admin/httpvoid-writeups
1
0
Fork 0
mirror of https://github.com/httpvoid/writeups synced 2026-06-08 14:43:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Ruby-tempfile-mktmpdir-PT.md

Browse Source
This commit is contained in:
Harsh Jaiswal
2021-04-07 18:20:17 +05:30
committed by GitHub
parent 763f060d1b
commit 043a865ecb
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Ruby-tempfile-mktmpdir-PT.md
+1 -1
View File
@@ -6,7 +6,7 @@ While playing around Ruby we noticed that Ruby's Tempfile/mktmpdir were allowing
### CVE-2018-6914 Patch analysis
A similar issue was previously reported by @oooooo_q for Linux, where `/` could be used which made path traversal possible on both Linux and Windows. We looked at the patch of this bug, which was relatively straight forward, delete `/` (File::SEPARATOR) and `\` (File::ALT_SEPARATOR, set on windows only) from the input before creating the file.
A similar issue was previously reported by [@ooooooo_q](https://twitter.com/ooooooo_q) for Linux, where `/` could be used which made path traversal possible on both Linux and Windows. We looked at the patch of this bug, which was relatively straight forward, delete `/` (File::SEPARATOR) and `\` (File::ALT_SEPARATOR, set on windows only) from the input before creating the file.
```patch
--- lib/tmpdir.rb