From 0e89a37eaf7a426181b489fe0325081f4b7cda66 Mon Sep 17 00:00:00 2001 From: Parker Moore Date: Sun, 7 Feb 2016 17:53:09 -0800 Subject: [PATCH] Revert "Jekyll.sanitized_path: sanitizing a questionable path should handle tildes" This reverts commit 246e65914ffef6affb7b699de6fcd496168c332e. --- lib/jekyll.rb | 3 +-- test/test_path_sanitization.rb | 9 --------- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/lib/jekyll.rb b/lib/jekyll.rb index 6896bb0b..8b92a045 100644 --- a/lib/jekyll.rb +++ b/lib/jekyll.rb @@ -153,9 +153,8 @@ module Jekyll def sanitized_path(base_directory, questionable_path) return base_directory if base_directory.eql?(questionable_path) - questionable_path.insert(0, '/') if questionable_path.start_with?('~') clean_path = File.expand_path(questionable_path, "/") - clean_path.sub!(/\A\w\:\//, '/') + clean_path = clean_path.sub(/\A\w\:\//, '/') if clean_path.start_with?(base_directory.sub(/\A\w\:\//, '/')) clean_path diff --git a/test/test_path_sanitization.rb b/test/test_path_sanitization.rb index 148103ea..b04a2bad 100644 --- a/test/test_path_sanitization.rb +++ b/test/test_path_sanitization.rb @@ -15,13 +15,4 @@ class TestPathSanitization < JekyllUnitTest assert_equal "/tmp/foobar/jail/..c:/..c:/..c:/etc/passwd", Jekyll.sanitized_path("/tmp/foobar/jail", "..c:/..c:/..c:/etc/passwd") end end - - should "escape tilde" do - assert_equal source_dir("~hi.txt"), Jekyll.sanitized_path(source_dir, "~hi.txt") - assert_equal source_dir("files", "~hi.txt"), Jekyll.sanitized_path(source_dir, "files/../files/~hi.txt") - end - - should "remove path traversals" do - assert_equal source_dir("files", "hi.txt"), Jekyll.sanitized_path(source_dir, "f./../../../../../../files/hi.txt") - end end