usa	2017-12-14 22:36:50 +0900 (Thu, 14 Dec 2017)

  New Revision: 61241

  https://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=61241

  Log:
    merge revision(s) 61197: [Backport #14184]
    
    webrick: compile RE correctly for beginning and end match
    
    Using ^ and $ in regexps means we can accidentally get fooled
    by "%0a" in HTTP request paths being decoded to newline
    characters.  Use \A and \z to match beginning and end-of-string
    respectively, instead.
    
    Thanks to mame and hsbt for reporting.
    
    * lib/webrick/httpserver.rb (MountTable#compile):
      use \A and \z instead of ^ and $
    * lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $
    * test/webrick/test_httpserver.rb (test_cntrl_in_path): new test

  Modified directories:
    branches/ruby_2_3/
  Modified files:
    branches/ruby_2_3/ChangeLog
    branches/ruby_2_3/lib/webrick/httpserver.rb
    branches/ruby_2_3/test/webrick/test_httpserver.rb
    branches/ruby_2_3/version.h
Index: ruby_2_3/ChangeLog
===================================================================
--- ruby_2_3/ChangeLog	(revision 61240)
+++ ruby_2_3/ChangeLog	(revision 61241)
@@ -1,3 +1,19 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_3/ChangeLog#L1
+Thu Dec 14 22:35:19 2017  Eric Wong  <normalperson@y...>
+
+	webrick: compile RE correctly for beginning and end match
+
+	Using ^ and $ in regexps means we can accidentally get fooled
+	by "%0a" in HTTP request paths being decoded to newline
+	characters.  Use \A and \z to match beginning and end-of-string
+	respectively, instead.
+
+	Thanks to mame and hsbt for reporting.
+
+	* lib/webrick/httpserver.rb (MountTable#compile):
+	  use \A and \z instead of ^ and $
+	* lib/webrick/httpserver.rb (MountTable#normalize): use \z instead of $
+	* test/webrick/test_httpserver.rb (test_cntrl_in_path): new test
+
 Thu Dec 14 22:29:04 2017  Eric Wong  <normalperson@y...>
 
 	webrick: do not hang acceptor on slow TLS connections
Index: ruby_2_3/lib/webrick/httpserver.rb
===================================================================
--- ruby_2_3/lib/webrick/httpserver.rb	(revision 61240)
+++ ruby_2_3/lib/webrick/httpserver.rb	(revision 61241)
@@ -267,12 +267,12 @@ module WEBrick https://github.com/ruby/ruby/blob/trunk/ruby_2_3/lib/webrick/httpserver.rb#L267
         k.sort!
         k.reverse!
         k.collect!{|path| Regexp.escape(path) }
-        @scanner = Regexp.new("^(" + k.join("|") +")(?=/|$)")
+        @scanner = Regexp.new("\\A(" + k.join("|") +")(?=/|\\z)")
       end
 
       def normalize(dir)
         ret = dir ? dir.dup : ""
-        ret.sub!(%r|/+$|, "")
+        ret.sub!(%r|/+\z|, "")
         ret
       end
     end
Index: ruby_2_3/version.h
===================================================================
--- ruby_2_3/version.h	(revision 61240)
+++ ruby_2_3/version.h	(revision 61241)
@@ -1,6 +1,6 @@ https://github.com/ruby/ruby/blob/trunk/ruby_2_3/version.h#L1
 #define RUBY_VERSION "2.3.6"
 #define RUBY_RELEASE_DATE "2017-12-14"
-#define RUBY_PATCHLEVEL 381
+#define RUBY_PATCHLEVEL 382
 
 #define RUBY_RELEASE_YEAR 2017
 #define RUBY_RELEASE_MONTH 12
Index: ruby_2_3/test/webrick/test_httpserver.rb
===================================================================
--- ruby_2_3/test/webrick/test_httpserver.rb	(revision 61240)
+++ ruby_2_3/test/webrick/test_httpserver.rb	(revision 61241)
@@ -410,4 +410,29 @@ class TestWEBrickHTTPServer < Test::Unit https://github.com/ruby/ruby/blob/trunk/ruby_2_3/test/webrick/test_httpserver.rb#L410
     }
     assert_equal(0, requested, "Server responded to #{requested} requests after shutdown")
   end
+
+  def test_cntrl_in_path
+    log_ary = []
+    access_log_ary = []
+    config = {
+      :Port => 0,
+      :BindAddress => '127.0.0.1',
+      :Logger => WEBrick::Log.new(log_ary, WEBrick::BasicLog::WARN),
+      :AccessLog => [[access_log_ary, '']],
+    }
+    s = WEBrick::HTTPServer.new(config)
+    s.mount('/foo', WEBrick::HTTPServlet::FileHandler, __FILE__)
+    th = Thread.new { s.start }
+    addr = s.listeners[0].addr
+
+    http = Net::HTTP.new(addr[3], addr[1])
+    req = Net::HTTP::Get.new('/notexist%0a/foo')
+    http.request(req) { |res| assert_equal('404', res.code) }
+    exp = %Q(ERROR `/notexist\\n/foo' not found.\n)
+    assert_equal 1, log_ary.size
+    assert log_ary[0].include?(exp)
+  ensure
+    s&.shutdown
+    th&.join
+  end
 end
Index: ruby_2_3
===================================================================
--- ruby_2_3	(revision 61240)
+++ ruby_2_3	(revision 61241)

Property changes on: ruby_2_3
___________________________________________________________________
Modified: svn:mergeinfo
## -0,0 +0,1 ##
   Merged /trunk:r61197

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/