sprockets 2.12.2 → 2.12.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: a18323da3c871b78a1aea7699a585578eca78d85
-  data.tar.gz: 3ab018646337e454e12463cdfef74467d74f016b
+  metadata.gz: 4ac3ec814692936eab4dc58704519ca15c383880
+  data.tar.gz: 1888571f870ed8cb1a4e7a36dd78b2c7079991ed
 SHA512:
-  metadata.gz: 7737e045a3bf093a6000679d8868167277e13ba72aeb237cd207d467d4bc1d1b7b5bdc0d457d246868105b641f27a4209d0629cb9391e9c1fd31c2d1bc7f04c2
-  data.tar.gz: b5b52602169324755121be25cc7c99d03751ab014f46945228323f3fdae420ce4c94df1dc80748f3e9d6b0203a2977e0206993271edaa5aabbbf11982e13c11c
+  metadata.gz: 5a11411a3911b1bb069ec8b350e3017d96377f70a7a41b62db3b8da1616186c57dd31a9d746f01cc7b16c1e717dd7dfcc1c513a2d92420a4ddbc7f1ee292bdb0
+  data.tar.gz: 036a48e5dc1c97776e9aa455e6b254ecfcd83edbd0cabc1c999c1b23f4881685458f9e2683c35e38d9ad72946facbefe05b2bdef962d9cc2ab9fa73c74780b82

data/README.md

@@ -366,6 +366,10 @@ submit a pull request.
 
 ## Version History ##
 
+**2.12.3** (October 28, 2014)
+
+* Security: Fix directory traversal bug in development mode server.
+
 **2.12.2** (September 5, 2014)
 
 * Ensure internal asset lookups calls are still restricted to load paths within

data/lib/sprockets/server.rb

@@ -33,16 +33,16 @@ module Sprockets
       # Extract the path from everything after the leading slash
       path = unescape(env['PATH_INFO'].to_s.sub(/^\//, ''))
 
-      # URLs containing a `".."` are rejected for security reasons.
-      if forbidden_request?(path)
-        return forbidden_response
-      end
-
       # Strip fingerprint
       if fingerprint = path_fingerprint(path)
         path = path.sub("-#{fingerprint}", '')
       end
 
+      # URLs containing a `".."` are rejected for security reasons.
+      if forbidden_request?(path)
+        return forbidden_response
+      end
+
       # Look up the asset.
       asset = find_asset(path, :bundle => !body_only?(env))
 
@@ -90,7 +90,7 @@ module Sprockets
         #
         #     http://example.org/assets/../../../etc/passwd
         #
-        path.include?("..")
+        path.include?("..") || Pathname.new(path).absolute?
       end
 
       # Returns a 403 Forbidden response tuple
@@ -222,7 +222,7 @@ module Sprockets
       #     # => "0aa2105d29558f3eb790d411d7d8fb66"
       #
       def path_fingerprint(path)
-        path[/-([0-9a-f]{7,40})\.[^.]+$/, 1]
+        path[/-([0-9a-f]{7,40})\.[^.]+\z/, 1]
       end
 
       # URI.unescape is deprecated on 1.9. We need to use URI::Parser

data/lib/sprockets/version.rb

@@ -1,3 +1,3 @@
 module Sprockets
-  VERSION = "2.12.2"
+  VERSION = "2.12.3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sprockets
 version: !ruby/object:Gem::Version
-  version: 2.12.2
+  version: 2.12.3
 platform: ruby
 authors:
 - Sam Stephenson
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-06 00:00:00.000000000 Z
+date: 2014-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: hike