CVE-2013-0262 harness.rb

require 'pp'

SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)

def inspectPath(path_info)
  parts = path_info.split SEPS
  parts.inject(0) do |depth, part|
    case part
      when '', '.'
        depth
      when '..'
        throw 'climb-out detected' if depth - 1 < 0
        depth - 1
      else
        depth + 1
      end
  end
  parts
end

pp inspectPath('./..')