gotoyuzo	2008-03-03 23:31:30 +0900 (Mon, 03 Mar 2008)

  New Revision: 15676

  Modified files:
    trunk/ChangeLog
    trunk/lib/webrick/httpservlet/filehandler.rb
    trunk/test/webrick/test_filehandler.rb

  Log:
    * lib/webrick/httpservlet/filehandler.rb: should normalize path
      separators in path_info to prevent directory traversal
      attacks on DOSISH platforms.
      reported by Digital Security Research Group [DSECRG-08-026].
    
    * lib/webrick/httpservlet/filehandler.rb: pathnames which have
      not to be published should be checked case-insensitively.


  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/test/webrick/test_filehandler.rb?r1=15676&r2=15675&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ChangeLog?r1=15676&r2=15675&diff_format=u
  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/lib/webrick/httpservlet/filehandler.rb?r1=15676&r2=15675&diff_format=u