Commit 089b9e57 authored by Douwe Maan's avatar Douwe Maan

Merge branch 'improve/rack-clean-path-info' into 'master'

Use Rack::Utils.clean_path_info instead of copy-pasted version.

See merge request gitlab-org/gitlab-ce!27001
parents 7a7808e3 29a68cc5
...@@ -22,7 +22,7 @@ class HelpController < ApplicationController ...@@ -22,7 +22,7 @@ class HelpController < ApplicationController
end end
def show def show
@path = clean_path_info(path_params[:path]) @path = Rack::Utils.clean_path_info(path_params[:path])
respond_to do |format| respond_to do |format|
format.any(:markdown, :md, :html) do format.any(:markdown, :md, :html) do
...@@ -75,35 +75,4 @@ class HelpController < ApplicationController ...@@ -75,35 +75,4 @@ class HelpController < ApplicationController
params params
end end
PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)
# Taken from ActionDispatch::FileHandler
# Cleans up the path, to prevent directory traversal outside the doc folder.
def clean_path_info(path_info)
parts = path_info.split(PATH_SEPS)
clean = []
# Walk over each part of the path
parts.each do |part|
# Turn `one//two` or `one/./two` into `one/two`.
next if part.empty? || part == '.'
if part == '..'
# Turn `one/two/../` into `one`
clean.pop
else
# Add simple folder names to the clean path.
clean << part
end
end
# If the path was an absolute path (i.e. `/` or `/one/two`),
# add `/` to the front of the clean path.
clean.unshift '/' if parts.empty? || parts.first.empty?
# Join all the clean path parts by the path separator.
::File.join(*clean)
end
end end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment