Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion lib/roadie/filesystem_provider.rb
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,9 @@ def inspect() "#<#{self.class} #@path>" end
private
def build_file_path(name)
raise InsecurePathError, name if name.include?("..")
File.join(@path, name[/^([^?]+)/])
return "" unless (filename = name[/^([^?]+)/])

File.join(@path, filename)
end
end
end
9 changes: 9 additions & 0 deletions spec/lib/roadie/filesystem_provider_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -71,5 +71,14 @@ module Roadie
end
end
end

describe "ignore link hrefs which are not on filesystem" do
# <link rel="stylesheet" href="?__debugger__=yes&amp;cmd=resource&amp;f=style.css" type="text/css">
it 'do not raise TypeError' do
expect {
provider.find_stylesheet!("?__debugger__=yes&amp;cmd=resource&amp;f=style.css")
}.to raise_error CssNotFound
end
end
end
end