(October 8, 2022, 07:48 PM)achillescarter Wrote: https://security.snyk.io/vuln/SNYK-RUBY-SINATRA-22017
i don't think this works, it doesnt work for me unless you got it working? it gives me a 400.
I also think there is something preventing this from happening:
#
# Unescapes '/' and '.', expands +path_info+.
# Thus <tt>GET /foo/%2e%2e%2fbar</tt> becomes <tt>GET /bar</tt>.
class PathTraversal < Base
def call(env)
path_was = env["PATH_INFO"]
env["PATH_INFO"] = cleanup path_was if path_was && !path_was.empty?
app.call env
ensure
env["PATH_INFO"] = path_was
end
but then again I could be reading it wrong lmao
