Skip to content

Instantly share code, notes, and snippets.

@nihen
Created October 19, 2009 13:57
Show Gist options
  • Save nihen/213392 to your computer and use it in GitHub Desktop.
Save nihen/213392 to your computer and use it in GitHub Desktop.
diff --git a/lib/Plack/App/File.pm b/lib/Plack/App/File.pm
index 1df4f74..8a64b98 100644
--- a/lib/Plack/App/File.pm
+++ b/lib/Plack/App/File.pm
@@ -9,7 +9,7 @@ use HTTP::Date;
use MIME::Types;
use Cwd ();
-__PACKAGE__->mk_accessors(qw( root encoding ));
+__PACKAGE__->mk_accessors(qw( root encoding followsymlinks));
sub should_handle {
my($self, $file) = @_;
@@ -29,9 +29,17 @@ sub call {
my $file = $docroot->file(File::Spec::Unix->splitpath($path));
my $realpath = Cwd::realpath($file->absolute->stringify);
- # Is the requested path within the root?
- if ($realpath && !$docroot->subsumes($realpath)) {
- return $self->return_403;
+ if ( !$self->followsymlinks ) {
+ # Is the requested path within the root?
+ if ($realpath && !$docroot->subsumes($realpath)) {
+ return $self->return_403;
+ }
+ }
+ else {
+ # followsymlinks?
+ if ($realpath && !$docroot->subsumes($file->absolute)) {
+ return $self->return_403;
+ }
}
# Does the file actually exist?
diff --git a/lib/Plack/Middleware/Static.pm b/lib/Plack/Middleware/Static.pm
index b900177..fda5641 100644
--- a/lib/Plack/Middleware/Static.pm
+++ b/lib/Plack/Middleware/Static.pm
@@ -4,7 +4,7 @@ use warnings;
use parent qw/Plack::Middleware/;
use Plack::App::File;
-__PACKAGE__->mk_accessors(qw( path root encoding ));
+__PACKAGE__->mk_accessors(qw( path root encoding followsymlinks));
sub call {
my $self = shift;
@@ -33,7 +33,7 @@ sub _handle_static {
$_;
} or return;
- $self->{file} ||= Plack::App::File->new({ root => $self->root || '.', encoding => $self->encoding });
+ $self->{file} ||= Plack::App::File->new({ root => $self->root || '.', encoding => $self->encoding, followsymlinks => $self->followsymlinks });
return $self->{file}->call({ %$env, PATH_INFO => $path }) # rewrite PATH
}
diff --git a/t/Plack-Middleware/static.t b/t/Plack-Middleware/static.t
index a1c52dc..a52fa2a 100644
--- a/t/Plack-Middleware/static.t
+++ b/t/Plack-Middleware/static.t
@@ -18,6 +18,8 @@ my $handler = builder {
enable "Plack::Middleware::Static",
path => sub { s!^/share/!!}, root => "$base/share";
enable "Plack::Middleware::Static",
+ path => qr{lnok\.txt$}i, root => '.', followsymlinks => 1;
+ enable "Plack::Middleware::Static",
path => qr{\.(t|PL|txt)$}i, root => '.';
sub {
[200, ['Content-Type' => 'text/plain', 'Content-Length' => 2], ['ok']]
@@ -64,6 +66,17 @@ my %test = (
my($ct, $charset) = $res->content_type;
is $charset, 'charset=utf-8';
}
+
+ {
+ my $res = $cb->(GET "http://localhost/Plack-Middleware/staticlnng.txt");
+ is $res->code, 403, 'no followsymlinks';
+ }
+ {
+ my $res = $cb->(GET "http://localhost/Plack-Middleware/staticlnok.txt");
+ is $res->content_type, 'text/plain';
+ my($ct, $charset) = $res->content_type;
+ is $charset, 'charset=utf-8';
+ }
},
app => $handler,
);
diff --git a/t/Plack-Middleware/staticlnng.txt b/t/Plack-Middleware/staticlnng.txt
new file mode 120000
index 0000000..3594e94
--- /dev/null
+++ b/t/Plack-Middleware/staticlnng.txt
@@ -0,0 +1 @@
+/etc/passwd
\ No newline at end of file
diff --git a/t/Plack-Middleware/staticlnok.txt b/t/Plack-Middleware/staticlnok.txt
new file mode 120000
index 0000000..d8fdad3
--- /dev/null
+++ b/t/Plack-Middleware/staticlnok.txt
@@ -0,0 +1 @@
+static.txt
\ No newline at end of file
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment