From 043a865ecbee7bddcc7ef87ec7a156f09796c223 Mon Sep 17 00:00:00 2001 From: Harsh Jaiswal Date: Wed, 7 Apr 2021 18:20:17 +0530 Subject: [PATCH] Update Ruby-tempfile-mktmpdir-PT.md --- Ruby-tempfile-mktmpdir-PT.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Ruby-tempfile-mktmpdir-PT.md b/Ruby-tempfile-mktmpdir-PT.md index 79f6089..2433537 100644 --- a/Ruby-tempfile-mktmpdir-PT.md +++ b/Ruby-tempfile-mktmpdir-PT.md @@ -6,7 +6,7 @@ While playing around Ruby we noticed that Ruby's Tempfile/mktmpdir were allowing ### CVE-2018-6914 Patch analysis -A similar issue was previously reported by @oooooo_q for Linux, where `/` could be used which made path traversal possible on both Linux and Windows. We looked at the patch of this bug, which was relatively straight forward, delete `/` (File::SEPARATOR) and `\` (File::ALT_SEPARATOR, set on windows only) from the input before creating the file. +A similar issue was previously reported by [@ooooooo_q](https://twitter.com/ooooooo_q) for Linux, where `/` could be used which made path traversal possible on both Linux and Windows. We looked at the patch of this bug, which was relatively straight forward, delete `/` (File::SEPARATOR) and `\` (File::ALT_SEPARATOR, set on windows only) from the input before creating the file. ```patch --- lib/tmpdir.rb