On Windows, ALT_SEPARATOR is \
+      # Delegate to Pathname nice the logic gets complex.
       def absolute_path?(path)
-        path[0] == File::SEPARATOR || path[0] == File::ALT_SEPARATOR
+        Pathname.new(path).absolute?
       end
     else
       def absolute_path?(path)
@@ -64,6 +67,12 @@ module Sprockets
       end
     end
 
+    if File::ALT_SEPARATOR
+      SEPARATOR_PATTERN = "#{Regexp.quote(File::SEPARATOR)}|#{Regexp.quote(File::ALT_SEPARATOR)}"
+    else
+      SEPARATOR_PATTERN = "#{Regexp.quote(File::SEPARATOR)}"
+    end
+
     # Internal: Check if path is explicitly relative.
     # Starts with "./" or "../".
     #
@@ -71,7 +80,7 @@ module Sprockets
     #
     # Returns true if path is relative, otherwise false.
     def relative_path?(path)
-      path =~ /^\.\.?($|\/)/ ? true : false
+      path =~ /^\.\.?($|#{SEPARATOR_PATTERN})/ ? true : false
     end
 
     # Internal: Get relative path for root path and subpath.

data/lib/sprockets/resolve.rb

@@ -110,7 +110,8 @@ module Sprockets
 
       if absolute_path?(path)
         path = File.expand_path(path)
-        if file?(path) && (accept.nil? || resolve_path_transform_type(path, accept))
+        if paths_split(self.paths, path) && file?(path) &&
+            (accept.nil? || resolve_path_transform_type(path, accept))
           filename = path
           type = resolve_path_transform_type(path, accept)
         end

data/lib/sprockets/server.rb

@@ -32,16 +32,16 @@ module Sprockets
       # Extract the path from everything after the leading slash
       path = Rack::Utils.unescape(env['PATH_INFO'].to_s.sub(/^\//, ''))
 
-      # URLs containing a `".."` are rejected for security reasons.
-      if forbidden_request?(path)
-        return forbidden_response
-      end
-
       # Strip fingerprint
       if fingerprint = path_fingerprint(path)
         path = path.sub("-#{fingerprint}", '')
       end
 
+      # URLs containing a `".."` are rejected for security reasons.
+      if forbidden_request?(path)
+        return forbidden_response
+      end
+
       # Look up the asset.
       options = {}
       options[:bundle] = !body_only?(env)
@@ -115,7 +115,7 @@ module Sprockets
         #
         #     http://example.org/assets/../../../etc/passwd
         #
-        path.include?("..")
+        path.include?("..") || absolute_path?(path)
       end
 
       # Returns a 200 OK response tuple
@@ -271,7 +271,7 @@ module Sprockets
       #     # => "0aa2105d29558f3eb790d411d7d8fb66"
       #
       def path_fingerprint(path)
-        path[/-([0-9a-f]{7,128})\.[^.]+$/, 1]
+        path[/-([0-9a-f]{7,128})\.[^.]+\z/, 1]
       end
   end
 end

data/lib/sprockets/version.rb

@@ -1,3 +1,3 @@
 module Sprockets
-  VERSION = "3.0.0.beta.2"
+  VERSION = "3.0.0.beta.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sprockets
 version: !ruby/object:Gem::Version
-  version: 3.0.0.beta.2
+  version: 3.0.0.beta.3
 platform: ruby
 authors:
 - Sam Stephenson
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-10 00:00:00.000000000 Z
+date: 2014-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack