class Rack::Protection::PathTraversal

Prevented attack

Directory traversal

Supported browsers

all

More infos

en.wikipedia.org/wiki/Directory_traversal

Unescapes '/' and '.', expands path_info. Thus GET /foo/%2e%2e%2fbar becomes GET /bar.

Public Instance Methods

call(env) click to toggle source
# File lib/rack/protection/path_traversal.rb, line 13
def call(env)
  path_was         = env["PATH_INFO"]
  env["PATH_INFO"] = cleanup path_was if path_was
  app.call env
ensure
  env["PATH_INFO"] = path_was
end
cleanup(path) click to toggle source
# File lib/rack/protection/path_traversal.rb, line 21
def cleanup(path)
  parts     = []
  unescaped = path.gsub('%2e', '.').gsub('%2f', '/')

  unescaped.split('/').each do |part|
    next if part.empty? or part == '.'
    part == '..' ? parts.pop : parts << part
  end

  cleaned = '/' << parts.join('/')
  cleaned << '/' if parts.any? and unescaped =~ %r\/\.{0,2}$/
  cleaned
end