Skip to content

Instantly share code, notes, and snippets.

@tmtm
Last active December 16, 2015 12:18
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save tmtm/5433102 to your computer and use it in GitHub Desktop.
Save tmtm/5433102 to your computer and use it in GitHub Desktop.
Rack アプリで、URL のパス(PATH_INFO)中に `%FF` が入っていたり、クエリ文字列(QUERY_STRING)中に `%FF=hoge` が入っていても Invalid byte sequence で落ちないようにするパッチ
require 'rack/utils'
require 'rack/protection/path_traversal'
module Rack
module Utils
orig_normalize_params_singleton = method(:normalize_params)
define_singleton_method(:normalize_params) do |params, name, *args|
return unless name && name.valid_encoding?
orig_normalize_params_singleton.call(params, name, *args)
end
orig_normalize_params = instance_method(:normalize_params)
define_method(:normalize_params) do |params, name, *args|
return unless name && name.valid_encoding?
orig_normalize_params.bind(self).call(params, name, *args)
end
end
module Protection
class PathTraversal
orig_cleanup = instance_method(:cleanup)
define_method(:cleanup) do |path|
orig_cleanup.bind(self).call(path).force_encoding('ASCII-8BIT')
end
end
end
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment