Commit9905ca9

authored and

committed

Fix directory traversal in Timezone.get when using Ruby data source

1 parent07b5941 commit9905ca9Copy full SHA for 9905ca9

File tree

-2

lines changed

-2

lines changed

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -38,7 +38,7 @@ def initialize`
`38`	`38`	`# Raises InvalidTimezoneIdentifier if the timezone is not found or the`
`39`	`39`	`# identifier is invalid.`
`40`	`40`	`defload_timezone_info(identifier)`
`41`		`-raiseInvalidTimezoneIdentifier,'Invalid identifier'ifidentifier !~/^[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*$/`
	`41`	`+raiseInvalidTimezoneIdentifier,'Invalid identifier'ifidentifier !~/\A[A-Za-z0-9\+\-_]+(\/[A-Za-z0-9\+\-_]+)*\z/`
`42`	`42`
`43`	`43`	`identifier=identifier.gsub(/-/,'__m__').gsub(/\+/,'__p__')`
`44`	`44`

Lines changed: 1 addition & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+raise'This should never be executed'`

Lines changed: 6 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -51,6 +51,12 @@ def test_load_timezone_info_invalid`
`51`	`51`	`@data_source.load_timezone_info('../Definitions/UTC')`
`52`	`52`	`end`
`53`	`53`	`end`
	`54`	`+`
	`55`	`+deftest_load_timezone_info_directory_traversal`
	`56`	`+test_data_depth=TZINFO_TEST_DATA_DIR.scan('/').size`
	`57`	`+payload_path=File.join(TESTS_DIR,'assets','payload')`
	`58`	`+assert_raises(InvalidTimezoneIdentifier){Timezone.get("foo\n#{'/..' *(test_data_depth +4)}#{payload_path}")}`
	`59`	`+end`
`54`	`60`
`55`	`61`	`deftest_load_timezone_info_nil`
`56`	`62`	`assert_raises(InvalidTimezoneIdentifier)do`

Lines changed: 1 addition & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -213,7 +213,7 @@ def test_get_not_exist`
`213`	`213`	`end`
`214`	`214`
`215`	`215`	`deftest_get_invalid`
`216`		`-assert_raises(InvalidTimezoneIdentifier){Timezone.get('../Definitions/UTC')}`
	`216`	`+assert_raises(InvalidTimezoneIdentifier){Timezone.get('../definitions/UTC')}`
`217`	`217`	`end`
`218`	`218`
`219`	`219`	`deftest_get_nil`

Comments

(0)