From 6fcca972c8ff03e351dfe41bb8791608e4b608de Mon Sep 17 00:00:00 2001 From: antisnatchor Date: Wed, 25 Mar 2015 10:52:47 +0100 Subject: [PATCH] Removed patched Rack::File after upgrading to Rack 1.6.0. --- core/ruby/file.rb | 44 -------------------------------------------- 1 file changed, 44 deletions(-) delete mode 100644 core/ruby/file.rb diff --git a/core/ruby/file.rb b/core/ruby/file.rb deleted file mode 100644 index b40161033..000000000 --- a/core/ruby/file.rb +++ /dev/null @@ -1,44 +0,0 @@ -require 'time' -require 'rack/utils' -require 'rack/mime' - -module Rack - class File - def _call(env) - unless ALLOWED_VERBS.include? env["REQUEST_METHOD"] - return fail(405, "Method Not Allowed") - end - - @path_info = Utils.unescape(env["PATH_INFO"]) - parts = @path_info.split SEPS - - parts.inject(0) do |depth, part| - case part - when '', '.' - depth - when '..' - return fail(404, "Not Found") if depth - 1 < 0 - depth - 1 - else - depth + 1 - end - end - - @path = F.join(@root, *parts) - - available = begin - F.file?(@path) && F.readable?(@path) - rescue SystemCallError - false - end - - if available - serving(env) - else - # this is the patched line. No need to reflect the URI path, potential XSS - # exploitable if you can bypass the Content-type: text/plain (IE MHTML and tricks like that) - fail(404, "File not found") - end - end - end -end \ No newline at end of file