From 009e2c200d7e43612b16c62f84a0321bde12503b Mon Sep 17 00:00:00 2001 From: Parker Moore Date: Thu, 27 Mar 2014 18:19:35 -0400 Subject: [PATCH] Only strip the drive name if it begins the string. --- lib/jekyll.rb | 2 +- test/test_path_sanitization.rb | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/jekyll.rb b/lib/jekyll.rb index 5caea137..90147ac3 100644 --- a/lib/jekyll.rb +++ b/lib/jekyll.rb @@ -111,7 +111,7 @@ module Jekyll def self.sanitized_path(base_directory, questionable_path) clean_path = File.expand_path(questionable_path, fs_root) - clean_path.gsub!(/\w\:\//, '/') + clean_path.gsub!(/\A\w\:\//, '/') unless clean_path.start_with?(base_directory) File.join(base_directory, clean_path) else diff --git a/test/test_path_sanitization.rb b/test/test_path_sanitization.rb index 8d753808..fa10e876 100644 --- a/test/test_path_sanitization.rb +++ b/test/test_path_sanitization.rb @@ -10,5 +10,9 @@ class TestPathSanitization < Test::Unit::TestCase should "strip drive name from path" do assert_equal "C:/Users/xmr/Desktop/mpc-hc.org/_site", Jekyll.sanitized_path(@source, @dest) end + + should "strip just the initial drive name" do + assert_equal "/tmp/foobar/jail/..c:/..c:/..c:/etc/passwd", Jekyll.sanitized_path("/tmp/foobar/jail", "..c:/..c:/..c:/etc/passwd") + end end end