diff --git a/lib/roadie/filesystem_provider.rb b/lib/roadie/filesystem_provider.rb index 46ab72e..d7fe09a 100644 --- a/lib/roadie/filesystem_provider.rb +++ b/lib/roadie/filesystem_provider.rb @@ -40,7 +40,9 @@ def inspect() "#<#{self.class} #@path>" end private def build_file_path(name) raise InsecurePathError, name if name.include?("..") - File.join(@path, name[/^([^?]+)/]) + return "" unless (filename = name[/^([^?]+)/]) + + File.join(@path, filename) end end end diff --git a/spec/lib/roadie/filesystem_provider_spec.rb b/spec/lib/roadie/filesystem_provider_spec.rb index ff24e9d..85f1ea1 100644 --- a/spec/lib/roadie/filesystem_provider_spec.rb +++ b/spec/lib/roadie/filesystem_provider_spec.rb @@ -71,5 +71,14 @@ module Roadie end end end + + describe "ignore link hrefs which are not on filesystem" do + # + it 'do not raise TypeError' do + expect { + provider.find_stylesheet!("?__debugger__=yes&cmd=resource&f=style.css") + }.to raise_error CssNotFound + end + end end end