From: Michael Schuerig <michael@...>
Date: 2007-11-23T08:22:25+09:00
Subject: Re: Forcing file operations under a directory

On Thursday 22 November 2007, Xavier Noria wrote:
> On Nov 22, 2007, at 12:15 AM, Michael Schuerig wrote:
> > My concrete problem is rather more mundane and can probably be
> > solved easier. I have uploaded file data and paths where they ought
> > to be stored. I'd like to make sure that they don't escape from
> > underneath the top-level directory where they are supposed to stay.
>
> To accomplish this you sanitize the filename, then compute
> File.expand_path inside a Dir.chdir block (if relative filenames are
> allowed), and check whether the result is out of the root via String
> comparisons on the names (regexps, etc.)

Yes, thanks, that's more or less what I'm doing now and relative 
filenames are disallowed anyway.

Michael

-- 
Michael Schuerig
mailto:michael@schuerig.de
http://www.schuerig.de/michael/