Merge pull request #1683 from cji-stripe/static_path_check

Validate expanded path matches public_dir when serving static files
sinatra · Mar 15, 2021 · cf40452 · cf40452
2 parents 936ea0b + 462c3ca
commit cf40452
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb
@@ -1090,6 +1090,7 @@ def static!(options = {})
       return unless valid_path?(path)
 
       path = File.expand_path(path)
+      return unless path.start_with?(File.expand_path(public_dir) + '/')
       return unless File.file?(path)
 
       env['sinatra.static_file'] = path

diff --git a/test/static_test.rb b/test/static_test.rb
@@ -97,6 +97,7 @@ class StaticTest < Minitest::Test
     mock_app do
       set :static, true
       set :public_folder, __dir__ + '/data'
+      disable :protection
     end
     get "/../#{File.basename(__FILE__)}"
     assert not_found?