fix: Path traversal at SwaggerController (#6205)

2023-01-13 03:14:21 +09:00
parent 9bbadc2388
commit 9e4a5d028c
1 changed files with 2 additions and 2 deletions
--- a/app/controllers/swagger_controller.rb
+++ b/app/controllers/swagger_controller.rb
@@ -11,8 +11,8 @@ class SwaggerController < ApplicationController

  def derived_path
    params[:path] ||= 'index.html'
-    path = params[:path]
-    path << ".#{params[:format]}" unless path.ends_with?(params[:format].to_s)
+    path = Rack::Utils.clean_path_info(params[:path])
+    path << ".#{Rack::Utils.clean_path_info(params[:format])}" unless path.ends_with?(params[:format].to_s)
    path
  end
 end