sprockets 2.3.0 → 2.3.1

data/README.md

@@ -354,7 +354,13 @@ submit a pull request.
 
 ## Version History ##
 
-**2.3.0** (Unreleased)
+**2.3.1** (February 11, 2012)
+
+* Added bytesize to manifest
+* Added Asset#bytesize alias
+* Security: Check path for forbidden access after unescaping
+
+**2.3.0** (January 16, 2012)
 
 * Added special Sass importer that automatically tracks any `@import`ed files.
 

data/lib/sprockets/asset.rb

@@ -30,6 +30,7 @@ module Sprockets
 
     attr_reader :logical_path, :pathname
     attr_reader :content_type, :mtime, :length, :digest
+    alias_method :bytesize, :length
 
     def initialize(environment, logical_path, pathname)
       @root         = environment.root

data/lib/sprockets/manifest.rb

@@ -91,6 +91,7 @@ module Sprockets
           files[asset.digest_path] = {
             'logical_path' => asset.logical_path,
             'mtime'        => asset.mtime.iso8601,
+            'size'         => asset.bytesize,
             'digest'       => asset.digest
           }
           assets[asset.logical_path] = asset.digest_path

data/lib/sprockets/server.rb

@@ -25,11 +25,6 @@ module Sprockets
 
       msg = "Served asset #{env['PATH_INFO']} -"
 
-      # URLs containing a `".."` are rejected for security reasons.
-      if forbidden_request?(env)
-        return forbidden_response
-      end
-
       # Mark session as "skipped" so no `Set-Cookie` header is set
       env['rack.session.options'] ||= {}
       env['rack.session.options'][:defer] = true
@@ -38,6 +33,11 @@ module Sprockets
       # Extract the path from everything after the leading slash
       path = unescape(env['PATH_INFO'].to_s.sub(/^\//, ''))
 
+      # URLs containing a `".."` are rejected for security reasons.
+      if forbidden_request?(path)
+        return forbidden_response
+      end
+
       # Strip fingerprint
       if fingerprint = path_fingerprint(path)
         path = path.sub("-#{fingerprint}", '')
@@ -85,12 +85,12 @@ module Sprockets
     end
 
     private
-      def forbidden_request?(env)
+      def forbidden_request?(path)
         # Prevent access to files elsewhere on the file system
         #
         #     http://example.org/assets/../../../etc/passwd
         #
-        env["PATH_INFO"].include?("..")
+        path.include?("..")
       end
 
       # Returns a 403 Forbidden response tuple

data/lib/sprockets/version.rb

@@ -1,3 +1,3 @@
 module Sprockets
-  VERSION = "2.3.0"
+  VERSION = "2.3.1"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: sprockets
 version: !ruby/object:Gem::Version 
-  hash: 3
+  hash: 1
   prerelease: 
   segments: 
   - 2
   - 3
-  - 0
-  version: 2.3.0
+  - 1
+  version: 2.3.1
 platform: ruby
 authors: 
 - Sam Stephenson
@@ -16,7 +16,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-01-16 00:00:00 -06:00
+date: 2012-02-11 00:00:00 -06:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency