diff options
| author | gotoyuzo <gotoyuzo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-03-03 14:31:30 +0000 |
|---|---|---|
| committer | gotoyuzo <gotoyuzo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e> | 2008-03-03 14:31:30 +0000 |
| commit | d3c28a3b6a597195b05b9375b9110b85a5d0d241 (patch) | |
| tree | d8dc28281572a27e3d7f438cfc9d2e4c1c107bdf /ChangeLog | |
| parent | 313759c988f2502ba55480a49fd44d6248107ccf (diff) | |
* lib/webrick/httpservlet/filehandler.rb: should normalize path
separators in path_info to prevent directory traversal
attacks on DOSISH platforms.
reported by Digital Security Research Group [DSECRG-08-026].
* lib/webrick/httpservlet/filehandler.rb: pathnames which have
not to be published should be checked case-insensitively.
git-svn-id: http://svn.ruby-lang.org/repos/ruby/trunk@15676 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
Diffstat (limited to 'ChangeLog')
| -rw-r--r-- | ChangeLog | 10 |
1 files changed, 10 insertions, 0 deletions
@@ -1,3 +1,13 @@ +Mon Mar 3 23:28:37 2008 GOTOU Yuuzou <gotoyuzo@notwork.org> + + * lib/webrick/httpservlet/filehandler.rb: should normalize path + separators in path_info to prevent directory traversal + attacks on DOSISH platforms. + reported by Digital Security Research Group [DSECRG-08-026]. + + * lib/webrick/httpservlet/filehandler.rb: pathnames which have + not to be published should be checked case-insensitively. + Mon Mar 3 17:25:45 2008 Yukihiro Matsumoto <matz@ruby-lang.org> * gc.c (add_heap): sort heaps array in ascending order to use |