From aac91cb762e20519aca6190345641d27e5991a75 Mon Sep 17 00:00:00 2001 From: normal Date: Wed, 13 Dec 2017 00:38:08 +0000 Subject: webrick: compile RE correctly for beginning and end match Using ^ and $ in regexps means we can accidentally get fooled by "%0a" in HTTP request paths being decoded to newline characters. Use \A and \z to match beginning and end-of-string respectively, instead. Thanks to mame and hsbt for reporting. * lib/webrick/httpserver.rb (MountTable#compile): use \A and \z instead of ^ and $ * lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $ * test/webrick/test_httpserver.rb (test_cntrl_in_path): new test git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61197 b2dd03c8-39d4-4d8f-98ff-823fe69b080e --- test/webrick/test_httpserver.rb | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'test/webrick/test_httpserver.rb') diff --git a/test/webrick/test_httpserver.rb b/test/webrick/test_httpserver.rb index 5aa94637ba..daeb7b955e 100644 --- a/test/webrick/test_httpserver.rb +++ b/test/webrick/test_httpserver.rb @@ -415,4 +415,29 @@ class TestWEBrickHTTPServer < Test::Unit::TestCase } assert_equal(0, requested, "Server responded to #{requested} requests after shutdown") end + + def test_cntrl_in_path + log_ary = [] + access_log_ary = [] + config = { + :Port => 0, + :BindAddress => '127.0.0.1', + :Logger => WEBrick::Log.new(log_ary, WEBrick::BasicLog::WARN), + :AccessLog => [[access_log_ary, '']], + } + s = WEBrick::HTTPServer.new(config) + s.mount('/foo', WEBrick::HTTPServlet::FileHandler, __FILE__) + th = Thread.new { s.start } + addr = s.listeners[0].addr + + http = Net::HTTP.new(addr[3], addr[1]) + req = Net::HTTP::Get.new('/notexist%0a/foo') + http.request(req) { |res| assert_equal('404', res.code) } + exp = %Q(ERROR `/notexist\\n/foo' not found.\n) + assert_equal 1, log_ary.size + assert log_ary[0].include?(exp) + ensure + s&.shutdown + th&.join + end end -- cgit v1.2.3