Class: Rack::Protection::PathTraversal

### Home Classes Methods

### In Files

- lib/rack/protection/path_traversal.rb

### Parent

Rack::Protection::Base

### Methods

- #call
- #cleanup

### Class/Module Index

Quicksearch

- Rack
- Rack::Protection
- Rack::Protection::AuthenticityToken
- Rack::Protection::Base
- Rack::Protection::EscapedParams
- Rack::Protection::FormToken
- Rack::Protection::FrameOptions
- Rack::Protection::HttpOrigin
- Rack::Protection::IPSpoofing
- Rack::Protection::JsonCsrf
- Rack::Protection::PathTraversal
- Rack::Protection::RemoteReferrer
- Rack::Protection::RemoteToken
- Rack::Protection::SessionHijacking
- Rack::Protection::VERSION
- Rack::Protection::XSSHeader

No matching classes.

# Rack::Protection::PathTraversal

Prevented attack | Directory traversal
Supported browsers | all
More infos | en.wikipedia.org/wiki/Directory_traversal

Unescapes '/' and '.', expands `path_info`. Thus `GET /foo/%2e%2e%2fbar` becomes `GET /bar`.

### Public Instance Methods

call(env) click to toggle source

    # File lib/rack/protection/path_traversal.rb, line 13
    def call(env)
      path_was         = env["PATH_INFO"]
      env["PATH_INFO"] = cleanup path_was if path_was && !path_was.empty?
      app.call env
    ensure
      env["PATH_INFO"] = path_was
    end

cleanup(path) click to toggle source

    # File lib/rack/protection/path_traversal.rb, line 21
    def cleanup(path)
      parts     = []
      unescaped = path.gsub('%2e', '.').gsub('%2f', '/')

      unescaped.split('/').each do |part|
        next if part.empty? or part == '.'
        part == '..' ? parts.pop : parts << part
      end

      cleaned = '/' << parts.join('/')
      cleaned << '/' if parts.any? and unescaped =~ /\/\.{0,2}$/
      cleaned
    end

[Validate]

Generated with the Darkfish Rdoc Generator 2.