1berry/ruby
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

webrick/httpservlet/*handler: use File.open

Browse Source 
This makes future code audits easier.  None of these changes
fix realistic remote code execution vulnerabilities because
we stat(2) before attempting Kernel#open.

* lib/webrick/httpservlet/erbhandler.rb (do_GET): use File.open
* lib/webrick/httpservlet/filehandler.rb (do_GET): use File.open
  (make_partial_content): ditto
  [Misc #14216]

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@61401 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
This commit is contained in:
normal 2017-12-22 01:08:00 +00:00
parent 1989371d10
commit 1ad355bd53
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/webrick/httpservlet/erbhandler.rb
View File

@ -53,7 +53,7 @@ module WEBrick
raise HTTPStatus::Forbidden, "ERBHandler cannot work." raise HTTPStatus::Forbidden, "ERBHandler cannot work."
end end
begin begin
data = open(@script_filename){|io| io.read } data = File.open(@script_filename, &:read)
res.body = evaluate(ERB.new(data), req, res) res.body = evaluate(ERB.new(data), req, res)
res['content-type'] ||= res['content-type'] ||=
HTTPUtils::mime_type(@script_filename, @config[:MimeTypes]) HTTPUtils::mime_type(@script_filename, @config[:MimeTypes])

4
lib/webrick/httpservlet/filehandler.rb
View File

@ -57,7 +57,7 @@ module WEBrick
res['content-type'] = mtype res['content-type'] = mtype
res['content-length'] = st.size res['content-length'] = st.size
res['last-modified'] = mtime.httpdate res['last-modified'] = mtime.httpdate
res.body = open(@local_path, "rb") res.body = File.open(@local_path, "rb")
end end
end end
@ -92,7 +92,7 @@ module WEBrick
raise HTTPStatus::BadRequest, raise HTTPStatus::BadRequest,
"Unrecognized range-spec: \"#{req['range']}\"" "Unrecognized range-spec: \"#{req['range']}\""
end end
open(filename, "rb"){|io| File.open(filename, "rb"){|io|
if ranges.size > 1 if ranges.size > 1
time = Time.now time = Time.now
boundary = "#{time.sec}_#{time.usec}_#{Process::pid}" boundary = "#{time.sec}_#{time.usec}_#{Process::pid}"