shyouhei	2008-06-15 23:04:14 +0900 (Sun, 15 Jun 2008)

  New Revision: 17302

  Modified files:
    branches/ruby_1_8_5/ChangeLog

  Log:
    add ChangeLog entries

  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/branches/ruby_1_8_5/ChangeLog?r1=17302&r2=17301&diff_format=u

Index: ruby_1_8_5/ChangeLog
===================================================================
--- ruby_1_8_5/ChangeLog	(revision 17301)
+++ ruby_1_8_5/ChangeLog	(revision 17302)
@@ -1,3 +1,28 @@
+Sun Jun 15 22:54:39 2008  GOTOU Yuuzou  <gotoyuzo@n...>
+
+	* lib/webrick/httpservlet/filehandler.rb: should normalize path
+	  name in path_info to prevent script disclosure vulnerability on
+	  DOSISH filesystems. (fix: CVE-2008-1891)
+	  Note: NTFS/FAT filesystem should not be published by the platforms
+	  other than Windows. Pathname interpretation (including short
+	  filename) is less than perfect.
+
+	* lib/webrick/httpservlet/abstract.rb
+	  (WEBrick::HTTPServlet::AbstracServlet#redirect_to_directory_uri):
+	  should escape the value of Location: header.
+
+	* lib/webrick/httpservlet/cgi_runner.rb: accept interpreter
+	  command line arguments.
+
+Sun Jun 15 22:54:39 2008  Nobuyoshi Nakada  <nobu@r...>
+
+	* file.c (file_expand_path): support for alternative data stream
+	  and ignored trailing garbages of NTFS.
+
+	* file.c (rb_file_s_basename): ditto.
+
+	* file.c (rb_file_s_extname): ditto.
+
 Sun Jun 15 22:52:24 2008  Yukihiro Matsumoto  <matz@r...>
 
 	* string.c (rb_str_cat): fixed buffer overrun reported by

--
ML: ruby-changes@q...
Info: http://www.atdot.net/~ko1/quickml/