Check to see if path is valid before cleaning

cyu / rack-cors

Rack Middleware for handling Cross-Origin Resource Sharing (CORS), which makes cross-origin AJAX possible.

MIT License

3.26k stars 263 forks source link

Check to see if path is valid before cleaning #194

Closed tragiclifestories closed 4 years ago

tragiclifestories commented 4 years ago

Strawman fix for #192. I will add tests if the approach is agreed in principle.

cyu commented 4 years ago

@tragiclifestories This is great, thanks!

I went ahead and merged this in – I was doing some more research, and saw a similar implementation here: https://github.com/rack/rack/blob/master/lib/rack/files.rb#L42.

I'm going to take your changes, remove the extra call to unescape and then change that call to use unescape_path. I'll then up the rack version in the process and bump this up a minor version.

Thanks for the PR and original report!