Prevent symlink path traversals

 * Closes CVE-2013-0262

1 files changed, 6 insertions, 11 deletions

diff --git a/lib/rack/file.rb b/lib/rack/file.rb
index 090a0015..ee58a1a7 100644
--- a/lib/rack/file.rb
+++ b/lib/rack/file.rb
@@ -41,19 +41,14 @@ module Rack
       path_info = Utils.unescape(env["PATH_INFO"])
       parts = path_info.split SEPS
 
-      parts.inject(0) do |depth, part|
-        case part
-        when '', '.'
-          depth
-        when '..'
-          return fail(404, "Not Found") if depth - 1 < 0
-          depth - 1
-        else
-          depth + 1
-        end
+      clean = []
+
+      parts.each do |part|
+        next if part.empty? || part == '.'
+        part == '..' ? clean.pop : clean << part
       end
 
-      @path = F.join(@root, *parts)
+      @path = F.join(@root, *clean)
 
       available = begin
         F.file?(@path) && F.readable?(@path)