From: Mariano Kamp <mariano.kamp@...>
Date: 2006-06-06T00:02:09+09:00
Subject: Re: New webserver

Stuart Brand wrote:
> def self.path(path)
> fileLine = path[1].strip
> fileLine = fileLine.gsub(/\.\//, '')
> fileLine = fileLine.gsub(/\/\./, '')
> fileLine = fileLine.gsub(/\\/, '')
> fileLine = fileLine.gsub(/\.{2,}/, '')
> fileLine = fileLine.gsub(/\/{2,}/, '')
> fileLine = "/srv/www/htdocs/" + fileLine
> return fileLine
> end
> 
> Is there a way of making it look prettier?
> 
> I'm trying to stop people using the address bar to access parts of the 
> system the should not
Stuart,

   why do you try to solve this problem on the string level?

   Wouldn't it make more sense to rely on the OS authorization scheme? 
On Unix you can set permissions on files and directories. You can also 
start a server using chroot so that nobody can break out (i.e. go up) of 
the designated directory/sandbox.

   If you go for the string way, you might need to check if different 
encodings of URIs can bust you regexps.

Cheers,
Mariano